EU Passporting for CASP License: One Authorization, 27 Markets

EU passporting is a cornerstone of the European single market for financial services — and MiCA extends this principle to crypto-asset service providers for the first time. Before MiCA, a crypto firm wanting to operate in France, Germany, and Poland needed to navigate three separate regulatory regimes, three applications, and three ongoing supervisory relationships. MiCA eliminates that fragmentation.

Under MiCA Articles 60–76, once a company obtains CASP authorization in its home member state, it acquires the right to provide any or all of its authorized crypto-asset services in any other EU member state — known as the host member state — purely through a notification procedure. There is no separate application, no additional fees to the host regulator, and no approval required from the host NCA.

The mechanism mirrors the EU passporting framework already used for investment firms (MiFID II), banks (CRD), and payment institutions (PSD2). MiCA brings crypto into the same single-market architecture, meaning the EU now has full regulatory harmonization for crypto-asset services across its entire territory.

The practical implication: after your home NCA forwards the notification, you can begin serving clients in the host country immediately — before the host NCA has even reviewed the notification in detail.

Passporting under MiCA is a two-phase notification process. The CASP submits a notification to the home NCA; the home NCA forwards it to the host NCAs. The CASP may then operate. Here is the full procedure:

What the Notification Must Include

MiCA Article 60(1) specifies the content of the passporting notification. Under ESMA's technical standards, the notification typically includes:

• The host member state(s) where services will be provided
• The specific crypto-asset services (from MiCA Annex I) to be provided in each host state
• Whether services will be provided on a cross-border basis (remotely) or through a branch
• A start date (which cannot be before the date of transmission by the home NCA)
• For branch passporting: a business plan, branch address, senior management identities, local AML officer details, and organizational structure

For pure cross-border service provision (no physical branch), the notification is simpler and faster. Most CASPs begin with cross-border passporting to test markets before establishing physical branches.

EU passporting under MiCA covers all 27 EU member states. The table below shows key details for each jurisdiction, including its NCA and any significant local considerations for passported CASPs:

EEA States (Norway, Iceland, Liechtenstein)

The EEA (European Economic Area) agreement generally incorporates EU financial services legislation. MiCA is being reviewed for EEA incorporation — once adopted, Norwegian, Icelandic, and Liechtenstein CASPs will benefit from the same passporting rights. Check with local counsel for the current adoption timeline in each EEA state.

Choosing the right home jurisdiction for your CASP authorization determines your passporting base, your regulatory costs, your operational overhead, and how quickly you can enter new EU markets. There is no single "best" jurisdiction — the optimal choice depends on your business model, target markets, and capitalization.

MiCA distinguishes between two forms of passporting. Understanding the difference is critical for operational planning:

Cross-Border Service Provision (Remote)

A CASP provides services to clients in the host member state without a physical presence there. This is the default starting point. The notification is straightforward — just a letter specifying services and target countries. The CASP operates entirely from its home state infrastructure. Most CASPs providing exchange, custody, or portfolio management services use this model.

Notification content: Host states, services, start date. Forwarded by home NCA within 10 working days. CASP starts operating on that date.

Branch Passporting (Physical Presence)

A CASP establishes a physical branch in a host member state — with local staff, a registered address, and client-facing operations. The branch notification is more detailed, similar to a mini-authorization application. The home NCA reviews it, may request clarifications, and then forwards to the host NCA within 2 months. The branch cannot start until the home NCA completes the review.

Additional requirements: Branch business plan, address, senior manager details, AML officer designation, organizational structure chart, and description of services to be provided at the branch.

EU passporting removes the requirement for a separate license in each host state — but it does not create a "regulation-free" zone. Passported CASPs must comply with host-state rules in several important areas:

AML/KYC Obligations

Anti-money laundering and counter-terrorist financing obligations derive from the EU's AMLD (Anti-Money Laundering Directive) framework, which is harmonized but implemented at national level. CASPs must apply the AML requirements of each member state where they provide services. In practice, for cross-border provision, this usually means applying your home state's AML regime — but you should verify host-state specifics, especially for higher-risk jurisdictions.

Consumer Protection and Marketing Rules

MiCA establishes baseline consumer protection standards. But host member states may have additional rules: language requirements for retail contracts (Germany, France, Spain), mandatory risk warnings, advertising restrictions, and complaint-handling obligations. France's AMF, for example, requires pre-notification before broadcasting crypto advertising to French retail clients.

Host NCA Supervisory Powers

Host NCAs retain supervisory jurisdiction over conduct matters in their territory. If a passported CASP breaches conduct rules in Germany, BaFin can act — including requiring the firm to stop providing services in Germany. This is separate from the home NCA's authorization supervision.

Tax and Employment Law

Passporting has no effect on tax obligations. Each host state may have crypto-specific tax rules (capital gains, VAT, transaction taxes). Establishing a branch creates a permanent establishment for tax purposes. Cross-border service provision generally does not create local tax presence — but this requires case-by-case legal analysis.

The European Securities and Markets Authority (ESMA) plays a central coordination role in the MiCA passporting system. ESMA maintains the public register of all authorized CASPs and their passporting notifications — the so-called ESMA CASP Register.

Under MiCA Article 109, ESMA publishes and maintains on its website a register of all authorized CASPs, including the member states where each CASP is authorized to provide services (both home state and all host states via passporting). This creates a centralized public record that host NCAs, clients, and counterparties can query.

ESMA also issues technical standards (RTS and ITS) governing the format and content of passporting notifications, the supervisory cooperation arrangements between home and host NCAs, and the procedures for passporting withdrawal or suspension. The ESMA CASP Register is the definitive reference for verifying a firm's passporting status.