Glossary

A · B · C · D · E · F · H · I · M · N · O · P · Q · R · S · T · V · W

A

Anti-Money Laundering Authority (AMLA)

The new EU body in Frankfurt, set up under Regulation (EU) 2024/1620, that sits above the national AML supervisors. The MLRO must bring procedures revised for the AML Regulation to the Board before 10 July 2027. Binder §7.7 · Chapter 7

Anti-money-laundering (AML) rules

The law against moving criminal money through financial firms. For crypto-asset firms it is Directive (EU) 2015/849, as amended by Directive (EU) 2018/843, which made them obliged entities. From 10 July 2027 the AML Regulation (EU) 2024/1624 applies to Halcyon directly and replaces the national rules. Binder §7 · Binder §7.7 · Chapter 7

Asset-referenced token (ART)

A crypto-asset, other than an EMT, that claims to keep a stable value by referencing another value or right, or a combination of them (MiCA Article 3(1)(6)). A token pegged to a basket of currencies is the usual example. Its issuer needs authorisation (Article 16) and must hold a reserve of assets, real assets backing the token, so that holders can be paid out (Article 36). Halcyon admits an ART only where the issuer is authorised. Definition: ART · Binder §10.4 · Chapter 2 · Chapter 5

Authorisation

The regulator's written permission to provide named crypto-asset services; everyone in the office calls it the licence. The applicant must be a legal person with its registered office and its effective management in the EU (MiCA Article 59). Effective management means the people who actually run it; a letterbox is refused. The file is set by Article 62 and begins with the programme of operations: which services, for which clients, in which countries, with a three-year business plan. The Central Bank of Ireland authorised Halcyon on 12 November 2025 for five services. Binder §1.1 · Appendix A · Chapter 3

B

Breach log

The MLRO's record of every failure under the AML rules and the Travel Rule: what happened, its scale, root cause, remediation, and whether it is also an ICT incident. Each entry is made on the day of detection, and the log goes to the Board each quarter. The 214 transfers of 9 February 2026 went in it, because there was no outage and no client loss. Binder §7.6 · Chapter 7

Business day and working day

In the Binder a business day is a day banks in Dublin are open. Article 63 counts the regulator's clocks in working days: days the Central Bank is open, so not weekends or public holidays. The passport's 15 days, by contrast, are calendar days (Article 65). Binder, what this binder is §3 · Chapter 3

C

CASP

A crypto-asset service provider: an undertaking whose business is providing crypto-asset services to clients professionally (MiCA Article 3(1)(15)). In plain words, the company that holds, trades or moves crypto-assets for other people. Halcyon has been one since 12 November 2025. Definition: CASP · Binder §1.1 · Chapter 1 · Chapter 2

Change control

The rule that no production system is changed without a record approved first: what, why, risk, tests, rollback, approver. Compliance signs off any change to custody, transfers, reconciliation or surveillance. A change made outside the rule is itself an incident, and was the root cause of the Travel Rule failure of 9 February 2026. Binder §9.2 · Chapter 7 · Chapter 9

Class 1, Class 2 and Class 3

MiCA's three classes of CASP under Annex IV, each with a minimum figure for own funds. Class 1 covers execution, placing, reception and transmission, advice, portfolio management and transfer: €50,000. Class 2 adds custody or exchange: €125,000. Class 3 adds operation of a trading platform: €150,000. Halcyon is Class 2 and would become Class 3 with an order book; neither floor bites, because one quarter of its fixed overheads is €1,600,000. Binder §3.1 · Appendix B.1 · Chapter 3 · Chapter 10

Client funds

A client's euro in Halcyon's hands, and still the client's. MiCA requires them to be placed at a credit institution by the end of the business day after receipt (Article 70). The account is held for clients, separate from Halcyon's own, and never used on its own account. Halcyon held €6,200,000 of them at 30 September 2025. Binder §4.3 · Chapter 5

Complaint

Any expression of dissatisfaction by a client about a Halcyon service, whether or not the word appears. Halcyon accepts it free and in writing, must handle complaints under a written procedure (MiCA Article 71); under the Binder it acknowledges within 5 business days and decides within 15, or within 35 with written reasons. A client not satisfied, or without a decision in time, may go to the Financial Services and Pensions Ombudsman, Ireland's independent and free dispute-resolution body. Binder §6.1 · Binder §6.3 · Binder §6.5 · Chapter 4

Compliance Binder

"The Binder": the internal policies Halcyon keeps because MiCA, DORA and the AML regime require them, with two client-facing extracts appended. Version 3.1, approved by the Board on 12 November 2025, owned by the Head of Compliance, next review 12 November 2026. A policy changes only by Board resolution. It is the evidence that the conditions of the licence are being met. Binder, what this binder is §1 · Chapter 1 · Chapter 10

Conflict of interest

A situation where Halcyon's interest, or one client's, pulls against another client's: trading as principal against a client, staff holding what clients trade, a fee that rewards the wrong choice. Halcyon must identify each one, prevent or manage it, and publish on its website the general nature and sources of its conflicts and what it does about them (MiCA Article 72). The Head of Compliance keeps the register of conflicts; where a conflict cannot be managed, the Binder adds a warning to that client before the service, which is the last resort. Binder §5.1 · Binder §5.4 · Chapter 4

Credit institution

The law's word for a bank. Client funds must sit at one (MiCA Article 70). Only a credit institution or an electronic money institution may issue an electronic money token (Article 48). The bank that holds Halcyon's client funds is not named in this course. Binder §4.3 · Chapter 1 · Chapter 5

Crypto-asset

A digital representation of a value or of a right that is able to be transferred and stored electronically using distributed ledger technology or similar technology (MiCA Article 3(1)(5)). In plain words, a token on a shared ledger. It is three things at once: the record on the ledger, the value or right it stands for, and the key that controls it. Definition: Crypto-asset · Chapter 1

Crypto-asset service

Any of the ten services MiCA lists in Article 3(1)(16). The ten: custody and administration; operation of a trading platform; exchange for funds; exchange for other crypto-assets; execution of orders; placing; reception and transmission of orders; advice; portfolio management; transfer services. Halcyon holds five of them. Appendix B of the Binder is the register. Definition: Crypto-asset service · Appendix B · Chapter 2

Custody and administration

Holding crypto-assets, or the keys to them, for clients: the first of Halcyon's five services (MiCA Article 75). The custodian keeps a register of positions and a custody policy, and segregates client wallets from its own. It is liable for a loss of crypto-assets, or of the means of access to them, up to their market value. Clients' crypto-assets in Halcyon's custody were €94,000,000 at 30 September 2025. Binder §4.1 · Binder §4.6 · Chapter 1 · Chapter 5

Customer due diligence (CDD)

Checking who a client is before doing anything for them: identity from an official document and a live image, address, screening against sanctions and politically-exposed-person lists, and a risk rating. A high-risk client gets enhanced due diligence: evidence of where the money comes from, the MLRO's approval, closer monitoring. No client trades, deposits or withdraws until it is complete. Binder §7.2 · Chapter 7

D

Distributed ledger

A shared record kept at the same time by many computers that do not trust each other, updated by agreement, so that no single owner controls it. The best-known kind is a blockchain; MiCA says "or similar technology" to cover the next invention (Article 3(1)(5)). A token is an entry on that ledger: so many units, at such-and-such an address. Definition: Crypto-asset · Chapter 1 · Chapter 2

DORA

The Digital Operational Resilience Act, Regulation (EU) 2022/2554: the EU's law on keeping financial firms' technology running and their data safe, applying from 17 January 2025. It names CASPs among the financial entities it binds (Article 2(1)(f)), so Halcyon obeys a law written with banks in mind. Its subjects are the ICT risk management framework, incidents and their reporting, testing, and third-party providers. Binder §9 · Chapter 9

E

Electronic money institution (EMI)

A licensed non-bank that issues prepaid electronic balances, e-money, under the EU's electronic-money rules. With a credit institution, it is the only kind of firm that may issue an electronic money token (MiCA Article 48). Halcyon is not one; becoming one would be a second authorisation with its own capital and safeguarding regime. Its clients' euro balances come from Brightwater Payments Limited, an Irish EMI, instead. Binder §1.3 · Chapter 2 · Chapter 5

Electronic money token (EMT)

A crypto-asset that claims to keep a stable value by referencing one official currency, such as the euro (MiCA Article 3(1)(7)): what the market calls a stablecoin. Only a credit institution or an electronic money institution may issue one (Article 48). Holders may redeem at par at any time (Article 49) and are paid no interest (Article 50). That is why the Board dropped "HalcyonEUR" on 18 February 2026. Definition: EMT · Binder §10.4 · Chapter 5

Exchange, and execution of orders

Two services that look alike on a screen. Exchange means Halcyon itself is on the other side: it sells you a coin from its own stock at a firm price, or buys yours (MiCA Article 77). Execution of orders means Halcyon gets your trade done wherever the best result is, without being the other side (Article 78). Halcyon holds both. Appendix B · Chapter 2

F

Fitness and probity

Ireland's name for MiCA's requirement that management be fit and proper: of good repute, with the knowledge and the time to run a regulated firm (Article 68). The Head of Legal keeps a fitness-and-probity file for each director and senior manager: identity, checks, declared interests and the Central Bank's response. A missing director's file was one of the three gaps of 9 April 2025. The new independent director's file stopped the clock for 20 working days that September. Binder §2.2 · Appendix A.4 · Chapter 3 · Chapter 4

H

Home authority and host authority

The home authority is the regulator that authorised a CASP and supervises it; Halcyon's is the Central Bank of Ireland. A host authority is the regulator of another member state where the CASP serves clients under the passport (MiCA Article 65). It is told what the CASP is doing there, never asked to approve it. Halcyon's six host states were notified on 20 January 2026. Binder §1.4 · Chapter 6

I

ICT-related incident

Any event that harms Halcyon's systems, networks or data: a failed update, a breach, a vendor outage. "ICT" means information and communication technology: the systems, the networks and the data. Every incident is logged with its time of detection and managed under DORA Article 17. It is then classified against the Article 18 criteria — clients affected, duration, geography, data lost, criticality, economic impact — to decide whether it is major. Binder §9.3 · Chapter 9

ICT risk management framework

The written rules, systems and controls that keep Halcyon's technology running and its data safe (DORA Article 6). The framework covers identification, protection, detection, response, recovery, learning and communication (Articles 8–14). The Board approves it, reviews it each year and after every major incident, and stays accountable for it (Article 5). Binder §9.1 · Chapter 9

ICT third-party provider

Any outside company supplying technology to Halcyon. Every contract with one goes in the register of information (DORA Article 28(3)). It must also carry the Article 30 terms: service levels, rights of access and audit, help in an incident, sub-contracting conditions, termination and exit assistance. A critical provider is one whose failure would stop a service; for each, the CTO keeps an exit plan, tested on paper each year. Keystone Vault Technologies BV, which runs the signing service for client wallets, is first on the list. Binder §9.6 · Binder §9.7 · Binder §4.5 · Chapter 9

Inside information

Precise information about a crypto-asset or its issuer that has not been made public and would be likely to move its price significantly (MiCA Article 87). Using it to deal, or to change or cancel an order, is insider dealing (Article 89); passing it to anyone who does not need it is unlawful disclosure (Article 90). Compliance keeps an insider list of who holds it, what and since when. A listing decision is inside information until it is announced. Definition: Inside information · Binder §8.2 · Chapter 8

M

Major ICT-related incident

An ICT-related incident that crosses the DORA Article 18 thresholds. Only a major one is reported to the Central Bank (Article 19). At the time of writing (2026) the technical standards set three clocks. Initial notification within 4 hours of classification and no later than 24 hours after detection; intermediate report within 72 hours; final report within one month. The Keystone Vault outage of 22 May 2026 was one; the Travel Rule failure of 9 February was not. Definition: Major ICT-related incident · Binder §9.4 · Appendix C · Chapter 9

Market manipulation

Any trade, order or statement that gives a false or misleading signal about the supply, demand or price of a crypto-asset (MiCA Article 91). Halcyon's surveillance watches four patterns. Wash trading: trades between linked accounts that create volume with no real change of ownership. Spoofing: an order placed to move the price, then cancelled. Layering: several such orders at different prices. Pump-and-dump: talking a token up online to sell into the rise. Binder §8.3 · Chapter 8

MiCA

Regulation (EU) 2023/1114 on markets in crypto-assets: the EU's single rulebook for crypto-assets and the firms that deal in them, in place of a different rulebook in each member state. In force 29 June 2023; Titles III and IV, on ARTs and EMTs, applied from 30 June 2024, the rest from 30 December 2024 (Article 149). An article number in this course with no regulation named is MiCA's. Binder, what this binder is §1 · Binder, what this binder is §3 · Chapter 2

Money Laundering Reporting Officer (MLRO)

The one named person the AML rules make responsible for deciding whether a suspicion is reported. At Halcyon it is Elena Stavrou, the Head of Compliance. She receives every internal report, alone decides whether to file a suspicious transaction report, and keeps the breach log. Her pay is not linked to revenue, and only a Board resolution may remove her. Binder §7.1 · Binder §2.4 · Chapter 7

N

National competent authority (NCA)

The regulator each EU member state names to supervise MiCA. Halcyon's is the Central Bank of Ireland, "the Central Bank" throughout this course: it authorised Halcyon, receives its STORs and its DORA incident reports, and forwards its passport notifications. It is also where Halcyon had been registered as a VASP since 17 March 2022. Definition: NCA · Chapter 6 · Chapter 8

O

Obliged entity

A business the anti-money-laundering law requires to know its customers, watch their transactions, report suspicion and appoint an MLRO. Directive (EU) 2018/843 made crypto-asset providers obliged entities. Halcyon has been one since its VASP registration on 17 March 2022, before MiCA was in force. Definition: Obliged entity · Binder §7.1 · Chapter 7

Operation of a trading platform

Running an order book: a system that matches one client's buy order against another client's sell order (MiCA Article 76). Halcyon is not authorised for it; the Board resolved on 1 September 2026 to apply. Article 76 asks six things: operating rules, no proprietary trading on the firm's own platform, resilience, transparency, settlement within 24 hours, and fees that do not encourage abuse. The service also moves a CASP to Class 3. Binder §1.3 · Appendix B · Chapter 8 · Chapter 10

Originator and beneficiary

The Travel Rule's two ends: the originator is the client sending a transfer, the beneficiary the person receiving it. With every outbound transfer Halcyon sends the receiving CASP the originator's name, distributed ledger address and one identifier, and the beneficiary's name and address (Transfer of Funds Regulation, Article 14). On an inbound transfer it checks the information is complete before crediting the client (Article 16). Binder §7.4 · Chapter 7

Outsourcing

Paying another firm to do part of the work the authorisation covers. MiCA allows it, but the CASP remains responsible to its clients for what the provider does (Article 73). Halcyon's custody technology is outsourced to Keystone Vault Technologies BV, and every outsourced function was an item in the application file. Appendix A.13 · Binder §4.5 · Chapter 4

Own funds

The capital a CASP must hold at all times: its own shares and retained earnings, not clients' money. The rule is the higher of the Annex IV class minimum and one quarter of the preceding year's fixed overheads (MiCA Article 67). Fixed overheads are the costs paid whether or not anyone trades: rent, salaries, systems. For Halcyon: €6,400,000 ÷ 4 = €1,600,000, above the Class 2 floor of €125,000; own funds held at 31 December 2025 were €2,100,000. A CASP may hold an equivalent insurance policy instead; Halcyon does not. Definition: Own funds · Binder §3.1 · Chapter 3

P

Passport

A CASP's right to provide its authorised services in any other EU member state on notification to its home authority (MiCA Article 65). No new authorisation, no local office, no local capital. The home authority forwards the notification within 10 working days; the CASP may start when the host authority receives it, and at the latest 15 calendar days after submission. Halcyon notified six states on 20 January 2026. The passport does not reach the United Kingdom. Definition: Passport · Binder §1.4 · Chapter 6

Private key and wallet

Each address on a distributed ledger is controlled by a private key, a long secret number that signs any movement from it. A wallet is the software or device that keeps a key and signs with it. Whoever holds the key controls the asset; a client who keeps crypto-assets with Halcyon holds no key. Halcyon's keys sit in Keystone Vault's hardware, and a withdrawal needs two Halcyon operations staff. Binder §4.5 · Chapter 1 · Chapter 5

Q

Qualifying holding

A stake in a CASP large enough to influence it. The identity, fitness and source of funds of every holder of one is part of the application file (MiCA Article 62). A later change in who holds one has its own notification and assessment (Articles 83 and 84). Appendix A.5 · Chapter 3 · Chapter 10

R

Reconciliation

Comparing two records that should agree and explaining every difference. Every business day before 10:00, Operations reconciles the register of positions to the ledger balance of every client wallet, and the client funds ledger to the bank statement. A difference goes to the Head of Compliance the same day; one unresolved after a business day enters the breach log. The Monday reconciliation of 9 February 2026 found the 214 transfers. Binder §4.7 · Chapter 5 · Chapter 7

Register of information

DORA's list of every contract with an ICT third-party provider: the provider, the service, and whether it supports a critical or important function (Article 28(3)). Halcyon had none when it applied in March 2025. Building it from scratch was the main reason the file waited from 9 April to 28 July. Definition: Register of information · Binder §9.6 · Appendix A.7 · Chapter 3 · Chapter 9

Register of positions

The record MiCA requires a custodian to keep, opened in the name of each client (Article 75). It shows the crypto-assets held, their quantity, the wallet address and every movement in or out, with date and time. It is the proof of what each client owns; the CTO owns it. Binder §4.4 · Chapter 5

Reverse solicitation

MiCA's narrow exemption: a firm outside the EU needs no MiCA authorisation for a service an EU client asks it for entirely on the client's own initiative, and for that service only (MiCA Article 61). Halcyon's Binder applies the same test in reverse, to a client outside the EU who approaches Halcyon; whether that client's own country allows it is that country's law. It is not a strategy: an advertisement, an app-store listing aimed at the country, or a referral scheme destroys it. That is why the answer to onboarding UK residents was no. Definition: Reverse solicitation · Binder §1.5 · Chapter 6

S

Safeguarding and segregation

Safeguarding is MiCA's word for the whole arrangement that keeps clients' crypto-assets and funds safe (Article 70). They are separate from Halcyon's own, protected in Halcyon's insolvency, and never used on Halcyon's own account. Segregation is its first half: client crypto-assets sit in wallets separate from any wallet holding Halcyon's own, and the balances are never mixed (Articles 70 and 75). The ban on use is the second half: not traded, lent, staked, pledged or borrowed against, and not used to cover another client's withdrawal. Definition: Safeguarding · Binder §4.1 · Binder §4.2 · Chapter 5

Self-hosted address

A wallet a person controls with their own keys, with no CASP or other obliged entity behind it. For a transfer above €1,000 to or from one, the Transfer of Funds Regulation requires Halcyon to verify that its own client owns or controls the address. A message signed with the wallet's key is one way. Thirty-one of the 214 transfers of 9 February 2026 went to self-hosted addresses and were re-screened. Definition: Self-hosted address · Binder §7.5 · Appendix D.2 · Chapter 7

Stablecoin

The market's word for a token that claims to keep a stable value. MiCA does not use it. A token pegged to one official currency is an electronic money token; one referencing a basket of currencies, or some other value, is an asset-referenced token. Each has its own title of MiCA and its own issuer rules. Definition: EMT · Definition: ART · Chapter 5

STOR

A suspicious transaction and order report: the notice to the NCA of suspected market abuse in an order or transaction. Any person professionally arranging or executing transactions must have arrangements to detect abuse, and must report without delay (MiCA Article 92). At Halcyon the Head of Compliance alone decides; the client is not told, and a decision not to file is recorded with reasons. Elena Stavrou filed one on the "PLM" pattern on 8 April 2026. Not to be confused with an STR. Definition: STOR · Binder §8.5 · Chapter 8

Surveillance

The software that reads every order and trade in the app and raises an alert when a pattern looks wrong: repeated trades between the same accounts, say. Halcyon must have arrangements to detect and report abuse (MiCA Article 92); under the Binder, Compliance reviews every alert within 2 business days and records whether it is explained, needs enquiry or is suspicious. The "PLM" alert of 3 April 2026 was 1,180 trades over six days between three accounts, €2,100,000 notional, with no change of beneficial ownership. Binder §8.4 · Chapter 8

Suspicious transaction report (STR)

The anti-money-laundering law's report of suspected money laundering. The MLRO makes it to the national financial intelligence unit, not to the Central Bank. Staff who suspect laundering report to the MLRO the same day and do not tell the client; telling them is tipping off, which the AML rules forbid. A STOR is a different report, to a different body, about a different wrong. Binder §7.3 · Chapter 7 · Chapter 8

T

Threat-led penetration testing

A controlled attack on the live systems by an independent tester, at least every three years, required only of the firms the authority designates (DORA Articles 24–27). Beneath it sits the ordinary testing programme: vulnerability scans and scenario tests of the systems behind the five services, reported to the Board. Binder §9.5 · Chapter 9

Transfer of Funds Regulation (the Travel Rule)

Regulation (EU) 2023/1113, applying from 30 December 2024, nicknamed the Travel Rule because sender and receiver details must travel with every transfer of crypto-assets. The originator's CASP sends the information (Article 14); the beneficiary's CASP checks it (Article 16). There is no minimum for transfers between CASPs; a transfer above €1,000 with a self-hosted address needs ownership verification. Over the weekend of 7–8 February 2026 a vendor update sent 214 transfers, €387,000 in all, without it. Definition: Travel Rule · Binder §7.4 · Chapter 7

Transfer services

The fifth of Halcyon's services: moving a client's crypto-assets to another wallet on the client's instruction (MiCA Article 82). The client terms say what travels with the transfer, and that a transfer cannot be reversed. A transfer above €1,000 to a wallet the client controls must first be proved theirs. Appendix D.2 · Chapter 7

Transitional period

The time MiCA gave a firm already operating under national law on 30 December 2024 to obtain authorisation (Article 143). Up to 18 months, to 1 July 2026, which a member state may shorten. Ireland chose twelve months, to 30 December 2025, so Halcyon's authorisation of 12 November came with seven weeks to spare; check the current position (2026). Firms that did not make it had to stop. Definition: Transitional period · Chapter 2 · Chapter 3

V

Virtual asset service provider (VASP)

The name for a crypto firm under the anti-money-laundering regime before MiCA. Registration was a narrow check: the regulator looked at the firm's customer checks and the honesty of its owners and managers, then wrote its name in a list. Halcyon was registered on 17 March 2022. MiCA authorisation added rules on top and took none away. Binder §1.1 · Chapter 2 · Chapter 3

W

White paper

The disclosure document published before a crypto-asset is offered to the public (MiCA Article 4) or admitted to trading (Article 5), describing the token, the project and the risks. Its contents are set by Article 6, and it is notified to the NCA (Article 8). A retail buyer in an offer has 14 days to change their mind (Article 13). Halcyon's listing committee admits no crypto-asset without one. Definition: White paper · Binder §10.2 · Chapter 2 · Chapter 10

Wind-down plan

The plan for closing the firm in an orderly way and handing every client back what is theirs (MiCA Article 74). Halcyon's states its triggers, twelve months of funding, and the order in which services stop: new clients first, custody last. Every client's assets are returned within 90 days. Its missing financial projections were one of the three gaps of 9 April 2025. Binder §3.3 · Appendix A.14 · Chapter 3 · Chapter 4