The Orderly Wind-Down Plan for CASPs and EMIs: What Supervisors Now Demand

Supervisors stopped treating the wind-down plan as a back-of-drawer formality. For a CASP or an EMI, the plan to exit the market is now a live authorisation condition — reviewed at licensing, tested annually, and pulled off the shelf the moment your numbers wobble.

The shift is structural. MiCA Art. 47, the EBA's recovery-plan guidelines, and the FCA's wind-down expectations all converge on the same demand: a tested, costed, customer-asset-return-ready plan in place at authorisation — not after the firm is already failing.

This guide sets out The Wind-Down Trigger Ladder — the escalation from solvent voluntary wind-down through supervisory-directed wind-down to insolvency — and the documents, runway, and customer-asset-return mechanics each rung demands. This is the plan that passes inspection.

Every recent CASP and EMI failure taught supervisors the same lesson: the firm that fails disorderly strands customer money. Funds get frozen for months, customer crypto sits in wallets no administrator can access, and the harm lands on retail users who never saw the balance sheet.

So the regulatory answer moved upstream. Instead of intervening at the point of failure, NCAs now demand that an orderly exit be engineered into the firm from day one. The plan is assessed at authorisation, funded by ring-fenced capital, and tested before the crisis — because a plan you have never tested is a plan you do not have.

The practical consequence: a half-page narrative saying "we would return funds to customers" no longer survives a desk review. Inspectors now test whether the plan is costed, whether the runway is funded, and whether the asset-return procedure is actually executable — by you, or by an administrator who has never seen your systems.

Under the Markets in Crypto-Assets Regulation¹^[1], MiCA Art. 47 requires every CASP to maintain a plan for the orderly wind-down of its activities — appropriate to the nature, scale and complexity of the services it provides, and ensuring the continuity or recovery of any critical activities, including the return of client crypto-assets and client funds.

In the UK, the FCA's Wind-down Planning Guide²^[2] sets the expectation that an authorised firm can cease regulated activities with minimal harm to clients and the market. The WDPG is not a tick-box: it expects a costed model, identified triggers, and a credible runway funded from own resources.

Funding the runway is the part most firms underestimate. The FCA's framework for assessing adequate financial resources³^[3] ties wind-down cost directly to the capital you must hold: you must hold enough own funds to cover the cost of an orderly wind-down under stress. A wind-down cost estimate that is too low is, in effect, an under-capitalisation finding waiting to happen.

For ART and EMT issuers, the EBA Guidelines on recovery plans⁴^[4] add a redemption dimension: the plan must show how token holders are made whole, and how the redemption right under MiCA Art. 39 and Art. 49 survives a wind-down. Recovery and wind-down are read as a continuum, not two unrelated files.

For EMIs the anchor is EMD2. The Electronic Money Directive⁵^[5] requires customer funds to be safeguarded — held segregated or insured so that, on insolvency, those funds are returned to holders ahead of general creditors. A wind-down plan that does not show the safeguarded pool reconciling to redemption liabilities is the single most common cause of a rejected EMI plan.

Wind-down is not one event. It is a ladder of three rungs, and which rung you land on determines who controls the process, how customer assets are treated, and how much it costs.

1. 1

   Rung 1 — Solvent voluntary wind-down: the firm chooses to exit while it still has positive equity and adequate liquidity. Management stays in control. This is the cheapest, cleanest, and most defensible exit.

2. 2

   Rung 2 — Supervisory-directed wind-down: the NCA forces the exit — by varying, suspending or withdrawing the authorisation. The firm may still be solvent, but control shifts toward the supervisor and the timeline compresses.

3. 3

   Rung 3 — Insolvency-adjacent wind-down: capital is already gone. An administrator or liquidator takes over, the safeguarding regime is tested in earnest, and customer-asset return becomes a contest with general creditors.

The point of the ladder is to keep your firm on Rung 1. A funded runway and clear internal triggers let you exit voluntarily before the supervisor or an insolvency practitioner takes the decision out of your hands.

This is the rung every plan should be engineered to reach. The firm is solvent, board-led, and exiting on its own terms — strategic pivot, loss of a critical banking partner, or a decision that the licence is no longer commercially viable. Management retains control of the runbook, the timeline, and the customer narrative.

The internal trigger that activates Rung 1 is yours to define, and supervisors expect it to be explicit: a capital or liquidity threshold (for example, own funds falling below 110% of the regulatory minimum), a sustained revenue decline, or the loss of the last viable safeguarding account. Hit the trigger, and the board executes the plan rather than debating it.

Customer assets at Rung 1 are returned in a managed, communicated sequence: notice to clients, an open withdrawal window, then a hard cut-over to redemption-only. Because the firm is solvent, the safeguarded pool covers redemption liabilities in full, and the return runs on your systems while staff who know them are still employed.

At Rung 2 the NCA forces the exit. It varies, suspends or withdraws the authorisation, or imposes a requirement — for example an FCA asset-restriction requirement, or a MiCA withdrawal of the CASP authorisation by the home NCA. The firm may still be solvent, but the decision to wind down is no longer yours.

Control becomes shared. You execute, but the supervisor sets reporting cadence, milestones, and constraints — often a freeze on new business, a mandated customer-communications timeline, and frequent updates on the safeguarded pool. The timeline compresses, and the customer narrative is now partly written by the regulator, which is why your pre-built customer-comms pack matters most here.

Customer assets are still returnable in full if safeguarding held, but the asset-return procedure has to be executable to supervisory deadlines. A plan that worked in a leisurely Rung 1 scenario can fail at Rung 2 simply because it assumed time you no longer have. Test it against a compressed clock.

Rung 3 is the failure scenario the whole plan exists to avoid. Capital is already gone, the firm cannot fund its own wind-down, and an administrator or liquidator takes control. Management loses the runbook entirely.

Here the safeguarding regime is tested for real. Under EMD2, correctly safeguarded customer funds are returned to holders ahead of general creditors — but only if the segregation was clean and the records reconcile. A commingled or poorly reconciled pool turns a protected return into a contested claim, and customers wait years.

For a CASP holding customer crypto, Rung 3 is harder still. An administrator with no key-management training cannot move assets out of cold storage. The asset-return procedure must be executable by a third party who has never seen your wallet architecture — documented key custody, signer arrangements, and a step-by-step return runbook are what make customer crypto recoverable in insolvency rather than locked forever.

Customer-asset return is the heart of the plan, and supervisors test it harder than anything else. The structure rests on three pillars: clean segregation, a defined return waterfall, and separate handling for crypto versus fiat.

If customer fiat is not held in a designated safeguarding account separate from the firm's own money, the return waterfall fails at the first step. The same applies to crypto: customer wallets must be segregated from corporate treasury wallets, and the holdings must reconcile to the customer ledger daily. Segregation done in the calm makes return possible in the storm.

The waterfall sets the order of distribution: first the costs of the wind-down distribution itself where the safeguarding regime permits, then customer claims against the safeguarded pool, and only then general creditors against the firm's own estate. A pool that reconciles cleanly lets customers be paid quickly and pro rata if there is any shortfall; a pool that does not turns into litigation.

Fiat return is a banking-rail problem: payouts to verified customer accounts, subject to AML checks that do not stall the return. Crypto return is a key-management and on-chain problem: you need documented signer access, a tested withdrawal path, and a procedure that survives the departure of the engineer who built it. Under MiCA, returning client crypto-assets is an explicitly named critical function — treat it as the load-bearing part of the plan.

The runway model is where the plan becomes a number. It estimates the cost of an orderly wind-down under stress, and that number drives the capital you must hold against it.

Split the cost into two layers. Fixed costs run for the whole wind-down period — premises, core systems, audit, regulatory reporting, and the staff-retention bridge. Variable costs scale with the asset-return job — payout processing, customer support, legal advice, and the cost of moving and reconciling crypto.

Then stress it. The realistic wind-down is not the orderly one — it is the one where revenue has already collapsed, a banking partner has exited, and staff are leaving. The stressed-wind-down cost estimate assumes a longer period, retention premiums, and contingency. That stressed figure — not the optimistic one — is the capital the FCA and your NCA expect you to hold.

The runway is usually expressed in months of funded operation. A custody-light EMI might wind down in 3–6 months; a custody-heavy CASP returning crypto to a large retail base may need 9–12 months or more. Hold capital for the long case, not the short one.

A supervisor-ready wind-down plan is not a single document. It is a pack of five, each tested and each ready to execute.

1. 1

   The plan — the master narrative: triggers, the rung-by-rung playbook, governance and decision rights, and the critical functions that must continue through the exit.

2. 2

   The cost model — the fixed-plus-variable runway model, the stressed estimate, and the explicit link from that estimate to the own-funds you hold.

3. 3

   The customer-comms pack — pre-drafted notices, FAQs and withdrawal instructions, ready to send within hours of a trigger and adaptable to a supervisor-mandated timeline.

4. 4

   The asset-return procedure — step-by-step return of fiat and crypto, written so a third party can execute it: account paths, signer access, reconciliation steps, and AML controls on payout.

5. 5

   The staff-retention bridge — funded retention for the handful of people who can run the return and reconcile the pool, so institutional knowledge does not walk out the door at the worst moment.

Underpinning all five is operational resilience: the EBA Guidelines on ICT and security risk management⁶^[6] expect that critical systems — including the ones that execute the asset return — stay available and recoverable through the wind-down, not just in business-as-usual.

The driver that dominates is asset-return complexity. A custody-heavy CASP carries the longest runway and the largest retained headcount precisely because returning customer crypto safely cannot be rushed or handed to people who do not understand the wallet architecture.

A desk review of a wind-down plan asks four questions, and a weak answer to any one of them is a finding.

• Is it costed? A real fixed-plus-variable model with a stressed estimate, not a single round number with no working behind it.

• Is it tested? A documented dry-run or scenario exercise — at minimum the asset-return procedure walked end to end against a compressed clock.

• Is the runway funded? The stressed cost estimate must reconcile to own funds actually held and available — capital you cannot draw on does not count.

• Is the asset return executable? By someone other than the founder — an administrator who has never seen your systems should be able to follow the procedure and return customer assets.

Pass all four and the plan is supervisor-ready. Fail the last one — executability — and you have a document that reads well and does nothing, which is exactly the failure mode supervisors moved upstream to prevent.

A wind-down plan is a tested, costed document setting out how a regulated firm — such as a CASP or EMI — would cease its regulated activities in an orderly way, returning customer funds and assets with minimal harm. It covers triggers, a costed runway, a customer-comms pack and an executable asset-return procedure.

Yes. MiCA Art. 47 requires every CASP to have a plan for the orderly wind-down of its activities, proportionate to its size and complexity, that ensures the continuity or recovery of critical functions — including the return of client crypto-assets and client funds. The plan is assessed by the home NCA at authorisation.

Enough to fund a stressed, orderly wind-down. The FCA's framework for adequate financial resources ties the figure to your wind-down cost estimate under stress — fixed plus variable costs over the full runway, with retention and contingency. For an EMI that may be a few months of operating cost; for a custody-heavy CASP, materially more. The estimate, not a fixed minimum, sets the capital.

If the CASP segregated customer crypto from its own treasury and documented its key custody, an administrator can follow the asset-return procedure and return holdings to customers. MiCA treats client crypto-asset return as a critical function. Where wallets were commingled or keys were undocumented, return becomes slow, contested, and in the worst case impossible — which is the precise harm the wind-down plan exists to prevent.

• EMI Safeguarding Architecture: how to structure the safeguarded pool that makes customer-asset return possible in a wind-down.

• Three-Account Segregation: the operating, safeguarding and reserve account split that keeps customer money clean and returnable.

• The EMI Compliance Programme Architecture: where the wind-down plan sits in the wider compliance framework supervisors assess.

• The 72-Hour Bank-Account Closure Response Protocol: losing a banking partner is a common wind-down trigger — here is how to survive it before it forces an exit.

The firms that pass inspection are the ones that treat wind-down as an engineering problem solved in the calm, not a legal narrative written in the storm. Build the trigger ladder, cost the stressed runway, test the asset return, and fund the capital against it — and you keep your firm, and your customers' money, on Rung 1 where everyone wants it to stay.