The answer is MiCA's EU passport. It is a mechanism built into the regulation itself that allows a single authorisation, obtained from one national competent authority (NCA), to cover all Member States through a notification procedure rather than repeated full authorisations. It is one of MiCA's most valuable structural features, and it is one of the least thoroughly understood in operational terms. This guide covers exactly how it works, what you file, when services can commence, and what the host state can still require of you. If you are still assessing whether MiCA applies to your business at all, start with our MiCA applicability decision framework first.
What the MiCA Passport Actually Is
The MiCA EU passport — formally the right of a home Member State CASP to provide services in any host Member State — is established in Article 59 of Regulation (EU) 2023/1114. That article provides that a CASP authorised in one Member State may provide its authorised services throughout the Union. Article 65 then sets out the operational procedure: the notification content, the NCA-to-NCA communication sequence, and the timing rule that determines when cross-border services may lawfully begin.
Before MiCA, a crypto firm wanting to serve clients across the EU faced a patchwork of national regimes — France's PSAN, Germany's KWG registration, the Netherlands' DNB regime, and others — each with distinct requirements and no mutual recognition. MiCA replaces that fragmentation with a single authorisation standard. One home-state licence, one supervisor of record, and a notification right that is valid across all 27 Member States. Through the EEA Agreement, the passport also extends to Norway, Iceland, and Liechtenstein, giving a licensed CASP access to a market of over 450 million people through a single authorisation.
The commercial implication: a CASP authorised in Malta can legally onboard clients in Germany, France, Spain, Poland, and every other EU and EEA state. It does not need a German BaFin licence, a French AMF authorisation, or a Spanish CNMV registration. The Article 65 passport notification covers all of them.
Who Can Passport — and Who Cannot
The passport right is available only to fully authorised CASPs — entities that have received a positive authorisation decision from a national competent authority under Article 63 MiCA, with that decision formally recorded in the ESMA public register of authorised CASPs.
Three categories of entity cannot use the MiCA passport:
- Grandfathered entities under Article 143(3). Firms that were operating under national law before 30 December 2024 and continued under the transitional regime were permitted to operate in their home Member State only. As we explain in detail in our guide to MiCA Article 143(3) grandfathering, Article 143(3) is a national — not EU-wide — permission. It does not activate passporting rights under any reading of the regulation. A French PSAN-registered entity operating in France under Article 143(3) could not legally onboard clients in Germany or Spain. With the transitional period now ended, this distinction is historical — but it was the most common misunderstanding among operators during the 2024–2026 transition window.
- Applicants with a pending MiCA application. Filing an application does not confer any operational permission beyond what the national transitional regime permitted. The passport right activates upon the authorisation decision — not upon filing.
- Third-country firms relying on reverse solicitation. Non-EU firms may serve EU clients only on the narrow basis of genuine client-initiated contact under
Article 61 MiCA. As we cover in our guide to MiCA reverse solicitation, ESMA's guidelines have made clear that this exception is extremely narrow and cannot be used as a structuring mechanism to avoid authorisation. Third-country firms wanting genuine EU market access must establish an EU entity and obtain CASP authorisation.
Verification step: before filing a passport notification, confirm your authorisation appears in the ESMA Interim MiCA Register. A notification filed while the home-state NCA is still processing the authorisation has no legal effect and creates a false impression of compliance.
The Article 65 Passporting Procedure, Step by Step
The notification procedure under Article 65 MiCA is a NCA-to-NCA mechanism. The CASP does not file directly with the host-state regulator. It notifies its home NCA, which then communicates the notification to each identified host NCA within the statutory timeframe. Here is the sequence as it runs in practice:
Step 1: CASP prepares and submits the passport notification to its home NCA
The CASP files a notification with the NCA that granted its authorisation. The notification identifies the Member States in which the CASP intends to provide services, the specific services to be provided in each, and the intended commencement date. Most home NCAs provide a standard form or electronic portal for this submission, aligned with the implementing technical standards under Commission Implementing Regulation (EU) 2025/306.
Step 2: Home NCA reviews the notification for completeness
The home NCA does not conduct a substantive assessment of whether the CASP is fit to operate in the host state — that question was resolved by the authorisation decision. The home NCA confirms only that the notification is formally complete and that the services being passported fall within the scope of the existing authorisation. Notifications covering services not within the authorisation scope will be rejected at this stage.
Step 3: Home NCA forwards the notification to the host NCA(s) — within 15 working days
Under Article 65(3) MiCA, the home NCA must communicate the passport notification to the competent authority of each host Member State within 15 working days of receipt. This is not a passive registration — it is an active NCA-to-NCA communication that formally establishes the CASP's right to operate cross-border in that jurisdiction. The home NCA simultaneously informs the CASP that the communication has been made.
Step 4: CASP may commence cross-border services — no host NCA approval required
Under Article 65(4) MiCA, the CASP may begin providing services in the host Member State on the date it receives communication from the home NCA that the notification has been forwarded — or at the latest on the 15th calendar day after submitting the passport notification, whichever is earlier. No approval from the host NCA is required. No waiting for the host NCA to accept, acknowledge, or respond.
Step 5: ESMA public register is updated
The passport notification and the Member States in which the CASP is authorised to provide cross-border services are recorded in the ESMA public register of CASPs. This is how clients, institutional counterparties, and supervisors verify a CASP's authorised cross-border scope. Confirm that the register reflects your passported states after filing — discrepancies should be flagged to the home NCA promptly.
What You Submit in the Passport Notification
The information required in a passport notification is set out in the implementing technical standards under MiCA. At a minimum, the notification must include:
| Item | What to provide | Notes |
|---|---|---|
| CASP identity | Legal name, LEI, home-state authorisation number | Must match the ESMA register exactly |
| Host Member States | Exhaustive list of each Member State to be served | Can cover multiple states in one notification |
| Services per Member State | Which authorised CASP services will be offered in each host state | Must be a subset of the authorised services — cannot exceed authorisation scope |
| Intended commencement date | Date you intend to start serving clients in each host state | Cannot pre-date the Article 65(4) trigger point |
| Client communication languages | Languages in which client documentation will be produced for each host state | Some host states have local language expectations — check NCA guidance per market |
| Branch details (if applicable) | Address and management details if establishing a local branch in the host state | Cross-border-only model does not require this field |
Timeline: From Notification to Lawful Cross-Border Services
The passport notification procedure is materially faster than a fresh authorisation. Understanding the full MiCA compliance timeline puts the passporting speed into context:
| Route | Timeline to commencement | Cost (indicative) |
|---|---|---|
| Fresh MiCA authorisation per host state | 9–15 months per jurisdiction (25-working-day completeness check + 40-working-day substantive review + information request cycles) | €150,000–€500,000 external legal fees per jurisdiction, plus application fees of €4,500–€100,000 |
| Article 65 passport notification | Up to 15 calendar days from filing; often 5–10 working days once home NCA processes and forwards | Internal compliance time to prepare; no NCA application fee in most jurisdictions |
A CASP authorised in Lithuania can be legally serving clients in France, Germany, and Spain within two to three weeks of filing the notification. Under the pre-MiCA patchwork of national regimes, reaching those same three markets would have required a French PSAN application, a German KWG process, and a Spanish CNMV registration — each running independently over many months, with no mutual recognition between them.
Timing in practice: do not wait for the 15-calendar-day ceiling before starting operations. File the notification, wait for the home NCA's confirmation email that the notification has been forwarded, and commence on that date. The 15-day ceiling is a legal backstop for slow NCA processing — most home NCAs communicate within five to seven working days.
Host-State Rules That Still Apply
The MiCA passport removes the authorisation barrier. It does not remove all host-state regulatory exposure. Several categories of obligation continue to apply to a passported CASP operating in a host state:
AML/CFT Supervision
Anti-money laundering supervision follows a different allocation than MiCA prudential supervision. Under the AMLA framework, AML/CFT supervisory responsibilities for cross-border CASP activities are allocated based on where the services are provided and whether the CASP operates through a branch or on a pure cross-border basis. A CASP serving German clients from Malta on a cross-border basis will primarily be subject to Maltese AML supervision for those activities, but host-state AML supervisors retain monitoring and coordination powers. Track where the AMLA allocation rules land your specific operating model before scaling into new markets. The DAC8 and CARF reporting obligations covered in our DAC8/CARF compliance guide add a further layer of cross-border data obligations from 1 January 2026.
Consumer Protection in Host State
Host NCAs retain emergency intervention powers if a passported CASP poses an immediate risk to clients or market integrity in their territory. While this power is designed as a last resort rather than routine supervision, it means the host NCA is not entirely passive. Host NCAs monitor complaint rates and escalate systemic concerns to the home NCA. A passported CASP with a high volume of consumer complaints in Germany will receive BaFin attention regardless of its Malta authorisation.
Marketing Communications
Under Article 66(1) MiCA — the general conduct obligation applicable to all CASPs — marketing communications must be clearly identifiable as such, fair, and not misleading. This standard applies in every Member State where communications are distributed, regardless of where the CASP is authorised. Host-state consumer protection authorities may additionally apply national advertising rules to the extent these are not pre-empted by MiCA. Check host-state NCA guidance on crypto marketing standards before launching paid campaigns targeting clients in a new jurisdiction. Germany's BaFin and France's AMF both publish specific expectations for crypto marketing materials targeting their retail client base.
Local Language Requirements
Some Member States expect client-facing disclosures — terms of service, risk warnings, white paper summaries — to be available in the national language. MiCA requires white papers to be drawn up in a language accepted by the home-state NCA, but host-state NCAs can have legitimate expectations about language accessibility for retail clients in their jurisdiction. Audit your client communication stack against the language expectations of each significant host market before onboarding clients there. Our guide to MiCA iXBRL white paper requirements covers the related disclosure obligations in detail.
Tax Obligations
Passporting under MiCA creates no direct tax presence in a host state. Tax residency, permanent establishment risk, and DAC8 reporting obligations depend on your corporate structure and the volume and nature of activities in each state — not on MiCA passport status. Obtain specific tax advice for each significant host market before scaling volume there.
Jurisdiction Comparison: Where to Base Your CASP
Because the home Member State is the only jurisdiction where you need to file a full CASP application — and because passporting gives you access to all other states regardless of home-state choice — the selection of home NCA is a process and relationship decision, not a market-access decision. Understanding the full CASP licence requirements across service categories is the prerequisite step before home-state selection.
| Jurisdiction / NCA | Processing time | Application fee | Profile fit | Notes |
|---|---|---|---|---|
| Luxembourg (CSSF) | 6–10 months | ~€10,000–€25,000 | Global brands, institutional custody, rapid passporting | Coinbase, Bitstamp, Clearstream authorised here; UCITS/AIFMD fund background makes CSSF comfortable with custody and segregation standards |
| Malta (MFSA) | 6–12 months | ~€5,000–€15,000 | Large exchanges, trading platforms, custody at scale | OKX, Crypto.com, Gemini, Bitpanda licensed here; longest-running crypto-native regulatory framework in the EU |
| Lithuania (Bank of Lithuania) | 4–8 months | ~€5,000–€10,000 | Fintech startups, payment-adjacent models, earlier-stage CASPs | Consistently faster processing times; established fintech infrastructure; proportionate approach for smaller models |
| Cyprus (CySEC) | 6–10 months | ~€10,000–€20,000 | Brokerage, OTC, crypto advisory services | Strong MiFID II heritage makes CySEC experienced with cross-border passporting mechanics and investment services conduct rules |
| Netherlands (AFM/DNB) | 8–14 months | Up to €100,000 | Payments-adjacent, on/off-ramp, institutional | Bitvavo, MoonPay authorised here; technically rigorous process; DNB ended grandfathering in June 2025, signalling supervisory seriousness |
| Germany (BaFin) | 10–18 months | ~€10,000 | Banks adding crypto, custodians, broker-banks | Most complex process; preferred by BaFin-regulated incumbents (Commerzbank, Trade Republic, N26, BitGo); grandfathering ended December 2025 |
A CASP authorised in Lithuania has identical legal access to the German and French markets as one authorised in Germany or France. The home-state choice affects your regulatory relationship, processing timeline, ongoing supervisory style, and the NCA's familiarity with your business model — not your market reach. ESMA's supervisory convergence programme has also narrowed the gap in what different NCAs actually require, so selecting a home state on the assumption it applies lower standards is an increasingly unreliable strategy.
Common Passporting Mistakes
Beyond the errors flagged in our broader review of MiCA compliance mistakes, passporting introduces its own category of operational errors:
Passporting services outside the authorisation scope
A passport notification can only cover services included in the home-state authorisation. A CASP authorised solely for custody and order reception cannot passport exchange services or portfolio management. To expand service scope, the CASP must first apply to its home NCA to amend the authorisation, then file a new or updated passport notification. Offering unauthorised services in a host state — even via a passported entity — is a breach of Article 59 and triggers the same Article 111 penalty exposure as operating without authorisation entirely.
Starting cross-border operations before the Article 65(4) trigger
Services may commence on the date the home NCA communicates that the notification has been forwarded — not on the date of filing, and not by assumption. If operations begin before receiving that communication (or before the 15-calendar-day ceiling expires), the CASP is technically providing services without the passport being legally effective. Build a simple process: file, wait for the home NCA confirmation, start on that date.
Confusing prudential and AML supervisory allocation
The home NCA is the prudential supervisor. AML/CFT supervisory responsibility for cross-border activities follows a different framework and may involve the host state's AML supervisor. Do not assume that being supervised for AML purposes by your home-state regulator covers your AML obligations in each host market. This is particularly relevant for CASPs providing high-volume services in large Member States such as Germany or France.
Not monitoring ESMA register updates after notification
Verify that your passport notifications are reflected in the ESMA public register within a reasonable time after filing. Institutional counterparties and corporate clients frequently check the register before onboarding a CASP. If the register does not show your passported states, those counterparties may incorrectly treat you as unauthorised. Follow up with your home NCA if register updates are delayed beyond two weeks.
Expanding into host markets without local client communication readiness
The legal right to onboard clients in a host state does not mean your operational infrastructure is ready for that market. Before going live, ensure: terms of service are available in the relevant language; KYC procedures account for local document formats; client support has capacity for queries from that market; and any marketing materials comply with both Article 66(1) MiCA and applicable host-state consumer standards. A passive or poorly localised experience generates complaints, and complaint patterns are how host NCAs identify CASPs that warrant escalation.
Map Your MiCA Authorisation and Passporting Scope
Run your business model through Compliora AI's 5-agent legal pipeline. Identify which CASP service categories you need, which jurisdictions your model covers, and what the authorisation and passporting sequence looks like for your structure.
Start Assessment →Frequently Asked Questions
Can a grandfathered CASP use the MiCA passport to operate across the EU?
No. The MiCA passport under Article 65 is available only to fully authorised CASPs. Entities operating under the Article 143(3) transitional regime were permitted to operate only in the Member State where they were originally authorised or registered under national law. The passport activates exclusively upon receiving a formal authorisation decision from a national competent authority. With the transitional period ended on 1 July 2026, this is now a historical constraint — but CASPs that served EU-wide clients under grandfathering without full authorisation were non-compliant throughout that period. See our analysis of the MiCA grandfathering period for the full country-by-country timeline.
How long does MiCA passporting take?
Under Article 65(3) MiCA, the home NCA has 15 working days to forward the passport notification to the host NCA. The CASP may commence cross-border services on the date it receives confirmation of that forwarding, or at the latest on the 15th calendar day after submitting the notification to its home NCA — whichever is earlier (Article 65(4)). In practice, most home NCAs process and forward within five to ten working days, meaning passporting typically completes in two to three weeks from filing. Compare that with the 9–15 months required for a full fresh authorisation.
Which regulator supervises a passported CASP in a host Member State?
The home NCA remains the primary prudential and authorisation supervisor for the CASP across all its activities. The host NCA assumes responsibility for consumer protection oversight within its territory and retains emergency intervention powers if the CASP poses an immediate risk to clients in the host state. AML/CFT supervision follows the AMLA framework and may involve the host state's designated AML supervisor depending on whether the CASP operates through a branch or on a pure cross-border basis.
Does passporting require physical presence in each host Member State?
No. MiCA's single authorisation model explicitly removes the obligation to establish a branch or subsidiary in each host Member State for cross-border service provision. A CASP incorporated and authorised in Malta can provide services to clients in Germany, France, and Spain without a local office. If the CASP does establish a branch in a host state, the branch details are included in the passport notification and the branch may be subject to local AML supervision — but branch establishment is a commercial choice, not a regulatory requirement for cross-border passporting.
Can a CASP passport services not covered by its home-state authorisation?
No. The passport covers only the services explicitly included in the home-state authorisation. A CASP authorised for custody and order reception cannot passport trading platform operation or portfolio management. To expand the passported services, the CASP must first apply to its home NCA to amend the authorisation to add the new service categories, then file a new or updated passport notification covering the expanded scope.
What happens if a CASP wants to exit a host Member State after passporting?
The CASP notifies its home NCA of the intended withdrawal. The home NCA forwards the withdrawal notification to the host NCA. The CASP must ensure orderly wind-down of client relationships in that jurisdiction — returning client assets held in custody, complying with applicable consumer protection and AML/CFT obligations during the exit, and providing clients with adequate prior notice of the cessation of services. The withdrawal process mirrors the notification procedure but runs in reverse.
Do I need a separate MiCA white paper for each host Member State?
No. A crypto-asset white paper submitted under MiCA in the home Member State is valid across the EU — it does not require re-approval or re-submission in each host state. Since 23 December 2025, all new MiCA white paper submissions must use iXBRL format rather than PDF. Our iXBRL white paper guide covers exactly what changed and what to do if your existing white paper was submitted in PDF. Host-state NCAs cannot impose additional approval requirements on a validly submitted MiCA white paper.
