Skip to main content
Full analysis: docs/MICA_REGULATORY_POSITION.md. Supporting opinions: docs/LEGAL_OPINION_GLOBAL_DISTRIBUTION.md, docs/LEGAL_OPINION_ADDENDUM_SKN_vs_BVI.md.
Counsel sign-off is a mainnet gate and has not been obtained. Nothing here is legal advice, and the position is not settled until counsel confirms it.

​
The core argument

Custody is what makes a service a regulated crypto-asset service. The architecture is built so that the platform never has it — not as a policy, but as a property of the code. The third row is the unusual one and it is why DB-display-only trust matters legally as well as technically.

​
The permissionless linchpin

distribute() is callable by anyone. The settlement spec names this the regulatory linchpin.
Any mechanism that lets the platform withhold a merchant’s funds — a debt gate, a compliance hold, an operational pause — hands us a capability a regulator will read as custody, whether or not we ever exercise it. This has already been the deciding argument against one proposal that was otherwise economically neutral.
The practical rule that follows: money owed to the platform is recovered as a bounded fee inside the split, never as a gate on the payout.

​
Hard ban: fiat on-ramps and off-ramps

Never touch, integrate, recommend, or document fiat on-ramps. MiCA’s “facilitating the conversion” language is broad enough that even a soft recommendation pulls the platform toward CASP scope.
This applies to every public surface, including casual mentions in help text, blog posts, and support replies. Stay strictly on-chain.

​
Sanctions screening is not a regulated service

Screening is an identity-blind list lookup. Refusing service to a sanctioned wallet is the negation of a service, not the provision of one, and it is not a crypto-asset service under Article 3(1). It is also explicitly not KYC — no identity is collected, verified, or stored, and payer verdicts are never persisted. See Sanctions.

​
Communications discipline

The trust guarantee is real but conditional, and overstating it creates both legal and reputational exposure.
Never claim “unhackable.” Describe the mechanism and the conditions. The non-absolutist communications floor applies to every public statement.
State these conditions whenever the routing claim is made:
  • It holds only when the merchant pins an anchor. Without one, the widget shows an unverified badge and does not block.
  • It defends the database-compromise threat. A full served-code compromise is mitigated by SRI-pinning, not eliminated.
  • It covers the pool rails. The legacy atomic rail is a separately tracked gap.
  • The audit is pending.
The same discipline applies to fees. The site advertised “keep 99%” while merchants actually kept 98.505%; that required a correction and a regression test. Publish numbers that survive arithmetic.

​
Mainnet gates

Four items, none of them engineering:
1

Third-party security audit

Of the pool rails, not just the legacy contracts.
2

Immunefi bug bounty live

Before real money is at risk.
3

MiCA counsel sign-off

On the custody position and the marketing claims.
4

Explicit per-chain GO

From the founder. Guardrail number one. No agent or automation may broadcast to a mainnet.

​
Positioning

Supported stablecoins are USDC, USDT, and EURC as equal options, with no geographic slant. EURC being the current default for new merchants is a configurable database value, not a market position. Do not describe the product as “Europe-first” or “EUR-first” on any user-facing surface. The default currency is likewise a configurable default, not a stance. docs/OFAC_COMPLIANCE_PROGRAM.md covers the operational compliance programme. docs/sprint0/TREASURY_SAFE_SPEC.md covers treasury custody arrangements, which are a separate question from customer fund custody.