Understanding CASPs: How EU Regulation Aims to Protect Your Cryptocurrency

In the early years of cryptocurrency, buying and storing digital assets often felt risky and confusing. Many cryptocurrency exchanges operated in a grey area, with limited rules on how they should protect client funds or secure their systems. When some of these platforms were hacked or became insolvent, everyday users suffered large losses.

Regulators responded by introducing specific frameworks to identify, supervise, and, where appropriate, restrict crypto-asset businesses. In the European Union, this now includes the Markets in Crypto-Assets Regulation (MiCAR), which sets out how firms providing cryptocurrency services must operate.

What is a CASP?

Regulators first used the term Virtual Asset Service Provider (VASP) to cover any business that exchanged, transferred, or safeguarded digital assets. This category ensured that cryptocurrency businesses followed core anti-money laundering (AML) and counter-terrorist financing (CTF) rules, similar to banks and payment institutions.

In the European Union, MiCAR builds on that idea and introduces the term Crypto-Asset Service Provider, or CASP. This definition sits within a more comprehensive regulatory regime and is tied to a detailed authorisation regime.

A CASP can include businesses that:

• Exchange crypto-assets for traditional money such as euro (EUR), or for other crypto-assets.
• Provide custodial wallets and safekeeping of private keys.
• Operate trading platforms for crypto-assets.
• Execute, receive, or transmit orders in crypto-assets on behalf of clients.
• Provide advice or portfolio management in relation to crypto-assets, where permitted.

If you buy Bitcoin (BTC) on a centralised exchange based in the EU, or you store Ethereum (ETH) with a regulated custodian in Ireland, you are dealing with a CASP. The exact permissions depend on the authorisation the firm holds in its home Member State.

How it works in practice

In traditional finance, a bank or payment institution holds your money and must follow strict rules so that it can account for it and return it to you. In cryptocurrency, custody means holding and securing the private keys that give access to your digital assets.

When you use an authorised CASP in the EU, that firm must comply with a number of important obligations. One of the key requirements is segregation of client assets. Client crypto-assets and client money must be kept separate from the CASP’s own funds. This makes it harder for the firm to use client assets to fund its business or pay its creditors.

CASPs are also subject to rules on organisational structure, operational risk, and internal controls. This typically includes:

• Clear policies for safekeeping client assets, such as using offline cold storage for a significant portion of holdings.
• Appropriate cyber security measures and regular testing.
• Incident and complaint handling procedures.
• Business continuity and disaster recovery plans.

Under MiCAR and related EU rules, a CASP must act honestly, fairly, and professionally in the best interests of its clients. Where a CASP provides custodial services, it can be held responsible if it fails to meet its legal duties in relation to safekeeping and record-keeping.

However, regulation does not remove all risk. Prices of crypto-assets can be extremely volatile, and there is no guarantee that any CASP or crypto-asset will remain available in future.

The advantages of CoinJar Europe Limited

CoinJar Europe Limited operates as an authorised CASP in Ireland. This means the company is subject to supervision by the Central Bank of Ireland and to the applicable requirements under EU and Irish law.

For users, this regulatory status has several practical benefits:

• Consumer protection is embedded in how the platform must operate. CoinJar Europe Limited is required to follow clear rules on how client funds and assets are held, recorded, and safeguarded.
• Security standards are not just a marketing claim. Institutional-grade controls, such as strong access management and secure storage of private keys, are part of the firm’s regulatory obligations.
• Financial soundness requirements apply, which means CoinJar Europe Limited must maintain sufficient capital and liquidity to support its operations and absorb certain shocks.
• Know-your-customer (KYC) and AML checks are standard. These processes help reduce fraud, protect other users, and support the integrity of the wider financial system.

Authorisation as a CASP is not a guarantee that losses will never occur. It does, however, mean that CoinJar Europe Limited operates within a structured framework, with clear rules, inspections, and potential sanctions if it fails to meet its duties.

Red flags and how to stay safe

The cryptocurrency sector still carries significant risk, especially if you use platforms that are not regulated in the EU or do not clearly explain their legal status. When you move funds to an unregulated or offshore platform, you may lose the protections that come from dealing with an authorised CASP.

Before you deposit money or crypto-assets with any provider, check for these warning signs:

• The platform does not clearly state its legal entity name, registered address, and authorisation information.
• There is no way to verify the firm in an official register maintained by an EU or national authority.
• The company advertises “guaranteed returns”, “risk-free yields”, or unusually high interest rates without a transparent and understandable explanation of the underlying activities.
• You can transfer large amounts of euro or other fiat currency without any identity checks. This is often a breach of AML rules and a serious warning sign.
• The terms of service do not explain how your digital assets are held, whether they are segregated, and what would happen if the company became insolvent.
• Customer support is minimal, unresponsive, or only available through anonymous messaging channels.

Using authorised CASPs cannot fully remove the risk of market losses or business failure. It can, however, reduce the likelihood of basic fraud, poor internal controls, or serious conflicts of interest.

Why CASP regulation matters

The move towards authorised CASPs under MiCAR is a significant development for cryptocurrency in Europe. Clear rules make it easier for both individuals and institutions to understand who they are dealing with and what protections they have.

For larger financial institutions, such as asset managers or payment firms, a regulated environment can make it more straightforward to offer cryptocurrency-related products in a controlled way. For retail users, minimum standards for disclosure, security, and conduct can improve trust and transparency.

Regulation does not eliminate risk, and it will not prevent prices from rising or falling. What it can do is provide a more consistent baseline for how firms operate, how they communicate with clients, and how they safeguard assets held on behalf of others.

Over time, this more structured approach may help digital assets to sit alongside traditional financial products in a clearer, more predictable framework.