Research guide
Crypto regulation and safety: what to check before transacting
MiCA, provider authorisation, custody and protection limits: a practical due-diligence checklist.
MiCA does not cover every financial product
MiCA establishes EU rules for crypto-assets and services within its scope. It does not replace all financial legislation: a tokenised asset qualifying as a financial instrument may fall under another framework. A person’s position depends on the product, provider, residence and service used. This guide does not give an individual legal conclusion or claim every coin is legal to purchase in every country.
Verify the entity, not just the brand
Look up the legal entity in the relevant official register and compare its domain, country and authorised services. A familiar brand may operate through different entities. Registration for one activity does not authorise every activity. ESMA also warns that white papers included in its register have not been reviewed or approved by authorities: publication of the document is not an endorsement of the asset.
Custody and irreversible transfers
With third-party custody you depend on the provider’s controls, terms and solvency. With self-custody you must protect keys and backups. Neither option removes all risks. Before transferring, check address, network, token and any required memo or destination tag. A small test transfer can reduce an operational mistake but does not prove a recipient or investment is legitimate.
Warning signs and records
Be wary of guaranteed returns, pressure to deposit and extra payments demanded to unlock withdrawals. Do not give recovery phrases to support staff or connect a wallet to unverified links. Keep receipts, transaction identifiers, terms and communications. For taxes and complaints consult sources in your jurisdiction; rules and remedies can change and do not guarantee recovery of lost funds.
Before making a decision
- Legal entity, domain and authorisation match the official register.
- Custody, withdrawal and complaint terms are available.
- Keys are never shared; network, address and permissions are checked.
