One authorisation for the Union
Regulation (EU) 2023/1114 provides that a crypto-asset service provider authorised by the competent authority of its home member state may provide crypto-asset services throughout the Union, either through the right of establishment, including through a branch, or through the freedom to provide services. A provider that serves clients in another member state on a cross-border basis is not required to have a physical presence there. The authorisation specifies the services the firm may provide, and the passport extends to those services and no others; a firm that wants to add a service applies to its home authority for an extension of its authorisation, which is assessed in the same way as the original application.
The home member state is the state in which the provider has its registered office, and the Regulation requires that the provider carries out at least part of its crypto-asset services there, that its place of effective management is in the Union and that at least one of its directors is resident in the Union. The home authority therefore expects substance: a registered office that is no more than an address, with management and operations elsewhere, does not meet the condition, and the authority assesses this at authorisation and on an ongoing basis.
The notification
A provider that intends to provide crypto-asset services in more than one member state submits four items of information to its home authority: a list of the member states in which it intends to provide services; the crypto-asset services it intends to provide on a cross-border basis; the intended starting date; and a list of all its other activities that are not covered by the Regulation. The information is submitted to the home authority, and a firm that knows at the outset which markets it will serve submits it with its application so that the authorisation and the passport take effect together.
Within ten working days of receiving the information, the home authority communicates it to the single points of contact of the host member states, to ESMA and to the EBA, and it informs the provider without delay that it has done so. The provider may begin to provide services in the other member states from the date it receives that confirmation or, at the latest, from the fifteenth calendar day after it submitted the information. The host authority is informed of the notification, and its approval is not required.
Branches and establishment
A provider may also serve another member state through a branch. The branch operates under the home authorisation, and its details appear in the ESMA register alongside those of the provider. A branch brings the provider into closer contact with the host authority, which has the power under the Regulation to take precautionary measures where it has clear and demonstrable grounds to suspect irregularities and the home authority's own measures have not resolved them, including preventing the provider from conducting further activities in its territory. The choice between a branch and cross-border services is therefore commercial and operational rather than regulatory: a branch is required where local staff or premises are needed to serve the market, and otherwise the cross-border route is available.
The ESMA register
ESMA maintains a public register of crypto-asset service providers. The home authority communicates a newly authorised provider's details to ESMA within two working days of granting the authorisation, and ESMA makes them available in the register by the date the provider starts to provide services. The register records, among other things, the services the provider is authorised to provide, the host member states in which it intends to provide them, the starting date, its other activities not covered by the Regulation and, where applicable, its branches. Competent authorities notify ESMA of changes to this information, so the register reflects the passport notifications a provider has made. Clients and counterparties use it to confirm a provider's authorisation and scope, and a provider should check that its entry is accurate when it starts in a new member state.
What the passport does not cover
The passport covers crypto-asset services as defined in the Regulation. It does not extend to activities that are regulated under other EU or national law, which is why the notification lists the provider's other activities. A provider that also provides payment services, for instance in connection with e-money tokens, needs authorisation under the Payment Services Directive for those services, with its own passport; a provider that deals in crypto-assets that qualify as financial instruments needs authorisation under MiFID II. National law outside the Regulation, such as consumer protection, tax and the law of contract, continues to apply in each host state, and a provider should take local advice on it before it starts.
Nor does the passport change the provider's home regulator. Supervision of the provider's compliance with the Regulation remains with the home authority, and the host authority's role is to receive the notification, to cooperate with the home authority and, in the last resort, to take the precautionary measures described above. A provider that serves many member states therefore has one supervisor for its MiCA obligations, which is the practical value of the passport.
Firms outside the EU and reverse solicitation
A firm established outside the Union has no passport, and the authorisation requirement applies to it whenever it provides crypto-asset services in the Union. The only exception is where a client established or situated in the Union initiates the service at its own exclusive initiative. The Regulation construes that exception narrowly. Where the firm, or an entity acting on its behalf or having close links with it, solicits clients in the Union by any means, including promotion or advertising, the service is not treated as provided at the client's own initiative, and a contractual clause or disclaimer stating otherwise has no effect. A client's own initiative does not entitle the firm to market new types of crypto-asset or crypto-asset service to that client afterwards.
ESMA's guidelines on reverse solicitation, published in their final form on 26 February 2025, read solicitation broadly and in a technology-neutral way. Websites, social media, mobile applications, sponsorship and content produced by influencers or other third parties acting for the firm can all amount to solicitation, and the question is one of fact on which the firm should be able to produce records of how each client relationship began. A firm that wants to serve EU clients as a business, rather than respond to the occasional unsolicited request, needs an authorised entity in the Union, and the passport then gives that entity the whole of the single market.
How we can help
We prepare CASP applications to the competent authority in any member state, including the passport notification and the substance the home authority expects to see, and we advise firms outside the EU on the structure of an EU entity. See MiCA CASP authorisation, or speak to us. Our note on what the application requires covers the contents of the application, the capital and the assessment timetable, and a provider that transfers or holds e-money tokens should read our note on authorisation under PSD2.
Sources
- Regulation (EU) 2023/1114 on markets in crypto-assets, Articles 59, 61, 65, 102 and 109, as published on EUR-Lex
- ESMA, Guidelines on reverse solicitation under MiCA, 26 February 2025
- ESMA, Markets in Crypto-Assets Regulation, including the register of crypto-asset service providers
Checked 13 October 2026.