Understanding Legal and Regulatory Frameworks in Digital Finance
One app screen can show a euro balance, a card, and a crypto balance stacked above one another in the same typeface. Visual continuity suggests legal continuity, and the two are unrelated. A Papaya Ltd licence crypto query is really a question about perimeters: which services sit inside the authorised institution, which sit outside it with another provider, and how a reader tells the difference from published documents rather than from layout.
The Interface is Not the Perimeter
Software presents services. It does not supply them. A single application can act as an access point to several legal relationships at once, and the design of the screen carries no information about which entity owes what to whom.
This is ordinary in modern payments, where providers assemble features from partners rather than building each one under their own licence. It becomes a problem only when the reader treats a regulatory fact about one entity as a fact about the whole interface.
The remedy is to work balance by balance, asking who the counterparty is for each one.
What the Register Records for the Issuer
The entity record for PAPAYA LTD in the European register of payment and electronic money institutions, observed on 22 October 2026, listed the institution type as electronic-money institution, the competent authority as the Malta Financial Services Authority, the national identification number as C55146, and a status of Authorised from 30 April 2012 marked Current.
The scope of that record is set by the legislation behind it. The MFSA supervises financial institutions under the Financial Institutions Act, which covers payment institutions and electronic money institutions, and Cap. 376 is activity-based: Article 3(1) requires a licence for the listed activities, and the authority may attach conditions, and may restrict, suspend, or withdraw a licence. Those listed activities are payment services and electronic money issuance.
They are not a general warrant over everything the institution’s brand touches.
Reading the Linked-Service Provisions
The document that settles the perimeter is the service agreement. Blackcat’s linked-service and provider terms, last updated 13 October 2026, describe linked wallets as accounts or balances held with third parties and connected to the user’s profile, and state that Papaya does not hold or control the funds in a linked wallet, with the third-party provider’s own terms governing the relationship.
The same terms name separate entities for separate features: the loyalty programme is operated by Baltic Technology Solutions OÜ, and the payment ring is provisioned through Fidesmo AB. The bonus payment is a part of the loyalty program provided by Baltic Technology Solutions OÜ. Detailed terms and conditions can be found at https://baltictechsolutions.com/loyalty-program-terms-and-condition.
For the virtual-asset wallet functionality, the terms name Manerio Inc., a company incorporated in Panama, and state that it is not authorised under Regulation (EU) 2023/1114 and is not supervised by the MFSA or by any other EU or EEA authority, operating instead under Panamanian law.
That is the provider’s own published position, and it is the material fact for this article: a service reached through the interface can sit under a different entity, a different jurisdiction, and a different regime from the euro account.
An integrated crypto exchange and custodial crypto wallets are provided by our partner MANERIO Sp. z o.o. You can find more information at https://maner.io/
Where the wording across sections is dense or appears to pull in different directions, the correct response is to read the clauses governing the specific service and, where it still matters, to ask the provider in writing. Reconciling an apparent inconsistency by assumption produces a confident claim with nothing under it.
An EMI Entry is Not a Crypto Authorisation
Crypto-asset services in the European Union sit under their own regime, with authorisation as a crypto-asset service provider under Regulation (EU) 2023/1114 and a separate supervisory relationship. That authorisation is granted to a named entity for named services, in the same activity-based way as a payment licence.
Two consequences follow. An electronic money institution entry establishes nothing about crypto-asset permissions, because the two authorisations are issued under different instruments and recorded in different places.
And an institution’s e-money authorisation is not extended to a partner by the partner’s appearance in the same app. Anyone assessing a crypto feature has to locate the entity providing it and then check that entity’s own position, which may be an authorisation in an EU member state, a third-country regime, or neither.
Four Things to Establish for a Third-Party Service
- Authorisation. Which regime, if any, the provider operates under, and in which state. An absence of an EU authorisation is a fact to record rather than a gap to fill with an assumption in either direction.
- Location. Where the entity is incorporated and which law governs the contract, since this determines the forum and the remedies available in a dispute.
- Residence restrictions. Whether the service is directed at, or available to, residents of the reader’s country. Terms that describe a service as aimed at non-EU residents are drawing a line that a reader in the EU should take seriously rather than route around.
- Protection arrangements. What, if anything, protects the balance. E-money safeguarding under Maltese law applies to funds received by the institution against electronic money. It does not reach a balance held by a different provider.
A Service-Perimeter Table
Euro payment account Papaya Ltd (C55146) MFSA, Malta; Financial Institutions Act E-money safeguarding under S.L. 376.04; outside the Depositor Compensation Scheme Per the account eligibility conditions Payment card Papaya Ltd, with scheme and provisioning partners MFSA, Malta, for the issuer; partners per their own terms As for the euro account; scheme rules separate Availability and delivery vary by country Loyalty programme Baltic Technology Solutions OÜ Unverified for this article; check the programme terms Not an e-money protection; per programme terms Per programme terms Virtual-asset linked wallet Manerio Inc. (Panama), per the terms Stated in the terms as not authorised under Regulation (EU) 2023/1114 and not supervised in the EU or EEA Not covered by the issuer’s e-money safeguarding Terms address EU and EEA residents specifically; read the relevant chapter in full
Service perimeter as described in the provider’s published terms of 13 October 2026. Fields not independently verified for this article are marked unverified rather than filled by inference. Source: Blackcat General Terms and Conditions, consulted 28 October 2026.
A Balance-by-Balance Checklist
For each balance visible in the interface, four answers are needed before any statement about protection is safe: the contracting entity, the document that names it, the regime that entity operates under, and what happens to that balance if the entity fails.
Where any answer is missing, the honest record is a blank with a note of what was asked and when, rather than a value carried across from the line above.
A reader who completes that exercise will often find that one interface contains several quite different legal positions. That is the finding, and it is more useful than a single verdict about whether the app is regulated.
Frequently Asked Questions
Does an EMI licence automatically authorise every crypto service?
No. Crypto-asset services sit under their own EU regime with separate authorisation for a named entity. An electronic money institution entry carries no implication about crypto permissions.
Can a linked wallet have a different legal provider from the euro account?
Yes. The Blackcat terms describe linked wallets as balances held with third parties, state that Papaya does not hold or control them, and name separate entities for certain services.
Where should a reader check which provider holds a particular asset?
In the service agreement clauses covering that specific service, read together with the partner’s own terms. The issuer disclosure and the register entry answer only for the issuer.