Live authorization graph for EU crypto firms to verify counterparties, passporting scope, and service permissions before money moves.

1. The grandfathering period is over, so firms outside the register can no longer legally serve EU clients and counterparties must re-check existing assumptions immediately.
2. ESMA's addition of 37 CASPs in one update shows the register is becoming a fast-moving operating dataset, not a static compliance webpage.
3. Only about 17 registered providers reportedly hold trading-platform permissions, so service-level permission mismatches can now break onboarding or order-routing decisions.
4. Because the register is now a public credibility signal for counterparties and institutions, authorization proof directly affects sales cycles and partner approvals.
5. Executives are framing compliance quality as a competitive advantage, which creates budget for software that turns permission monitoring into a repeatable operating process.

Catalyst. The July 1 cutoff made register status the live gate to EU crypto service delivery, so any mismatch between what a counterparty claims and what the register actually permits became an immediate compliance and revenue risk.

The product ingests the ESMA register daily, resolves legal entities and trade names, and translates license entries into an internal service taxonomy compliance teams can actually use. When a broker wants to onboard or renew a custodian, liquidity venue, or portfolio-management partner, the system checks the exact permission set, stores the proof, and opens an exception if the scope or jurisdiction is ambiguous. Integrations with CRM, ticketing, or transaction-approval workflows let teams block activation until the right evidence is attached, while alerts flag any later register change that could invalidate an existing relationship. Over time the company builds the canonical historical change log and counterparty graph that banks, auditors, and institutions trust when underwriting crypto exposure.

What's different. Chain-analytics and KYC vendors focus on who the customer is and whether funds are risky; law firms and consultants focus on one-time opinions. This company owns a different layer: machine-readable permission scope across legal entities, service categories, and jurisdictions, with a historical change log embedded in operational workflows. That makes it valuable both before a counterparty is approved and after it is live, when a register change can silently create exposure. The more counterparties, exception cases, and mapped permission patterns it sees, the harder it becomes to replace with a generic spreadsheet or a single-vendor compliance suite.

Jobs to be done

flowchart LR
  Buyer[CASP compliance lead] --> Pain[Cannot prove counterparty permission scope daily]
  Pain --> Product[Live MiCA authorization graph]
  Product --> Outcome[Faster onboarding and safer EU crypto service delivery]

Executive takeaways

• The wedge is real but the first market is smaller than generic EU crypto-compliance hype suggests: ESMA's current CASP file contains 279 unique authorised entities, only 115 home-based in Germany, France, and the Netherlands, and just 18 trading-platform permissions [3].
• The pain is operational, not informational: ESMA already publishes weekly CSVs and NCAs publish forms, passport notifications, and ongoing reporting obligations, but teams still have to reconcile service codes, host-state coverage, legal-entity aliases, and workflow-specific permissions before turning on counterparties [2][3][4][20][24][25][30].
• Budget exists only if the product sits inside existing compliance motions. Notabene's 2024 survey says 47% of respondents had to demonstrate Travel Rule compliance during licence applications and 64% do due diligence pre-transaction, while Chainalysis, Elliptic, Notabene, and Sumsub already sell adjacent screening, analytics, Travel Rule, and KYB tools into the same buyer [51][63][75][78][97].
• Competitive intensity is high from adjacent vendors and from the free substitute of public registers plus spreadsheets, screenshots, and legal memos. The white space is narrower: a MiCA-specific graph of which legal entity can perform which service in which jurisdiction, with usable evidence and change history [2][3][51][63][75][97].
• The venture case depends on expansion beyond CASPs. MiCA creates a credible beachhead, but the immediate SAM is probably single-digit millions unless the product expands to banks, stablecoin issuers, and broader multi-jurisdiction licensing workflows [3][33][45].

Market definition

This market is a workflow-grade authorisation and counterparty-permission layer for regulated crypto firms operating under MiCA. It sits between raw registers and existing AML and Travel Rule stacks, translating ESMA and NCA records, service codes, passport notifications, and transfer-data obligations into an approval signal for custody, exchange, transfer, trading, and portfolio-management workflows [2][3][4][15][24][30][75][83].

Customer and buyer

The day-to-day user is the compliance operations or onboarding manager who must prove counterparties' current status before activation; the economic buyer is usually the CCO, COO, or head of compliance because authorisation quality, passport notifications, management-body suitability, and post-licence reporting all sit inside controlled supervisory processes rather than ad hoc operations [18][23][24][25][30][33][35].

Buying triggers

• A new counterparty onboarding or cross-border expansion forces the team to prove the exact MiCA service and host-state coverage before activation. [20][24][30]
• A transitional deadline, wind-down plan, or register update creates urgency to re-check which providers can still legally serve EU clients. [18][33][42]
• A licence review, institutional diligence questionnaire, or Travel Rule audit requires evidence that counterparties and controls are current and pre-transaction. [33][35][78][79]

Willingness to pay

Public pricing is scarce, but budget is real: regulated crypto firms already buy quote-led crypto-compliance, screening, Travel Rule, and KYB products from Chainalysis, Elliptic, Notabene, and Sumsub, and Notabene's survey found that 47% of respondents had to demonstrate Travel Rule compliance during licence applications. That supports spend for a workflow-grade layer, but buyers will want it to replace manual register checks, evidence packs, or outside-counsel loops rather than add another dashboard. [51][63][75][78][97][98]

Category dynamics

Growth signal First post-transition ESMA refresh added 37 CASPs; the current CSV shows 279 unique authorised entities and 18 trading-platform permissions.

Validation signals

• The first post-transition refresh added 37 CASPs and brought the public total to 280, proving the register is changing quickly enough to justify monitoring.
• Notabene's 2024 survey found that 47% of respondents had to demonstrate Travel Rule compliance in licence applications and 64% perform due diligence pre-transaction.
• The Central Bank of Ireland says CASP authorisation is significantly broader than VASP registration and gives no simplified assessment.

Regulatory & technical constraints

• ESMA updates the central register weekly rather than in real time, so central-register latency must be managed.
• Article 60 notifications and Article 63 authorisations can look similar from the outside but imply different entitlement logic.
• Travel Rule obligations around originators and beneficiaries mean permission checks must connect to actual transaction flows, not just entity master data.

Adoption friction

PESTLE

• political EU policymakers chose a harmonised cross-border regime, which increases the value of a single source of authorisation truth.
• economic The immediate buyer pool is limited—279 authorised CASPs overall and 115 in the beachhead—so the first wedge is valuable but not huge.
• social Compliance quality is becoming a trust signal for counterparties and institutional clients, not just a regulator checkbox.
• technological Weekly CSVs, service codes, and existing screening APIs make automation feasible without waiting for new infrastructure.
• legal MiCA, TFR, passport notifications, and national transition rules create layered obligations that are easy to misread in edge cases.

The adjacent market clusters into blockchain analytics, Travel Rule and counterparty networks, and KYB or onboarding suites. The default substitute remains the regulator's public register plus spreadsheets, screenshots, and legal memos. The white space is not “crypto compliance” broadly, but a system that resolves which legal entity can do which MiCA service in which jurisdiction before money moves [2][3][51][63][75][97].

Why incumbents do not win by default

• Blockchain analytics suites. Chainalysis and Elliptic can identify risky wallets, entities, and transaction patterns, but they do not present themselves as the canonical MiCA permission graph or passporting audit trail.
• Travel Rule networks. Notabene is strongest where the workflow begins at transfer messaging and counterparty VASP due diligence, yet its public materials focus on Travel Rule data exchange and VASP discovery rather than full MiCA service-scope history across counterparties.
• KYB and onboarding suites. Sumsub already sells crypto onboarding, Travel Rule, monitoring, and business verification, but the product family is broader identity and compliance infrastructure rather than a regulator-grade MiCA entitlement layer.
• Regulators and raw registers. ESMA, NCAs, and official forms are the raw source of truth, but they publish records and process notifications rather than resolve entity aliases, historical deltas, or workflow-specific approval logic for operators.

Porter's five forces

• Supplier power 2 / 5 Core source data is public and official, which reduces supplier lock-in, but firms still depend on regulators for timing and on adjacent tooling partners for workflow surfaces.
• Buyer power 4 / 5 The buyer pool is concentrated and sophisticated, with only 115 beachhead CASPs in Germany, France, and the Netherlands and many already using adjacent analytics, Travel Rule, or KYB vendors.
• Threat of entrants 4 / 5 Because the raw register data is public and machine-readable, new entrants can build dashboards quickly; the harder moat is historical mapping and workflow embedding, not data access.
• Threat of substitutes 5 / 5 Public registers, spreadsheets, screenshots, outside counsel, and adjacent suites are all credible substitutes until a product proves faster approvals or fewer exceptions.
• Competitive rivalry 4 / 5 Multiple adjacent vendors already sell screening, analytics, VASP discovery, or KYB into the same team even if few market a MiCA-specific permission graph.

MiCA Counterparty Monitor should start as a workflow-grade permission and evidence layer for MiCA-authorized brokers and custodians in France, Germany, and the Netherlands that rely on multiple external CASPs across the EEA. The immediate pain is not winning a license; it is proving during each onboarding, renewal, and institutional diligence event that a counterparty's exact MiCA service scope and host-state coverage match the workflow being activated. ESMA's weekly CSV and national notices make the raw data available, but teams still reconcile legal-entity aliases, passport coverage, and service codes manually in spreadsheets, screenshots, and counsel memos. The MVP should therefore focus on daily ingestion, entity-resolution, service-taxonomy mapping, evidence snapshots, alerts, and a human-review queue embedded in onboarding or ticketing systems rather than trying to replace AML, Travel Rule, or transaction-monitoring stacks. This beachhead is narrower and faster to prove than a broad crypto-compliance suite because 59 of the 115 FR/DE/NL home-state CASPs already passport to 5+ markets and are more likely to feel repeated counterparty-scope friction. The modeled beachhead is still small—about "$8.6M" of SAM and "$0.8M" of year-3 SOM for the initial slice—so the venture case depends on showing that the same control layer can expand into banks, asset managers, and multi-jurisdiction licensing workflows. The biggest evidence gap is how many of the 115 beachhead CASPs actually manage enough counterparties to buy a standalone system at roughly "$75k" ACV, and that must be validated before scaling headcount. The first 12 months therefore need to prove willingness to pay, measurable reduction in approval or evidence-pack labor, and external acceptance of the startup's evidence packs in standard diligence cases.

Problem

• Compliance teams at MiCA-authorized brokers and custodians still re-check counterparties through public registers, screenshots, and counsel memos, so onboarding and renewal decisions slow down while evidence goes stale.
• A counterparty can appear authorized yet still lack the exact service permission or host-state coverage a custody, exchange, or portfolio-management workflow assumes, creating revenue delay or regulatory exposure.

Solution

• Ingest ESMA and selected NCA updates, resolve legal entities to brands, and convert MiCA service codes plus passport data into workflow-specific approval logic for each monitored counterparty.
• Generate current evidence packs, alert on material register changes, and route ambiguous cases into human review inside onboarding, CRM, or ticketing systems before a partner is activated or renewed.

Why we win

• The wedge is narrower than generic crypto compliance and more operational than legal research: a system of record for who can perform which MiCA service in which market before money moves.
• Historical delta logs, entity-alias resolution, and reusable service-policy mappings compound with every monitored counterparty in ways that raw registers and one-off legal memos do not.
• Adjacent vendors already own AML, Travel Rule, and KYB budgets, so the startup can win by embedding into their workflows instead of competing head-on as another broad suite.

Milestones

flowchart LR
  Wedge[MiCA counterparty wedge] --> MVP[Permission graph and evidence MVP]
  MVP --> Proof[Faster approvals and caught scope mismatches]
  Proof --> Expansion[Bank diligence and broader license intelligence]

Founding team

Experiment roadmap

Risk assessment

What must be true

• At least 20-30 of the 115 FR/DE/NL home-state CASPs manage enough cross-border counterparties and approval churn to buy a standalone permission workflow at roughly $75k ACV.
• The first production pilots reduce approval or evidence-pack labor by at least 50% while surfacing real permission or passport mismatches that manual checks miss.
• CCOs and COOs will fund this as a separate workflow layer instead of insisting that existing Travel Rule, KYB, analytics, or counsel relationships absorb the problem.
• Register-derived evidence packs and historical deltas will satisfy most standard bank, auditor, or institutional diligence requests without bespoke legal memos.
• The startup can win workflow position and proprietary mapping data before adjacent vendors or improved regulator tooling compress the wedge.

Open diligence questions

• How many FR/DE/NL CASPs actually manage more than 10 external counterparties across 3+ EEA markets today?
• Which approval surface creates the fastest proof and lowest security friction: ticketing, CRM, onboarding, or Travel Rule tooling?
• What percentage of real counterparty files still need bespoke legal interpretation after productized service-scope mapping?
• Will buyers pay standalone ACV in the $60k-$90k range, or does the product need to ride as an OEM or bundled module?
• Do banks, asset managers, and auditors accept evidence packs built from register data plus change history, or do they still require custom legal opinions in most edge cases?

Model sanity

• Revenue engine. Revenue is driven by paying accounts rising from 4 at Y1 exit to 11 at Y3 exit while blended realized account revenue approaches about $100K annualized.
• Must go right. Pilots must convert into production without turning evidence packs and Article 60 or 63 edge cases into a services-heavy delivery model.
• Model breaks if. If the Y3 exit slips from 11 to 9 customers or the sales cycle stretches toward 9 months, the downside case finishes with almost no cash left.
• Next-round proof. The seed story works only after the company shows more than 100 monitored counterparties, one functioning partner channel, and clear ACV lift beyond the initial roughly $75K beachhead.

Scenarios

Sensitivity

flowchart LR
  TriggeredAccounts[Triggered accounts] --> PaidPilots[Paid pilots]
  PaidPilots --> ProductionAccounts[Production accounts]
  ProductionAccounts --> ExpansionModules[Expansion modules]
  ProductionAccounts --> Revenue[Subscription revenue]
  ExpansionModules --> Revenue
  Revenue --> GrossProfit
  GrossProfit --> Cash

Flags: The base case already reaches the top end of the BP's 8-12 customer Y3 milestone and effectively consumes the researched initial SOM, so the next round still depends on expansion beyond the CASP wedge. · Base CAC of roughly $108K is high relative to a ~$100K annualized revenue account, so advisor and adjacent-vendor channels must reduce acquisition cost before a larger GTM build-out. · Revenue per FTE remains below typical SaaS efficiency benchmarks by Y3, which is a warning that the beachhead alone is not yet venture-scale. · The model stays cash-positive in the base case, but the downside case ends near zero cash, leaving little room for a delayed seed without spending cuts or slower hiring.

• Public-data commoditization. Buyers may initially see this as a thin wrapper around the ESMA register rather than a must-have operating system. Mitigation: Embed the product in approval workflows, historical change logs, and counterparty evidence packs that are costly to reproduce manually.
• Regulatory edge-case ambiguity. Raw register entries and passporting facts may still require legal interpretation in nuanced service or jurisdiction cases, limiting full automation. Mitigation: Keep human-review queues, partner with specialist counsel, and automate the unambiguous service-permission checks first.
• Beachhead market size. The first segment of MiCA-authorized firms with complex counterparty networks may be smaller than expected as the regime matures. Mitigation: Use the CASP wedge to expand into banks, PSPs, and multi-jurisdiction licensing workflows once the permission graph is established.