MiCA passporting

The mechanism sits in Article 65 of Regulation (EU) 2023/1114. A provider files its target country list with its home authority, which forwards it to the host regulators, ESMA and EBA within 10 working days, and service may start by the 15th calendar day after the filing. A passport tells you who supervises a platform, not whether that platform will accept you.

How it works

MiCA passporting runs on a notification, not on a second application. Article 59(7) says a crypto-asset service provider is allowed to provide services throughout the Union "either through the right of establishment, including through a branch, or through the freedom to provide services", and that a provider serving clients across borders "shall not be required to have a physical presence in the territory of a host Member State". Article 3(1)(34) names the host Member State as the one where the services are provided, where that differs from the home state.

The filing itself is short. Article 65(1) asks the provider to give its home authority four things: the list of member states it intends to serve, which crypto-asset services it will provide on a cross-border basis, the starting date, and a list of its other activities that the Regulation does not cover. Article 65(2) gives the home authority 10 working days to pass that on to the single points of contact of the host member states, to ESMA and to EBA. Article 65(3) has it tell the provider that the message went out, and Article 65(4) lets the provider begin from the day it receives that confirmation, or at the latest on the 15th calendar day after it filed.

Two limits are worth knowing. A passport widens where a firm may work, never what it may do: Article 59(6) requires an authorisation to specify which services it covers, and Article 59(8) makes a firm that wants to add one apply for an extension, processed like a fresh authorisation. The passport is also derivative. Under Article 64 the home authority can withdraw the licence outright, and paragraph 8 of that article obliges the firm to keep procedures ready for the timely and orderly transfer of client crypto-assets and funds to another provider when that happens.

Why this matters when you buy bitcoin

Passporting is the reason a European exchange page on this site can name a regulator in a country you do not live in. Across the 231 country guides here, the European entries often rank a platform whose supervisor sits elsewhere in the bloc. When a guide says an exchange is regulated in Europe, the honest reading is that one named authority in one named country supervises it and the other member states rely on that.

Relying is not the same as having no say. Article 102 lets the competent authority of a host member state that has "clear and demonstrable grounds for suspecting that there are irregularities" notify the home authority and ESMA. Where those irregularities persist despite the measures the home authority takes, and amount to an infringement of the Regulation, the host authority takes its own measures to protect clients, including preventing the provider "from conducting further activities in the host Member State". The local regulator therefore keeps a backstop in a market where it issued no licence.

Treat the licence and the account as separate questions. Nothing in Article 65 obliges a firm to open its doors in a state it has notified, so a firm can hold a passport for the whole bloc while its signup flow accepts a much shorter list. That is why a country guide here lists the platforms that actually serve that country, which is a different question from which licence any of them holds.

The third use is negative. If a platform courting you from outside the bloc cannot name a home authority and a notification behind it, it is not passported, and the protections the Regulation attaches to authorised providers do not reach the account you would open with it. That is checkable rather than a matter of trust. Under Article 109, ESMA keeps a register that carries, for every authorised provider, the competent authority that granted the authorisation, the list of crypto-asset services provided, and "the list of host Member States in which the crypto-asset service provider intends to provide crypto-asset services". Withdrawals of authorisation and precautionary measures taken under Article 102 are added to the same register and "shall remain published in the register for five years".

Bitvavo's AFM passport and its 25 supported countries

Bitvavo is the clearest worked example on this site of the distance between a passport's reach and a signup list. Bitvavo B.V. is licensed as a crypto-asset service provider by the Dutch Authority for the Financial Markets, and the company's announcement, dated 27 June 2025, says the licence "enables Bitvavo to offer its services across all EU member states, (as well as Norway, Iceland and Liechtenstein) under a single harmonised regulatory framework". Its help centre puts the same point in a user's language: Bitvavo "can now offer crypto-asset services in all EU countries under one license", and "without needing a separate license in every country".

That licence covers three named services: custody and administration of crypto-assets, operation of a trading platform, and transfer services of crypto-assets. The announcement also records what the passport replaced, since Bitvavo "already held registrations in several major European countries, including France, Austria, Italy, and Spain, in addition to the Netherlands".

Now compare the reach with the door. Bitvavo's own Countries page heads its table "Countries (25)". The help article prints 24 names under "Supported countries include:" and then closes the outer boundary in its FAQ: "At this time, Bitvavo only supports users who reside within the SEPA zone. It's not possible to create an account from countries outside this region." A passport covering every member state plus three EEA countries, and a table of 25 rows, are both accurate at the same time. The first is a permission the AFM granted. The second is a commercial choice Bitvavo made.

MiCA passporting vs reverse solicitation

MiCA passporting and reverse solicitation are opposite answers to one question: how a firm may lawfully serve a client in a member state where it holds no local licence. Passporting answers it with an authorisation plus a notification. Reverse solicitation, in Article 61(1), answers it with an exemption, because where a client in the Union initiates a service "at its own exclusive initiative" from a third-country firm, the Article 59 authorisation requirement does not apply to that service for that client.

The exemption is narrow by design. Article 61(1) says a third-country firm that solicits or advertises to clients in the Union, by any means of communication, is not providing anything on a client's own initiative, and that this holds "notwithstanding any contractual clause or disclaimer purporting to state otherwise". Article 61(2) adds that a client's initiative does not entitle the firm to market new types of crypto-assets or new services to that client afterwards. A passport is a standing permission. Reverse solicitation is a single client-shaped hole in the authorisation rule.

MiCA passporting vs regulatory authorisation

MiCA passporting and regulatory authorisation are two stages of one process, and only the first stage is a licence. Authorisation is Article 59: a person may not provide crypto-asset services in the Union unless authorised, and Article 59(2) requires a registered office in a member state where at least part of the services are carried out, a place of effective management in the Union, and at least one director resident in the Union. Passporting is what an already authorised firm does with Article 65 afterwards. It mints no new licence, adds no service, and triggers no host-state assessment of the firm.

The practical test is which document changes. Adding a country to a passport is a notification the home authority forwards within 10 working days. Adding a crypto-asset service is an extension of the authorisation itself, processed under Article 63. The passport is a map of countries. The authorisation is the list of things you are allowed to do in them.