Leadership
A single interlocutor
One technology conversation instead of several vendors per perimeter.
A platform that custodises and moves clients' crypto-assets. And, once authorised, DORA applies too.
What MiCA, the CNMV, DORA and, where payments apply, PSD2 ask of a CASP, and how it can serve more clients in more countries without standing up a new technical department.
Technical case study
Regulatory calendar
From the MiCA transition to the EU passport. With DORA already in force.
The dates that set when only authorised CASPs may operate and what resilience is required of them.
30 Dec 2024
MiCA and Travel Rule apply
The crypto-asset services framework and transfer information rules apply in full.
Regulations (EU) 2023/1114 and 2023/1113
17 Jan 2025
DORA applies
It covers crypto-asset service providers authorised under MiCA (art. 2.1.f).
Regulation (EU) 2022/2554
2025–2026
CASP authorisations in Spain
The CNMV authorises the first national providers; others operate with a passport from another State.
CNMV · crypto-asset providers
1 Jul 2026
Transitional period ends
In Spain only providers authorised by the CNMV or another European authority may operate.
CNMV · MiCA notice
2026+
EU expansion the sector plans
Companies in the sector plan to take the service to more Member States under the MiCA passport.
2026 sector communications
The insight of the case
MiCA authorisation does not close the technical file: with the same legal entity come DORA and, if there is a payment institution, PSD2. Treating only the licence leaves gaps supervisors and institutional clients notice.
Globodain reading of MiCA, DORA art. 2.1.f and Spain's RDL 19/2018
The challenge
Three perimeters at once, the same team and more countries.
What this profile costs today
- 01Segregated custody and MiCA controls on the service
- 02ICT resilience, incidents and vendors under DORA
- 03Travel Rule, KYC and AML on every transfer
- 04Payments or EMTs with SCA and safeguarding if licensed
- 05EU passport without duplicating vendors per country
- 06Bank and institutional due diligence on every deal
What they ask
The same questions in every audit.
Supervisor, partner bank or institutional client: the question, the rule and what Globodain prepares.
Question
Rule or standard
What we prepare
01Who custodises and how is it segregated?
MiCA · custody duties
What we prepare ·Control map and segregation evidence
02How is ICT risk managed?
DORA art. 2.1.f and ICT framework
What we prepare ·Risk, incident and third-party registers
03What travels with each transfer?
Travel Rule 2023/1113
What we prepare ·KYC/AML flows and technical traceability
04How is payment authenticated?
PSD2 / SCA if a payment entity
What we prepare ·Flow design and access controls
05Where is client data?
GDPR
What we prepare ·Data architecture and processors
What we propose
One technology partner for MiCA, DORA and payments at once.
A single interlocutor answers leadership, compliance and the technical team while the passport opens more countries.
Compliance
Evidence ready
ICT reports for the supervisor, partner banks and due diligence.
Technical team
Capacity that adds
Reinforcement in security, SRE and compliance, without replacing the team.
Its market
Authorised CASPs, national and passport competition.
What public sources show about the end of the transition and who competes on the register.
1 Jul 2026
end of Spain's MiCA transitional period: only authorised providers may operate
CNMV
DORA
applies to CASPs authorised under MiCA (art. 2.1.f)
CNMV · DORA FAQ
~295
CASPs authorised in the EU in a mid-2026 ESMA interim-register cut
CARCI · ESMA
Companies in the sector
Criptan
Spanish CASP: custody, exchange and transfer under MiCA
Crossmint
B2B wallet and exchange infrastructure; CNMV CASP
Coinbase
Global exchange with MiCA passport into Spain
Bitpanda
Pan-EU platform with freedom to provide services in Spain
Prosegur Crypto
Institutional digital-asset custody; Spanish CASP
Bit2Me
Spanish CASP: custody, exchange, execution and transfer; EMT payments
The profile that combines MiCA, DORA resilience and a payments arm carries more technical surface than a retail-only exchange.
Expected impact
More clients served with the same team.
What changes when MiCA, DORA and AML stop consuming the technical team.
×2.0
clients it can serve by the end of the period, versus staying without a partner
−28 pts
of technical time going back to product and clients
6 → 1
technical areas, a single interlocutor
Illustrative scenario, not a forecast. Index 100 = clients it can serve after the transition ends. Assumption: freed time goes back to product and expansion.
How we would solve it
A continuous rhythm, not a project with an end date.
Each turn leaves evidence and sets the priority of the next.
- 01
Diagnosis
Security, access, data, infrastructure, code and integrations.
- 02
Audit
A report leadership, risk and supervisors can read.
- 03
Implementation
We fix things alongside its team, without replacing it.
- 04
Vigilance
Early warning when the rules require moving the roadmap.
Benefits and advantages
What this profile gains from the first quarter.
01
Evidence for the supervisor
ICT controls organised for the CNMV, BdE and partners.
02
DORA in operation
ICT risk, incidents and critical vendors, documented.
03
A smoother passport
The same technical base for more Member States.
04
AML and Travel Rule
Traceable flows without blocking the product.
05
A single partner
One relationship covers security, cloud and watch.
06
A product-focused team
Technical time goes back to clients and the API.
Why Globodain
Capabilities that apply to an authorised CASP.
Scope note: the mention of regulated environments describes applicable capabilities, not an accredited track record in crypto-assets.
- 01
Cybersecurity
Security and access on custody and client accounts.
- 02
Technical audit
Data, CI/CD, integrations, infrastructure and code.
- 03
Compliance
A technical reading of MiCA, DORA, PSD2 and the GDPR on its stack.
- 04
Cloud and SRE
Infrastructure ready to grow without tech debt.
- 05
Integrations
KYC, Travel Rule and payments, securely connected.
- 06
Vigilance
Early warning of regulatory changes that affect the CASP.
Scope and limits
So it is clear from day one.
What we bring
- Technical audit, implementation and continuous vigilance
- A report with findings and priorities
- A stable interlocutor, not a one-off vendor
What we do not do
- We do not certify regulatory compliance
- We do not issue certificates or seals to third parties
- We do not replace legal advice: we complement it
Certifications and legal advice belong to authorised third parties. We provide technology support: audit, implementation and vigilance.
Does your case look like this profile? Let's analyse it.
This study was built from public sources on the sector. If yours looks similar, Rubén Ayuso will analyse it with you and prepare one for you.
Technical study prepared by Globodain Technology Corporation from public sources on the sector. It does not describe a specific company and was not prepared with one. The companies named are examples from the sector: this does not imply a commercial relationship or their participation. Not a contract: figures and scenarios are indicative.
