When a client reports a missing crypto-asset transfer, the provider needs to establish what happened and explain its decision clearly. The EU’s Markets in Crypto-Assets Regulation (MiCA) sets out what crypto-asset service providers (CASPs) must do when handling complaints like these.
What you’ll take away
– How MiCA authorisation and passporting work, and what CASPs remain responsible for once they begin operating.
– Why the facts of a disputed transfer or custody incident matter when assessing responsibility.
– What Article 71 and the related technical standards require, from receiving a complaint to communicating a reasoned decision.
– How recurring complaints can reveal weaknesses in technology, controls or client communications.
Imagine a client contacts a crypto platform after a €20,000 withdrawal fails to arrive. The app shows the transfer as completed, but the receiving wallet shows no credit. The client wants to know where the assets are and whether the provider can recover them.
The platform needs to establish what happened. Was the transfer broadcast and confirmed on the intended network? Did the platform execute the client’s instructions correctly? Could the receiving service be experiencing a delay? The answers determine how the firm investigates, what it tells the client and whether it needs to escalate a wider incident.
MiCA sets common EU rules for crypto-asset services such as operating a trading platform, exchanging crypto-assets and providing custody. The EU-wide transitional period for existing providers ended on 1 July 2026. Firms providing services within MiCA’s scope need the applicable regulatory basis to operate. That generally means CASP authorisation, although certain already-regulated financial entities can provide specified services under Article 60, subject to its conditions and notification requirements.
A CASP authorised in Cyprus that plans to offer its authorised services in Germany can use MiCA’s cross-border notification procedure under Article 65. In operational terms, expansion means making sure clients in the new market can find the complaints procedure, submit a complaint in an applicable language and receive a clear response.
MiCA also sets ongoing governance and organisational requirements. For CASPs in scope, the EU’s Digital Operational Resilience Act (DORA) adds obligations on ICT risk management, major ICT incident reporting and technology third-party risk. If an outsourced wallet platform fails, the supplier may hold the technical evidence, while the CASP remains responsible for meeting its own obligations. The CASP needs a way to obtain the evidence, coordinate incident response and keep affected clients informed.
A transfer sent to the wrong address and assets lost in a custody incident can both prompt a complaint about missing crypto-assets. They call for different investigations.
If a client enters the wrong address, the CASP should check the instructions received, the network used, what the platform displayed before confirmation and whether it executed the transfer as instructed. Whether the transfer can be reversed is a separate question from whether the firm fulfilled its obligations.
Where a CASP provides custody and administration on behalf of clients, Article 75(8) sets out a specific liability rule. The custodian is liable for the loss of crypto-assets or the means of accessing them if the loss results from an incident attributable to it. The liability is capped at the market value of the crypto-assets at the time of the loss. An investigation therefore needs to distinguish between a temporary loss of access and an actual loss, and establish what caused it.
Article 71 requires CASPs to publish their complaints-handling procedures and handle client complaints promptly, fairly and consistently. Clients must be able to complain free of charge. The provider must make a complaint template available, keep records of complaints and actions taken, investigate fairly and communicate the outcome. Commission Delegated Regulation (EU) 2025/294 specifies how the process should work.
For the team handling the €20,000 withdrawal complaint, this means:
1. Acknowledge and assess. Log the date of receipt, acknowledge the complaint and tell the client without undue delay whether it meets the admissibility criteria. Give the client a contact for follow-up.
2. Gather the evidence. Compare the client’s instruction, internal transaction records and on-chain data where available. Ask for additional information only where needed, and use relevant records the firm already holds.
3. Explain the decision. Address each point the client raised, explain the findings in plain language and identify available remedies if the outcome only partly meets the client’s request or rejects it. Communicate the decision without undue delay and within two months of receipt under the standard timetable. If an exceptional delay makes the applicable timeframe impossible to meet, promptly explain why and specify when the decision will be issued.
A client who complains through a support channel can easily be routed into a routine service queue. If the firm uses automated triage, it should make sure staff can correct misclassifications and escalate time-sensitive cases. In the withdrawal example, a human reviewer may recognise that several apparently unrelated tickets concern the same network or provider.
The technical standards require CASPs to analyse complaints-handling data on an ongoing basis. For example, several delayed withdrawals on the same network might point to a processing bottleneck, an unreliable supplier or a status message that tells clients a withdrawal is complete too early. The complaints team can group the cases, flag the pattern to the service owner and track whether the fix reduces repeat complaints.
The €20,000 withdrawal case provides a practical test.
Could your team reconstruct the transaction, explain its findings clearly to the client and recognise whether other clients are affected?
Develop your team’s complaints-handling skills
EIMF’s MiCA training programmes are designed for compliance, risk and customer-facing professionals who want to apply MiCA’s requirements to the way they receive, investigate and resolve complaints. View the EIMF programmes
Resources
ESMA statement on the end of the transitional period
Commission Delegated Regulation (EU) 2025/294
Commission Delegated Regulation (EU) 2025/294, Articles 3 and 7
Commission Delegated Regulation (EU) 2025/294, Articles 4–7
Join us to gain insights from Alana Hill, learn practical strategies for turning conflict into opportunity, and discover how challenges can drive growth and stronger team performance.
On All Self-Paced eLearning CPD Courses in Financial Regulation
Hosted by the EIMF and the Chartered Governance Institute
Engage with 20+ leading experts and earn 6 CPD units in Financial Regulation.
Not sure if it’s right for you? Let’s talk.
Discount Coupon: NYNY10
Valid until 31 Jan 2025 23:59
Register now to receive a valuable educational resource each day and be automatically entered into our Grand Christmas Draw on 24th December – Don’t miss out!
On Self-Paced eLearning Courses
*complete your purchase before 21 April 2024