EU digital assets: check the entity, then test the operating model

The EU’s maximum MiCA transition period ended on 1 July 2026. ESMA’s April statement told providers relying on transitional arrangements to secure authorisation or implement an orderly wind-down. For procurement teams, a historic national registration or an application in progress should not be treated as evidence of current permission to provide the proposed service.

The contracting entity matters as much as the brand. ESMA explains that MiCA protections attach to the specific authorised EU legal entity, rather than every company in its group. Its statement directs users to check the register and their contract, and cautions against arrangements that route regulated services through unauthorised third-country entities.

Operational resilience is a separate workstream. DORA has applied since 17 January 2025 and includes authorised crypto-asset service providers within its scope. Article 28 requires a maintained register of contractual arrangements for third-party ICT services, distinguishing those supporting critical or important functions. A vendor inventory needs to describe actual dependencies, not simply list approved logos.

For ICT services supporting critical or important functions, Article 28 also requires exit strategies and documented plans that are tested and reviewed. The aim includes maintaining business and customer-service continuity while changing provider or bringing a service in-house. Buying infrastructure therefore creates responsibilities that continue after a contract is signed.

Our suggested evidence pack connects those requirements: identify the entity delivering each service, record its authorisation basis and scope, map custody and infrastructure dependencies, and assign owners for incident escalation. Ask the supplier to demonstrate how customers and records would move during a service withdrawal. Keep unresolved points visible before commercial approval.

For gaming businesses adding a wallet or digital-asset feature, first establish which activities and entities fall within the relevant rules; a Web3 label alone does not answer that question. This is an operational briefing for that discussion, not legal advice, investment advice or confirmation that a particular product or provider is compliant.