Crossmint's General Counsel on AI Agents, Liability, and MiCA 2.0

It's the new core for the next era of finance.

Alright. Alright. Well, we got my job. Welcome to the show. Hello. Thanks for having me. Great to meet you. There like I said, we got to talk with the CPA before you. Now we're going to legal. We're getting we're getting it feels like we're back in college or something right now, getting getting a master class on the on the few topics that are we get to touch on, but they're a little bit outside of our realm. So Sure. Maybe let's just start, like, what's your journey been like into Crossman?

We don't get to talk about talk with your persona that much on this show. So what does it look like? And, like, what does it mean to sit in the seat that you do at Crossman? Sure.

Like, I started my career in actually, I started my career in sales after school, after college, but immediately moved to to legal because I didn't like and I had the a double degree in in business management and law. Got by going to law. Big law, actually, I spent five years in in a big law firm in Spain.

And when I was there, out of the blue lottery, which you have had in the in the in the show, I think, a couple months ago, like, our CEO, he reached out when he was originally incorporating Croftment with, like, several questions because we have been in the same in the same university. Actually, he did, like, an engineering, and I did, of course, law. And he reached out and, like, I have these questions. I don't know. Where to incorporate? How to incorporate, whether I don't know.

Like, all these even legal questions that I I help him with. He eventually incorporated in in in Delaware, Delaware Corporation, which we eventually moved into Miami into Miami. And when was originally raising our CSA, he reached out again and said, look. We need a lawyer as soon as possible. Did you wanna join? I'm like, I didn't have a clue about crypto blockchain at the time. This was September, October two thousand twenty two.

But, anyway, I thought it was I was actually thinking of of going in house, and I thought it was the right opportunity. Probably, actually very convincing and super charismatic, so I he he got me he got he convinced me, and I said, I and I joined. When I joined, actually, Crossman was just focused on NFTs. Things have changed a lot from what we started and where we are now. We shifted to stablecoins and broader infrastructure in 02/2324.

I, of course, managed the full regulatory trip of CrossMin from, again, focus on being focused on NFTs, which was a nonregulated environment, a nonregulated asset to where we are today, which we are focused purely on infrastructure for for stablecoins and money movement. I've I manage the the regional vast registration in Europe. We are working on other licensing at the moment in other jurisdictions. Yeah. It's been an amazing trip, an amazing journey for me as a general counsel, actually. I've I've learned loads.

I've been the the the interesting thing is that I've seen how regulations have been designed starting in Europe, then The UK, all the jurisdictions, The US now with genius. It's it's been yeah. I don't think I've I I I would have been able to leave the journey anywhere else, but now I I think I have a gap of a great regulation. Right? It's still very moving pieces. Like, things are gonna still gonna change. The regulators are still understanding where we are and where we should go next.

But if not the worldwide West, think it was when I joined. I think they're more clear now for for all players in the stay in the in the space. I think we have some certainty of where we should go and, like, states and relations and everything. So it's actually good not only for us as the players, but also for the the clients and the and the big clients coming into the space who want this kind of they want certainty.

They want they want players who have done their their homework, and they have been quite listed by by local city regulator like ESMA or the all of the all of the national regulators in Spain or in in The US for all of the the state money money transmit regulations in The UK, the FCA, etcetera, etcetera. Right?

Like, I think we are in a very in a very good spot now in terms of being able to offer our the the enterprises and the the institutional clients some certainty and some warranties that they are getting into a regulated industry so they can operate with all of the the controls and the the warranties that again, that we are not a bank, but we are a financial institution, not a crypto institution. We are a financial institution now.

And that helps a lot with the conversations too, with clients, with counterparties, with vendors. It helps a lot. And, of course, I mean, it's not been easy, but it pays off. Right? Like, we I think we've we didn't at the time when we started there with our bus registration back in 2023, we didn't expect it would be be so hard to get here. But now that we're here, we we really appreciate that we made investment because it's it's helping us.

I think we can grow a lot more that now that we're here versus if we have just stayed another way to partner or in NFTs and just focus on that very niche market. Right? So, yeah, we're very happy. I'm very happy to have to have the opportunity with company. Gone

through the the difficult journey of really pursuing licensing directly and and getting those in house and pursuing those in house. Is that when you think about the difficulty or the the hardness that you're talking about, what does that specifically look like for someone in your position on the legal side of things with getting these licenses? We just saw that, you know, CrossFit is now Mica authorized. Like, what bring us into the difficulty of what this looks like for those who aren't familiar.

What what's so hard about this? So,

I mean, as I mentioned, we started as an NFT company originally. That means we I mean, we are a a crypto native company. And our staff, our team, most of the OGs that we started here, they are crypto native. So we we have already start up, like, crypto like mindset that we have to completely change as we moved into the other way to space. Right? That doesn't happen from in in a in a day. You know? Like, we we need to educate the developers.

We need to hire the right people, compliance people, payments, engineers, payments, experts, external council, of course, you know, the the jurisdictions that you operate. So the the changing mindset is very, very relevant because, again, we have all of these competitor who have decided to stay out of of the regulated space and continue to be in the in the worldwide data of of of crypto, and that's up to them.

But if for us in house and with our team, we have got to make this change in how everyone operates because we have our all of our policies, how things need to be done now following a framework, a procedure. We have a lot of reporting in place that we need to communicate to the to the regulator. They can come at any time in house and do a a supervision and and, you know, ask questions, interview people in the team. We haven't had that, thank god, by the at the time, but it could happen at any time.

So we but we need to have everyone on board with what they need to to to know, to understand, to communicate to the regulator if it if it comes to that. So that's that's the biggest at the at at least the the first stage. So to be able to educate the team in in becoming that a financial institution and not just a crypto a crypto player. Right? Then at this once you have the the team ready, you need to hire more.

You need to to build a framework, to build infrastructure, to invest a lot of money in in that in the the the right individuals to improve the the infrastructure so it's it's enterprise grade because the regulator is gonna come in. It's gonna check everything in terms of SLAs, resiliency. We are subject to DORA now. DORA is a a European regulation that focus on resiliency of the infrastructure that you have in place. It's applicable to all financial institutions operating and servicing clients in Europe. DORA.

D o r a. It's Digital Operational Resilience Act. Yeah. That's it. Okay. Okay. Heard it from me. So but, again, it's focused on resiliency to to making sure that if there's ever a a leakage or a or a or the systems go down, you are able to to keep the the the formation of the of our clients in place to to be able to to get all the backups and the the the the infrastructure you be able to move it to a to a second data center or whatever so that we can continue to service our clients.

That takes, again, a lot of time, money, investment from the team, investment from the from our our engineers, which is not focused on developing the product. And then interacting with the regulator. Like, we are a start we not we're not a start anymore. We are 80 people strong now. But when we started talking to the regulator, we were three people in the team, 10 based in Spain, 20 in The US at the time. And the regulator sees that and think, look. These guys, they are not ready. They are talking to banks.

They're talking to to companies like Coinbase and the like, who are huge big. They have 100 of lawyers and compliance people in in house versus us that at the time we were three people in in legal and compliance. Of course, we moved from three compliance to, like, 12 that we have today, which is over, like, 15 to 20% of our team is now in in compliance to legal. But at the time, again, we were pretty small, and and they see that. And they didn't trust us at the time.

We needed to to gain their trust, gain their confidence, came to a lot of meetings, explain a lot of things to them. Another thing is that the regulator, of course, this is new to them. Like, I mean, not not not anymore, but when we started talking to regulator, the Spanish regulator back in 2024, Mika was something that was completely new to the officers in there. Then also came. Like, we actually, I was they were getting in house training, and I was an instructor for some of the topics that they were receiving.

But on on the other side of the table, I was also talking to them to get in the license. Right? Like, it was a back and forth, of course, it was super professional. They they were very thorough and kind of the the requirements were very very clear, and and ESMA, the European regulator was providing the right guidance, but they were they were they needed to to be with us.

In Spain, for example, I think at the as of now, there's only, like, nine or 10 CASPs, crypto asset service providers, licensed under MICA, and six are banks. So that can give you an idea of the kind of players that have a MICA license versus three or four that we are in Spain regulated that are pure crypto players. Right? And the same requirements apply to all. It doesn't matter if you are a crypto or a crypto entity a crypto native entity or you are a bank. The same requirements are gonna apply to you.

So, and that's that's huge to be able to to offer the same kind of of quality and the same kind of of infrastructure to your client. But if we were a bank, that that's what our client want. That's why we now can go into those billing tab until our clients that we have that enterprise grade infrastructure available to them. And we couldn't say that before. Like, we couldn't go to our our client and say, we have everything all this in place because we didn't have a seal from our regulator saying, hey.

These guys did that. Now we have it. So and that's also critical that is also helping a lot of our our go to market team to be able to sell to bigger clients, bigger deals. So, hopefully,

things go can only go better for Plasmid Moino Yeah. From here. Miguel, I'm I'm curious. We we've kinda seen this, you know, Mika's come to fruition. Some companies like I think Tethr is one of the big ones that you, you know, you would think would seek regulation. And they said, actually, no. We're gonna gonna leave this geo. We're not gonna seek seek to be Mika compliant. There's other teams that just I think 17, don't quote me on that directly, but have actually gone from BaaS to being fully MICA compliant.

Help us understand why does that gap exist, and then what's next for even the people that are MICA compliant or by a certain date if they aren't compliant? What happens? What happens to the current landscape? So the gap is

it is due to what I meant, Tom. The the the the change in mindset, the investment requirements, like, in to have capital requirements. In our case, we offer exchange, and transfer services. So the capital requirements were a 115 €125,000, but then we got additional requirements because we also we are also p f d two licensed now. We are at $300,000 euros at the moment, which is not I mean, they're easy to get, but that does one thing.

That is infrastructure training for the for everyone in the company, guarding the right the right relationship in place with banks, infra providers, everyone. DORA, which is again one of the biggest, toughest parts of the of the the infra requirements. So that's the that's the the first thing. The BAS the BAS registration was originally just an this was pretty much just an AML registration. So you just needed to meet AML requirements, submit some reporting to the local AML supervisor, and that and that was it.

Whereas Mika is, like, super comprehensive. Like, it covers the honorability and knowledge of the portal of the people in the team. It covers infrastructure. It covers resiliency. It covers procedures, market dominance. I don't know. Like, commercial marketing, everything. You know? So you need to have a lot of moving objects, blocks in place. Very well very well coordinated. The people in the team needs to be to be aligned with being thorough and and honorable and and ethic.

So it changes the the com the composition completely from what the the basic game basic. But they made regulations that were that were the only requirement for for math. So that's that's the first thing.

Therefore, the for the players that are now wear masks and have had to leave or are in the process of of leaving or or getting a license, the regulator asks for either an exit plan or a transition plan so that the clients that were were being serviced by by a VaaS entity would have to been to have been moved to a regulated entity client, like a regulated entity like CrossMiner.

Lot of of we have kept on clients moving from vast that were losing their license, and we have received those clients from from those vast entities to us, which is great. And I know a lot of them are still are still working on on getting a license, which I hope a lot of them will get by the end of this year.

And then probably as as twenty two thousand twenty six comes to an end, it will be, like, a lower rate of of new players, entities getting into getting a CAS license because, again, the values to entry are very high versus what was required before. And we will see less and less entities coming into place. It will be the biggest the biggest the typical again, coming to Coinbase's crackers and the such, then some infra products like Crossmead and and and other and others like this.

And then probably some banks we want to come in later and and join the the the market. Right? And for the future, well, for us, we had to get the PSD2 license just to give you some idea. So, originally, Mika was supposed to get you everything you needed to know that to to service clients with crypto with crypto services.

But last year, I think it was in June 2025, ESMA came up with a requirement that if you were offering stablecoin services in payments, so being able to use stablecoins for payments or for payment accounts, you needed to get also a PSD2 license, which is a payment license. Right? So another environment of entry, another regulator in our case, in most local regulations in Europe. So if you want to be servicing clients in in terms of festival containments in Europe, you're also gonna need a PSD2 license.

Hope in the future, maybe this it's not gonna happen. There there's been some discussion that PSD two PSD three will unify MICA and and and PSD two or three for for payments, but we don't know about that. But in in any of it, what what I wanted to say is that you if you wanted to offer stable con service stable con money service, you need an an additional license, which we have today. Thank god.

So for players operating in in crypto, in Europe, you also need to get into payment into payment regulations, which is another another barrier, more more reporting, another greater, which is a pain. And finally, for the future is MICA 2.0 is on the works. I think we're very superbly. I don't know what where where things will land with with the commission. It could I I don't expect to get any any clear evolution in 2028 earliest, so there's a lot of things to be discussed yet. Yeah. That seems like a long time.

Why why that long? So Europe is very is is usually slow in in getting new release and enacted. And actually, is quite is very comprehensive. So there's no I don't think there is a rush to get new a new Mica 2.0 out there. I think we still need to see how the current players that have been operating under MICA for less than a year, and most of them were actually under the grandfathering period. So most of us are operating under MICA have have been operating under MICA for less than a month.

We need we all need and the regulator need to see to have feedback from from the players, what we're seeing, what the regulator is seeing, what is coming up during supervision for the regulator. So after, you know, after some back and forth, they will have a better idea of where where the the weaknesses of of MICA are, where there are ups from MICA are, But the market is really demanding, where the bad players are actually exploiting the gaps and the the the the the weaknesses of MICA.

And with that, there will be more time to actually take action and and enforcement and and a new regulation trying to to to improve what is called it is today. But it's it's super early for everyone in the space to to think about AMCA 2.0. Of course, are gaps in AMCA, IDFi and yielding and and others and deposits.

So there's there's things that where there is a gap. Speak a little bit about those gaps. Like, what what are the things that even the two MICA 2.0 doesn't have that you wish it did or things that are still missing in regal in the regulation there?

You said yield, DeFi lending. What does that look like right now? Sure. I mean, there's so for DeFi, there's no there's no mention in in in MICA, so we we cannot know. There is and I think this is common not only in Europe, but for everyone for every jurisdiction out there, no one knows no one knows how to explain what decentralized really means. Like, what is sufficiently decentralized in order to call a DeFi protocol sufficiently decentralized to be considered decentralized? Right? Like, we don't know.

There's a lot of moving pieces. There's a lot of of artifacts, a lot of things that are being designed by by crypto companies out there to to be able to design new new DeFi models, new DeFi services. So it's difficult to understand for a regulated product related point of view what really the quarter DeFi release.

And, again, because of that, I think we we need to all to think about, I mean, not not CrossFit, of course, but the regulator really thing needs to to understand very well what DeFi is, how they could regulate it so that when a protocol is not essentially this is really decentralized, it's actually centralized because the power of the protocol is really falling on a a handful of of operators or even one operator, and it then it it really needs it's not decentralized, so it really needs some regulations so that it cannot be exploited.

That that's one of the biggest gap I see. Again, I don't have an answer for it. Hopefully, in some in some time, everyone in this week can come today and and really define what the centralizes and what centralizes. I mean, we all know what centralizes, but we don't really know what the centralizes. So that's what's that's a big one.

Then for yielding, I think it's a bad because it's I think it's easy to understand that why regulated crypto company like us or any other crypto asset service provider out there could not offer yielding on on stablecoin deposits. I don't I don't understand why not, but it cannot. It's one of the of the bands under MICA that you can stablecoins deposits cannot offer yield. So this is one of the gaps that I think should be addressed by MICA 2.0 at some point.

And, I think the simple solution is if if you have TIP plus service providers that meet all of the MICA requirements, all of the prudential requirements, capital requirements, everything, why shouldn't be or or or under maybe a new category of of service and the maker be able to to provide yield? We'll see. Also, deposits stablecoin deposits are not guaranteed versus fiat deposits. And in Europe, there's a a warranty of fiat deposits up to €100,000 or for consumers, which is not replicated for stablecoins.

That's how they got that ECC address.

But, of course, that takes time, and I think it's maybe more about politics than any anything else. What what just to think through this from your vantage point, like, is either on one point o or two point o, what is something that you're seeing in the regulation that you personally think is you know, if you had kind of the power to strike something or suggest something, what what would you do if you had full control? Are there any things that you feel like are a little ridiculous or shouldn't be in there? Or

what's your perspective on that as someone who's spent a lot of time looking into it? I mean, first of all, I want to to be clear that I and we are trusting the respect totally the criteria of the regulator on how they design MICA. However case, however, if I if if I handle the power, I will and I put this time in or I could improve my custom policy. Again, yielding yielding is is an easy one.

We see clients trying to understand why or how they could offer yield on deposits of stablecoins, and sometimes they they don't understand why they can't. So that's an easy one for me that I will I would would be I would give casts the ability to offer yield on stablecoins. That's a that's a first. Another one that I don't think is a problem of MICA, but it's a problem that has come up after MICA was envisioned and its agents.

So we see we see agents we see we see stablecoins as the natural currency for agents to operate with. It it does make sense. So agents need a a credible, reliable way to operate, and smart contracts give give them the right tools to do it. However, today, it's very uncertain who should be liable in the event that an agent screws things up. Right? Like, that's not clear at all. With I don't know. And and when I speak to other lawyers, clients in space, we are not in an agreement.

We are never in an agreement as to who should be to blame if if things goes off. So that's probably one of the biggest pieces that I would ask Mika 2.0 to focus on on try to address. Just build a, I don't know, like, a framework to ask to address who should be if things fail in this space, it's the responsibility of the car issuer. If something fails in in the imprite, the the responsibility of of the imprite provider, if it's on the the positives on the back, I don't know.

But, no, I like a very clear separation of the possibilities. So if an if an agent that can operate as intended, this is what's gonna happen, and this is who's going going to blame. And maybe there's gonna be the need for some new insurance policies that cover agents, which I think are already being worked by some providers, which makes a lot of things. And I I think there's a market for that. There's gonna be a market for that. So that's another one.

How to give how to regulate the stablecoins so that they are the natural and the the the default tool for for agents to operate and to spend money off of the users. And finally, I mean, from an NFT background in in CrossMeet, one of the missing things in in Mika were that NFTs were left behind completely out of the of of of relations. I think that's an easy one. Just give us some tools to understand how to to deal with NFTs and also with Ningquins, which are our biggest asset category today.

And it's not very clear as if they fall on the on the MICA, which I think they do. Others don't understand don't think they fall on the MICA. So, you know, give us uncertainty as to how to deal with MINCOIDs.

So those three and and yielding and and agency in probably the two the most important on my wish list if I had to to ask for something. Yeah. It's crazy. The things that you don't think that you we the things that we don't know that we should be thinking about. You know? And I imagine the agents, it's like, who would have thought in a year, in six months that it would be this pressing of conversation? You know? I think I think back to when I first started using ChatGPT to write out, you know, a LinkedIn post.

It's like, I'll use it here and there, and now, you know, AI is completely consumed to, you know, majority of business operations and, you know, how Okay. How what's gonna happen in the next two years, especially when it comes to actually moving money, which is inevitable, it feels like, at this point. Totally. Yeah. I think agents and stablecoins

I mean, agents in general deserve their own regulation. At the end of the day, they are dealing with users' money. It's very risky that congregated companies are moving and touching people's money. That's usually where bad players come into play and steal money from users. But at the end of the day, if, you know, you have Mika, you have CASPs, the HD move. Of course, I'm a document, and we have a Mika license. But I think the HD move are going to be to just say, look.

As with anything any player with moving moving parts of the users, you need a license. Whether it's a Mika license, whether it's PSD two, MiFID, whatever, just leave money movement to related players as many other related business and industry, and it will usually be safer for the user. Awesome. Percent.

Miguel, thing we miss, I know we've I know we've been taking a deep dive in here. We gotta pause, move on to the next guest. But anything that we missed here that, as we close, you wanted to leave the audience with? No. I think I I think we covered everything. I think the biggest question mark for everyone to think about is agents and how we're gonna be we're gonna give users

the power to trust their agents to spend their money on a reliable

CrossFit? CrossFit seems to be, like, really doing a lot of powerful work, especially the, I think, the x four zero two relationship, the infrastructure tooling, relationship to point base, and, like, it seems like there's a lot of upside and and even existing momentum. A lot of companies are just now entering this conversation and kind of figuring out what to do.

I feel like CrossMint has been really, you know, laying the foundation for an agentic economy for payments and and commerce for longer than people realize. So, yeah, I'm excited to see more of that and, yeah, excited to keep following the journey of of what's what's possible with the tools that you guys have built. Because, yeah, from my vantage point, the NFT when I first got to know CrossMint, it was definitely in the same, like, I think around the time you did too.

And I was like, NFT infrastructure, and some of my friends even were, like, working and selling that infrastructure. And even at that time, like, CrossFit was crushing it. Like, CrossFit was serving a lot of the marketplaces and trading applications, helping companies in the NFT business do commerce on top of really what is tokenized assets and things like stablecoins and all this other stuff. It's very it's not exactly the same.

It's obviously different, but tokenization of assets is the way that we're framing it, the way that we're talking about it. Like, moving a stablecoin from point a to point b is, in some ways, more related than most people think to moving an NFT from point a to point b. So, yeah, excited. It it's cool to see the, like, the evolution and the the way that the positioning of the brand has changed too. I'm I'm really bullish on you guys. So thanks for taking the time. Thank you. And we're excited to stay in touch. Yeah.

Thank you.