Crypto M&A due diligence: licenses, treasuries, keys and tokens

Under MiCA, anyone who intends to acquire a holding in a CASP that reaches or exceeds 20%, 30% or 50% of voting rights or capital, or that would make the CASP its subsidiary, must notify the competent authority first¹. The authority acknowledges receipt within two working days and has 60 working days to assess, and the clock can stop for up to 20 working days while it waits for information, or up to 30 if the acquirer is outside the Union¹.

The assessment looks at the acquirer's reputation and financial soundness, the experience of the people who will run the business, whether the CASP can keep complying with MiCA, and any reasonable grounds to suspect money laundering or terrorist financing¹. Prepare that file during diligence, not after signing. In the US, state money transmission laws generally require approval or notice before a licensee changes hands, so a target licensed in many states can face many parallel approvals with different timelines.

Where a project has both equity and a token, the buyer acquires the shares but not the token holders' consent. Check the supply schedule and any insider token releases that fall soon after closing, the governance rights tokens carry, and whether the treasury sits with the company or with a foundation the buyer will not control. A buyer's plan to change fees, migrate chains or redirect treasury funds can need a token holder vote.

ColdAI's capital raising work designs token economies through supply modeling, simulation and governance analysis⁵, and the same methods apply in reverse during diligence: model what the release schedule and incentives will do to the token after the deal, and whether token and equity holders' interests point the same way.

Public ledgers let a buyer trace where funds came from. On-chain analytics can show exposure to sanctioned addresses, mixers or addresses linked to known exploits. OFAC can add digital currency addresses to its sanctions list, and US persons holding blocked virtual currency must deny all parties access to it³. In the EU, the transfer-of-funds rules in Regulation (EU) 2023/1113 extend information requirements to crypto-asset transfers⁴, so check whether the target collects and passes on the required originator and beneficiary data.