Cross-border crypto services in EU under MiCA: Restrictions and Passport Rules

The landscape for cross-border crypto services is the provision of cryptocurrency-related financial services across national boundaries within a unified regulatory framework has shifted dramatically since the end of 2024. If you are running a crypto business or planning to enter the European market, the old days of navigating twenty-seven different national rules are over. The Markets in Crypto-Assets (MiCA) Regulation is the European Union's comprehensive legal framework governing crypto-asset issuance and service provision now dictates how these services operate. This isn't just about compliance checkboxes; it fundamentally changes who can serve whom, where they can be based, and what they must disclose.

For many providers, especially those outside the EU, this feels like a wall going up. For those inside, it’s a bridge being built-but only if you follow the specific construction plans laid out by Brussels. Understanding the restrictions under MiCA is no longer optional; it is the difference between operating legally and facing severe penalties or being blocked entirely from the single market.

How the EU Passport System Works for Crypto Providers

The core mechanism that enables cross-border crypto operations are business activities allowing authorized entities to provide services in multiple jurisdictions under one license in the EU is the passport system. Think of it like a driver’s license: once you get licensed in your home country, you can drive anywhere in the union without needing a new permit for every border you cross.

Under MiCA, a Crypto-Asset Service Provider (CASP) is an entity authorized to offer services such as exchange, custody, or trading of crypto-assets obtains authorization in its home member state. Once approved, it can notify other member states where it intends to operate. This notification process replaces the need for separate licenses in France, Germany, Italy, and so on. It drastically cuts down on administrative overhead and allows firms to scale across Europe with a single point of regulatory contact.

However, this convenience comes with strict conditions. You cannot simply register in the most lenient jurisdiction and ignore local nuances. The home authority remains primarily responsible for supervision, but host authorities still have powers regarding consumer protection and market conduct within their borders. The passport ensures uniformity, but it does not eliminate oversight.

Strict Rules for Non-EU Providers: The End of Easy Access

If your company is based outside the European Union-whether in the US, Asia, or elsewhere-the rules are significantly tighter. MiCA closes the loophole that previously allowed non-EU exchanges to serve EU clients freely. Now, third-country providers face two main paths, and neither is easy.

1. Establishing an EU Entity
To actively solicit customers or promote services in the EU, a non-EU firm must set up a legal entity within the bloc. This subsidiary must obtain full CASP authorization under MiCA. This means meeting all capital requirements, hiring compliant staff, and adhering to EU operational standards. It is a costly and time-consuming process, designed to ensure that EU consumers are protected by entities subject to direct EU supervision.

2. Reverse Solicitation
The alternative is "reverse solicitation." This occurs when an EU client independently contacts a non-EU provider without any prior marketing or promotion from the provider. In theory, this allows some cross-border business to continue. In practice, the European Securities and Markets Authority (ESMA is the European Union's financial regulatory agency responsible for securities markets and crypto-asset oversight) has issued guidelines that make this exception very narrow.

You cannot run ads targeting EU users. You cannot list your website in EU search results with promotional content. You cannot email potential clients. If there is any hint that you initiated the contact or encouraged the request, it is not reverse solicitation. National authorities have the discretion to shut down services if they believe a provider is circumventing the rules. For most global exchanges, setting up an EU subsidiary is the only viable long-term strategy.

Operational Burdens: What CASPs Must Do Daily

Getting the license is just the beginning. Operating as a CASP under MiCA involves continuous compliance efforts. The regulation imposes prescriptive organizational rules that mirror traditional finance. Here is what you need to manage:

• Safekeeping of Client Assets: You must keep client funds and crypto-assets separate from your own corporate assets. Segregation is mandatory to protect users in case of insolvency.
• Outsourcing Controls: If you outsource critical functions (like IT infrastructure or customer support), you remain fully liable. You must ensure vendors meet EU security and data protection standards.
• Market Abuse Detection: Providers involved in trading must implement systems to detect insider dealing and market manipulation. This requires sophisticated monitoring software and trained compliance officers.
• Anti-Money Laundering (AML): MiCA works alongside the EU Anti-Money Laundering Directive. You must perform customer due diligence (KYC), monitor transactions for suspicious activity, and report to financial intelligence units.

These requirements are not suggestions. Failure to maintain proper records or detect illicit flows can result in license revocation. For smaller startups, the cost of building these internal controls can be prohibitive, which is why industry experts note that MiCA may favor larger, well-resourced firms over innovative newcomers.

Special Scrutiny for "Significant" Providers

Not all CASPs are treated equally. MiCA introduces a tiered approach based on size and impact. A provider is classified as "significant" if it serves at least 15 million active users annually within the EU. This threshold captures major global exchanges and large custodial wallet operators.

Significant CASPs face additional supervisory layers. They must report directly to ESMA and cooperate with a supervisory college comprising regulators from all relevant member states. This means more frequent audits, stricter stress testing, and higher transparency obligations. The goal is to prevent systemic risk-if a giant platform fails, it shouldn’t destabilize the broader financial system.

This classification also affects stablecoin issuers. Asset-referenced tokens (ARTs) and e-money tokens (EMTs) linked to significant issuers undergo rigorous reserve management checks. Issuers must prove they hold sufficient high-quality liquid assets to back their tokens and guarantee redemption rights for users. Liquidity maintenance is continuously monitored, ensuring that users can always cash out at par value.

Transitional Periods and Implementation Realities

MiCA was implemented in phases. The first phase, covering ARTs and EMTs, took effect on June 30, 2024. The second phase, regulating general CASPs and other crypto-assets, became fully applicable on December 30, 2024. However, the transition hasn't been uniform across all 27 member states.

The regulation allowed countries to adopt shorter transitional periods for existing local providers. As of early 2025, fifteen EU nations chose to accelerate their implementation timeline. This created a patchwork of deadlines during the transition year. Companies had to track which national authorities were enforcing MiCA rules earlier than others. While the passport system is now live, legacy issues from national regimes may still surface in edge cases.

Furthermore, the European Commission issued delegated acts in late 2024 detailing technical standards for own funds, remuneration policies, and stress tests. These secondary regulations provide the granular details needed for daily operations. Ignoring them is not an option; they form part of the binding legal framework.

Impact on Embedded Finance and Niche Platforms

A common misconception is that MiCA only applies to dedicated crypto exchanges. In reality, the regulation is activity-based. If your business offers crypto-related services-even as a small part of a larger operation-you fall under MiCA’s scope. This includes embedded finance platforms, fintech apps adding crypto wallets, and payment processors handling tokenized assets.

For example, a neobank that allows users to buy Bitcoin through its app must register as a CASP for that specific activity. It cannot hide behind its banking license alone. This broad reach ensures that consumer protections apply regardless of the business model. It also means that companies integrating crypto features must assess their entire product suite for compliance gaps.

Token issuers are not exempt either. Any project launching a new crypto-asset to the public must publish a detailed white paper compliant with MiCA standards. This document must disclose risks, technology details, team information, and economic models. Faking or omitting material information leads to severe liability. The era of anonymous launches with vague promises is effectively over in the EU.

Looking Ahead: Global Influence and Future Adaptations

MiCA positions the EU as a global leader in crypto regulation. By creating a clear, comprehensive framework, it attracts legitimate businesses seeking regulatory certainty. Many international firms are establishing EU hubs not just for market access, but to use the region as a base for global operations. The "Brussels Effect" is at play here: other jurisdictions may align their rules with MiCA to facilitate cross-border cooperation.

However, the landscape is not static. Decentralized finance (DeFi) and emerging technologies like central bank digital currencies (CBDCs) pose ongoing challenges. ESMA continues to develop guidelines to address these evolving areas. Regulators are watching closely to see how decentralized protocols interact with centralized service points. Expect further clarifications and possibly additional restrictions as the technology matures.

For businesses, the key takeaway is adaptability. Compliance under MiCA is not a one-time project; it is an ongoing operational discipline. Those who invest in robust governance, transparent reporting, and user-centric design will thrive. Those who try to cut corners will find themselves excluded from the world’s largest single market.