This article describes AuthOnce's design rationale and general compliance posture. It is not legal advice. Merchants should consult qualified legal counsel for their specific jurisdiction and use case before deploying billing infrastructure.
One of the most common questions we receive from merchants and developers evaluating AuthOnce is about regulatory exposure. Does operating a USDC subscription billing protocol require a Crypto Asset Service Provider (CASP) license under MiCA? Does it trigger VASP registration requirements? The answer, by design, is no — and this article explains the architectural decisions that make that true.
The Two Licensing Frameworks That Matter
VASP (Virtual Asset Service Provider) — The FATF framework defines VASPs as entities that conduct exchanges, transfers, safekeeping, or financial services related to virtual assets. The trigger is providing these services as a business activity.
CASP (Crypto Asset Service Provider) — Under MiCA (EU Markets in Crypto Assets regulation), CASPs are entities that provide crypto asset services including custody, exchange, transfer, and advisory services on behalf of clients.
Both frameworks share a critical threshold: they apply to entities that hold, transfer, or provide services over client assets. An entity that merely provides the software tools for parties to transact directly with each other occupies a different regulatory position.
AuthOnce's Software-Only Architecture
AuthOnce is a software protocol. It publishes smart contracts on Base Network. It provides a merchant dashboard and subscriber interface. It operates a Keeper that triggers contract execution. It does not, at any point, hold, custody, or control subscriber or merchant funds.
Non-Custodial By Design
Funds move directly from subscriber wallet to merchant wallet via on-chain smart contract execution. AuthOnce never holds funds in transit or in escrow.
No Fiat Touchpoints
AuthOnce does not convert, receive, hold, or transmit fiat currency, ever. All protocol activity is USDC on Base Network. Where a subscriber funds their wallet via card, an onramp partner (e.g. Circle, Coinbase) delivers USDC directly to the subscriber's own wallet — AuthOnce has no visibility into or involvement in that step.
BSL 1.1 Licensed Contracts
Protocol contracts are published under Business Source License 1.1. The license protects the codebase while allowing independent verification of protocol mechanics.
Open Execution Flow
The Keeper triggers EIP-2612 permit execution but does not authorize or approve transfers. Authorization comes from the subscriber's cryptographic signature — executed by the USDC smart contract directly.
CASP and VASP licensing applies to entities providing services over crypto assets on behalf of clients. Providing open-source software infrastructure that enables parties to transact directly on-chain occupies a categorically different position — analogous to a wallet software provider rather than an exchange or custodian.
Why Non-Custody Is the Legal Foundation
The most important regulatory threshold in both FATF and MiCA frameworks is custody. An entity that controls or holds client assets is providing a custody service and is squarely within regulatory scope. An entity that provides software tools for users to control their own assets does not cross this threshold — provided the software genuinely does not control or access funds independently.
In AuthOnce's architecture, the subscriber controls their USDC at all times until the moment of authorized execution. The non-custodial design means no AuthOnce-controlled address ever holds subscriber funds. The Keeper triggers contract execution but cannot redirect funds — the smart contract enforces the recipient address as the merchant's registered wallet, hardcoded at subscription creation.
No Fiat Leg, By Architecture
AuthOnce has no fiat settlement relationship of any kind. A subscriber who wants to fund their wallet with a card does so through an independent onramp partner (Circle, Coinbase Onramp) — the partner converts fiat to USDC and delivers it directly to the subscriber's own wallet. AuthOnce is never a counterparty to that transaction, never touches the fiat leg, and never holds a settlement relationship with any processor. This is not fiat activity routed through AuthOnce and offloaded — it is upstream of AuthOnce entirely, structurally outside the protocol's scope.
BSL 1.1 Licensing
The Business Source License 1.1 governing AuthOnce's smart contracts serves two functions: it protects the protocol from unauthorized commercial forks in the near term, and it provides full code transparency for audit, verification, and regulatory review. Any regulator, auditor, or merchant can read the complete protocol logic via the AuthOnce developer portal and verify that the custody claims above are accurate at the contract level. Protocol transparency is itself a compliance tool.
Deploy with confidence
Software-only protocol. Non-custodial. BSL 1.1 licensed. Full code transparency on GitHub.