MiCA Passport Compliance Checker
Service Details
Compliance Results
Enter details and click "Check Compliance Status" to see your MiCA passport eligibility.
Key Requirements
- Full CASP Licence Required Mandatory
- Own-Funds Threshold €350k min
- Professional Liability Insurance Required
- AML/KYC Compliance Mandatory
- White-Paper for Token Issuers Required
Ever wondered how a crypto exchange can sell to users in France, Germany and Spain without setting up 27 separate licences? The answer lies in the EU’s MiCA passport - a single authorisation that unlocks the whole single market for crypto‑asset service providers (CASPs). Below you’ll learn the exact steps, the strict rules you must obey, and what it means if you’re a non‑EU firm trying to tap Europe’s 500million crypto users.
TL;DR
- MiCA’s passport lets a CASP authorised in one member state operate across all 27 EU countries.
- To get the passport you need a full CASP licence, own‑funds, insurance and a detailed white‑paper for token issuers.
- ‘Significant’ CASPs (15million EU users) face extra ESMA reporting and supervision.
- Non‑EU firms must set up an EU legal entity and obtain the same licence; reverse‑solicitation is a narrow loophole.
- Compliance costs are high, but the passport cuts duplication and creates a level playing field.
What is MiCA??
Markets in Crypto‑Assets Regulation (MiCA) is the EU’s first harmonised framework that treats crypto‑assets like any other financial product. Ratified in April2023, it rolled out in two phases - the first on 30June2024 for stablecoins (asset‑referenced tokens and e‑money tokens), the second on 30December2024 for all crypto‑asset service providers. From that date onward, any firm that wants to sell, custody or trade crypto assets in Europe must be a recognised CASP and abide by a common rule‑book.
The EU Passport - One Licence, 27 Markets
The core of MiCA’s cross‑border magic is the EU passport. Once a CASP obtains authorisation from the competent supervisory authority in its home member state, it can automatically provide the same services in every other EU country. The passport mirrors the freedom that banks and insurance firms already enjoy under the Capital Markets Union.
How it works:
- Choose a home member state (often the one with the quickest licensing queue).
- Submit a full CASP application - organisational structure, capital, insurance, AML policies and a public white‑paper (for token issuers).
- After the national authority grants the licence, notify the same authority of the intention to use the passport.
- The authority forwards the dossier to the European Securities and Markets Authority (ESMA) for a quick check.
- Once ESMA signs off, the CASP can start marketing and offering services in any EU state without further licences.
Key Obligations for EU‑Authorized CASPs
Getting the passport is only the start. MiCA imposes a suite of prescriptive rules that bring crypto‑providers in line with traditional finance.
- Organisational rules: A board of directors, risk‑management function and a compliance officer must be in place.
- Own‑funds and insurance: Minimum own‑funds are 350k€ for custodial services and 125k€ for exchange services; professional liability insurance is mandatory.
- Safekeeping: Client crypto assets must be held in segregated accounts or covered by a qualified holding arrangement.
- Disclosure: Public white‑papers for token issuers must detail technology, rights, issuance volume and reserve‑backing (for stablecoins).
- Market abuse monitoring: Real‑time surveillance systems to detect insider dealing, manipulation and wash‑trading.
- AML / CFT: Full customer‑due‑diligence (KYC), transaction monitoring and mandatory suspicious activity reports to the national Financial Intelligence Unit.
‘Significant’ CASPs - When Size Triggers Extra Supervision
If a CASP serves at least 15million active EU users in a twelve‑month period, it is deemed ‘significant’. These firms face additional scrutiny:
- Direct reporting to ESMA, including quarterly activity reports and stress‑test results.
- Higher own‑funds thresholds (up to 1million€) and stricter liquidity monitoring.
- Obligation to publish an annual public statement on governance, risk and compliance.
- Potential inclusion in EU‑wide supervisory colleges for coordinated oversight.
Non‑EU (Third‑Country) Providers - The New Reality
Before MiCA, a foreign exchange could simply target EU customers via its website. Now, the rules are tight:
- To actively solicit EU clients or run advertising, a third‑country firm must set up an EU legal entity (usually a limited liability company) and obtain the full CASP licence.
- The only loophole is reverse solicitation: an EU resident initiates contact without any promotion from the foreign firm. ESMA’s 2024 guidelines make this exception narrow - any unsolicited email, social‑media post or referral can be considered a breach.
- National authorities retain the right to demand a MiCA licence even for passive services, adding regulatory uncertainty.
In practice, most large global exchanges have responded by creating EU subsidiaries that hold a local CASP licence, thereby accessing the passport and avoiding reverse‑solicitation risks.
AML, Consumer Protection and the Broader Regulatory Ecosystem
MiCA does not exist in a vacuum. It sits on top of the EU Anti‑Money‑Laundering Directive (AMLD6) and works hand‑in‑hand with national Financial Intelligence Units.
- CASPs must verify the source of funds for transactions over €10,000 and retain records for at least five years.
- Suspicious Transaction Reports (STRs) must be filed within 24hours of detection.
- Consumer‑protection clauses obligate clear pricing, transparent fee structures and a 14‑day withdrawal right for stored crypto assets (subject to market‑risk disclosures).
Practical Checklist for Launching a Cross‑border Service
Use this cheat‑sheet as a project‑management guide. Tick each box before you apply for the passport.
| Task | Details | Status |
|---|---|---|
| Choose home member state | Consider licensing speed, tax regime, language support | ☐ |
| Set up EU legal entity | LLC or AG with registered office in the home state | ☐ |
| Prepare capital & insurance | Meet own‑fund thresholds; obtain professional liability cover | ☐ |
| Draft white‑paper (if token issuer) | Include tech specs, rights, reserve backing, redemption policy | ☐ |
| Implement AML/KYC | Risk‑based customer due diligence, transaction monitoring | ☐ |
| Build market‑abuse detection | Real‑time surveillance, alert escalation procedures | ☐ |
| File CASP licence application | Submit to national competent authority with all supporting docs | ☐ |
| Notify passport intent | Provide cross‑border service plan to home authority | ☐ |
| ESMA review | Address any queries within 30days | ☐ |
| Go live in EU market | Launch marketing, onboarding, and service delivery | ☐ |
Comparing EU‑Authorized vs Third‑Country Providers
| Aspect | EU‑Authorized CASP | Third‑Country Provider |
|---|---|---|
| Legal presence | EU‑registered entity (mandatory) | Optional; often no EU entity |
| Licensing | Full MiCA CASP licence required | MiCA licence only if actively soliciting EU clients |
| Passport rights | Automatic access to all 27 member states | None - must seek separate authorisations or rely on reverse solicitation |
| AML compliance | Full AMLD6 alignment, STR filing | May rely on home‑jurisdiction rules (higher risk of regulator push‑back) |
| Supervisory body | National authority + ESMA oversight | Home‑country regulator; EU authorities can still demand MiCA licence |
| Capital & insurance | Own‑fund thresholds (350k€‑1M€) and mandatory professional liability | Typically lower or none (subject to local rules) |
Next Steps and Common Pitfalls
Even with a checklist, many firms stumble early on:
- Under‑estimating capital: Regulators inspect balance‑sheet proofs rigorously; a shortfall triggers licence denial.
- Overlooking language requirements: All consumer‑facing documents must be in the official language(s) of the home state and, for marketing, in the language of the target market.
- Ignoring the ‘significant’ threshold: If you aim for rapid growth, start building ESMA‑reporting capabilities now.
- Assuming reverse solicitation is easy: Documentation of unsolicited client contact is scrutinised; any hint of promotion can be disallowed.
- Neglecting post‑licence supervision: Ongoing reporting, stress‑testing and policy updates are mandatory for the life of the licence.
Plan for a dedicated compliance team, partner with a EU‑based legal counsel, and allocate budget for the first‑year licensing fees (often €150‑300k). The payoff is access to a market that collectively holds more than €1trillion in crypto‑related assets.
Frequently Asked Questions
Can a crypto exchange based in Singapore serve EU customers without a MiCA licence?
No. Under MiCA, any firm that actively solicits EU clients or runs advertising must establish an EU legal entity and obtain a full CASP licence. The only narrow exception is reverse solicitation, where a EU resident contacts the firm on their own initiative - but ESMA’s 2024 guidance makes this path risky for a sustainable business.
How long does the passport approval process usually take?
After the national authority grants the initial CASP licence, the passport notification is reviewed by ESMA within 30days on average. Overall, from the start of the licence application to full passport activation, firms report 4‑6months if documentation is complete.
What are the own‑fund requirements for a custodial wallet service?
MiCA sets a minimum of €350000 in own funds for custodial services, plus a professional liability insurance policy covering at least €1million of exposure.
Do ‘significant’ CASPs have to report to ESMA in real‑time?
They must submit quarterly activity reports and annual stress‑test results. Real‑time reporting is required only for specific market‑abuse incidents, which must be communicated within 24hours of detection.
Is there a limit to the number of EU states a CASP can serve with one passport?
No. The passport grants unrestricted access to all 27 member states as long as the CASP complies with local consumer‑protection rules and maintains the required reporting back to its home authority.
Author
Ronan Caverly
I'm a blockchain analyst and market strategist bridging crypto and equities. I research protocols, decode tokenomics, and track exchange flows to spot risk and opportunity. I invest privately and advise fintech teams on go-to-market and compliance-aware growth. I also publish weekly insights to help retail and funds navigate digital asset cycles.