MiCA explainer

Segment Review 29.10.2026: CASP and Wallet Security

Explanation and Watchlist Edition: The Baltic and Nordic CASP landscape at the end of October, the Payward-Saldo Bank transaction, and hardware wallet reseller security. No fresh news in the segment this time.

Toms Ābeltiņš

29 October 20267 min read

There has been no new, clearly datable significant event in the segment over the last 24 hours – so this is an explanation and watchlist edition. We look at the regional CASP landscape (around 377 licences in the EEA as of 19.10.2026), Payward's 14 October agreement to buy Lithuania's Saldo Bank, and the hardware wallet reseller security story.

Thursday, 29 October 2026. This is an explanation and Watchlist format edition, not a classic daily news publication. Over the last 24 hours, there have been no new, clearly datable, and significant regulatory or product events in our segment – crypto exchanges and CASPs, hardware wallets, crypto cards, and tax tools serving the Baltics (LV, LT, EE) and Northern Europe (FI, SE, NO, DK). To avoid presenting older events as fresh news, this time we offer a map of the regional segment's status at the end of October, based on verifiable dates, and an updated watchlist of ongoing stories.

CASP Landscape in the Region: ESMA Register Mid-October

After 1 July 2026, when the MiCA transition period concluded, the main structural indicator for our segment is the register of Crypto-Asset Service Providers (CASPs) maintained by the European Securities and Markets Authority (ESMA). According to publicly available summaries of the register, as of 19 October 2026, there were approximately 377 licensed CASPs across 27 countries in the European Economic Area. This figure should be considered approximate – it is compiled by third-party tracking tools, and the exact number is subject to frequent changes, so the authoritative source remains the ESMA register itself.

In the Baltics, two Latvian-licensed companies – Noah LV SIA and Atrya Technologies SIA – were added to the register at the beginning of October, with their authorisation date listed as 30 September 2026. As this date is over a month old and based on data from a tracking tool, we do not consider it fresh news, but rather regional context confirming Latvia's role as one of the most active CASP jurisdictions in the region. Any decision regarding collaboration with these companies should be verified directly in the ESMA and Latvijas Banka registers.

The broader picture has not changed since the summer: according to a 3 July compilation by regional industry media Kaupr, there were around 38 MiCA-authorised companies in the Nordics and Baltics, of which approximately 35 are pure CASPs. Latvia had the most authorisations in the region, while in Estonia, Lightspark Payments Europe received the first individual CASP licence on 1 July. Major local players – Firi and NBX in Norway, Safello in Sweden, Coinmotion in Finland, Lunar and Coinify in Denmark, CoinGate in Lithuania – continue to operate under a licensed regime.

Kraken Parent Company Buys Saldo Bank: Convergence of Exchanges and Banks

The most significant structural event in the region over the past month is the 14 October announcement by Payward, the parent company of crypto exchange Kraken, of an agreement to acquire Saldo Finance Oy – the Finnish-registered holding company of Saldo Bank. As the announcement is two weeks old, we view it as context rather than yesterday's news, but its impact on the segment is significant enough to warrant a separate analysis.

Saldo Bank UAB is a digital specialised bank registered and licensed in Lithuania: it is licensed by the European Central Bank and supervised by the Bank of Lithuania. The bank serves customers in Lithuania, Finland, Sweden, and Germany, and employed over 90 staff at the end of September. Payward states that its banking arm currently operates under an Irish electronic money institution licence, which does not allow for interest payments on deposits or the issuance of loans; a credit institution licence removes these restrictions and would allow for offering deposit interest, lending, and banking-as-a-service. The transaction amount has not been disclosed, and its closing is expected in 2027, subject to approval by the Bank of Lithuania and the ECB.

This is the first instance of a crypto industry company acquiring an EEA-licensed credit institution, and it marks a clear trend: the convergence of exchange and banking services. The interpretation should be taken with caution. The transaction is not yet complete and depends on supervisory approval, but supervisors are likely to carefully assess a deposit bank taken over by a crypto-origin owner. For Baltic and Nordic users, the direct impact is not yet felt, but the strategic signal is clear: Lithuania is strengthening its position as a gateway through which international crypto platforms gain full banking infrastructure in the EEA.

Watchlist: Hardware Wallet Security

In the hardware wallet segment, two related but distinct security stories continue in October. These are not news from the last 24 hours, and we are keeping them on our watchlist with precise dates.

On 9 October, a security incident related to Ledger devices came to light: according to reports, attackers had modified devices sold through a third-party reseller, physically inserting hidden hardware implants. Estimated losses reached approximately 93 million US dollars. It is important to emphasise that these claims of implants are indications, not independently confirmed conclusions, and the final technical picture is still emerging.

In response to this incident, on 13 October, Trezor's Chief Commercial Officer, Danny Sanders, announced that the company would reduce its network of authorised resellers, with some partnerships ending on 1 January 2027. Trezor stresses that there is no evidence of Trezor devices themselves being compromised, and that the move is a precautionary measure to work with a smaller, fully vetted number of partners. For background, in August 2026, Trezor experienced a data breach through a third-party fulfilment service provider, which exposed customer personal information.

Separately, the 3 June discovery regarding the TROPIC01 security chip used in Trezor Safe 7 remains valid. The Ledger Donjon team, in an independent audit, found that a laser fault injection attack could extract some of the chip's protected secrets. Trezor states that user funds remain secure – keys and wallet backups are not stored on this chip – but a complete fix cannot be delivered remotely as the problem is at the hardware level; potential improvements are expected in future chip versions. The regional conclusion for users in the Baltics and Nordics remains unchanged: purchase hardware wallets only from the manufacturer or directly verified channels and follow official security announcements from manufacturers.

Crypto Cards and Tax Tools

There have been no new regional developments in the crypto card segment in recent days. Earlier launched pan-European products – including the Kraken Mastercard debit card in the EEA and UK, launched in July with up to 2% cashback in Bitcoin – are still formally available to Baltic and Nordic EEA users, but no separate regional announcements have been recorded during this period.

In the tax tool segment (Koinly, Blockpit, Divly, and similar), there have been no clearly datable new products or regulatory events during this period. We are keeping this category under close observation as the end of 2026 and the 2027 tax season approach, when crypto transaction declarations and tool compliance with local requirements will become relevant for Baltic and Nordic users.

Side Events Outside Our Segment

For completeness, we note two recent regional events that fall outside our narrow segment and pertain to the topic of tokenisation: on 27 October, Lithuanian company VIALET announced the addition of tokenised money market funds in collaboration with Axiology, and on 26 October, news emerged of Latvia's plans to create a framework for commercial property tokenisation by 2027. These events do not relate to crypto exchanges, wallets, cards, or tax tools, so we mention them only as collateral context.

Looking Ahead – Next Checkpoints

In the coming weeks, the main points to watch in our segment are as follows. Firstly, ESMA CASP register updates: any new authorisation for a Baltic or Nordic company will be a direct segment event. Secondly, the progress of the Payward and Saldo Bank transaction – the stance of the Bank of Lithuania and the ECB on a credit institution with crypto-origin ownership. Thirdly, the evolution of the hardware wallet reseller security story and potential new manufacturer announcements. Fourthly, regional developments in crypto cards and tax tools in the context of the tax season. We will include each of these in the daily or weekly review as soon as a clearly datable event emerges.

Norriwire Briefing