Europe's securities regulator has clarified when crypto firms can hold customer money through non-bank payment providers. ESMA’s answer permits temporary use of such accounts, but requires the money to reach a qualifying bank or central-bank account by the end of the business day after receipt. The answer is dated 6 October 2026. ESMA highlighted it in its 16 October Q&A announcement.
ESMA says a bank account held in a payment provider's name does not satisfy the requirement, even if it is dedicated to the crypto firm and technically separated from other accounts. The firm instead retains a claim against the payment provider. The qualifying account must be held directly in the crypto firm's name, or under the applicable legal asset-segregation arrangement. Safeguarding continues during temporary holding.
What the customer-money rule covers
The rule is Article 70 of the Markets in Crypto-Assets Regulation, known as MiCA. Its cash provisions exclude electronic-money tokens. They require arrangements protecting customers' ownership rights and preventing the provider from using their money for its own account. Funds held at the bank or central bank must sit in an account separately identifiable from accounts containing the provider's own money.
Article 70 contains provisions for crypto-assets and payment services. Providers holding customers' crypto-assets, or the means of accessing them, must protect ownership rights, especially in insolvency, and prevent use for their own account. Related payment services may be delivered directly or through a third party with the required payment-services authorisation. Customers must be told the service's nature, terms, applicable rights and who supplies it. The article exempts providers that are themselves electronic-money institutions, payment institutions or credit institutions from its paragraphs on holding and placing customer funds.
Evidence required from crypto firms
The operational detail appears in existing EU authorisation standards, published in the Official Journal on 31 March 2025. Applicants must describe the factors used to select banks for customer deposits, any diversification policy and how often those choices are reviewed. Their application must also explain how customers receive clear, concise and non-technical information about the relevant safeguarding systems and procedures. These are information requirements for the licensing assessment, providing evidence for supervisors to examine rather than simply accepting a firm's general assurance that customer assets are protected.
Those standards address digital custody too. Applicants must explain their approval and safeguarding systems for cryptographic keys, including multi-signature wallets, and how they distinguish customers' wallets from their own. Where a wallet contains assets belonging to several customers, they must describe the separation between those customers' holdings. The standards also require detail about the applicant's planned outsourcing, including the entities involved, their location and the services outsourced. These existing disclosures help identify who performs a function and where the arrangements operate, including planned outsourcing within a corporate group.
Account safeguards do not remove the wider risks of crypto products. In their October 2025 consumer warning, the European supervisory authorities said crypto-assets can undergo sharp price changes and liquidity constraints, leaving holders unable to sell at their preferred time or price. They also distinguished MiCA's information and complaints-handling protections from those available for traditional financial products, noting the absence of compensation schemes for crypto-assets. These warnings concern the risks and protection attached to the product or service; they should not be read as a finding about a particular firm's conduct.
The same warning explains why the provider's regulatory status matters: services offered by firms outside EU regulation may leave customers with weaker protection or none. The authorities identify misleading promotions, fraud, hacks and complex products among the risks. Their warning also describes the danger of losing access to private keys, which can mean permanently losing access to the associated crypto-assets. The customer-money clarification therefore addresses one part of a wider protection framework, without guaranteeing that a crypto investment will retain its value. Dalimss News has separately reported on ESMA's stablecoin service restrictions and Britain's crypto VAT guidance, which deal with different regulatory questions.
