What is the MiCA passport mechanism? How can one license cover the entire EU or European Economic Area?

The MiCA passporting mechanism grants licensed Crypto-Asset Service Providers (CASPs) cross-border rights under the Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114). Once a CASP secures Article 63 authorization in its home country, it can leverage the Article 65 notification procedure to offer authorized services across other EU member states and EEA countries—eliminating the need to reapply for a license in each host country.

Prior to MiCA’s implementation, crypto platforms seeking to operate in multiple jurisdictions had to navigate each country’s separate registration process. The MiCA EU regulatory framework standardizes CASP licensing and client protection rules at the EU level. The passporting mechanism serves as a “single authorization, multi-country service” interface, providing a clear legal foundation for cross-border operations.

What Is the Passporting Mechanism? How Does Article 65 Work?

MiCA’s passporting mechanism is grounded in Article 59(7) and Article 65. Article 59(7) establishes the cross-border rights of licensed CASPs, while Article 65 details the notification process. Passporting is a notification-based system—CASPs are not required to submit separate capital or AML documentation to host NCAs or wait for approval.

The standard process involves four steps:

1. The CASP completes Article 63 authorization with its home NCA.
2. The CASP submits a cross-border notification to the home NCA, specifying the host countries, service types, and crypto-asset categories.
3. The home NCA forwards the notification to the host NCA, ESMA, and EBA within 10 business days.
4. Upon completion of the forwarding, the CASP can provide authorized services in the notified host country.

If the CASP wishes to add new service types, it must first amend its home authorization under Article 63 and then update its passport notification.

This table summarizes the Article 65 process. Unlike country-by-country licensing, approval is centralized with the home NCA; the host country simply receives an information notice, not a new license application.

Figure 1. MiCA passporting process: After home country authorization, a CASP can access EU and EEA host markets through the Article 65 notification procedure.

How Do Home and Host NCAs Divide Responsibilities?

MiCA’s cross-border supervision adheres to the “home-state supervision” principle. The home NCA grants Article 63 authorization and is responsible for prudential oversight, ongoing compliance reviews, and forwarding passport notifications. The host NCA does not reissue licenses but retains authority over local market conduct, anti-money laundering (AML), consumer protection, and may impose temporary precautionary measures under Article 88(4).

This table clarifies the division of responsibilities. User complaints are generally handled by the CASP’s home NCA; issues involving local market conduct can also be referred to the host NCA. ESMA may coordinate in cross-border disputes.

Figure 2. Comparison of home and host NCA supervisory responsibilities under the MiCA passporting framework.

What Information Is Required in the Passport Notification?

Article 65(1) requires CASPs to notify the home NCA of the intended host countries, CASP service types, relevant crypto-asset categories, and marketing arrangements in each host country. If the CASP conducts targeted promotions or local-language advertising, this must be disclosed in the notification.

CASPs do not need to contact each host NCA directly—the home NCA is the sole channel, forwarding notifications to ESMA, EBA, and relevant host authorities. The 10-business-day timeline begins upon receipt of a “complete notification.” Passport notification and initial authorization are separate processes: the European MiCA license application process focuses on Article 63 authorization, while passport notification extends cross-border services based on existing authorization and requires much less documentation.

Which CASP Services Are Covered by the Passporting Mechanism?

MiCA Annex I specifies 10 CASP service types, including custody and administration, operation of trading platforms, exchange between crypto-assets and funds/crypto-assets, client order execution and transmission, placement, investment advice, portfolio management, and client transfers. Passporting only covers services explicitly listed in the authorization; services not included in the original authorization cannot be automatically added through passporting. Stablecoin issuance authorization and CASP passporting are governed by separate regulatory tracks.

Gate Technology Limited is licensed as a CASP by the Malta Financial Services Authority (MFSA), offering exchange, client execution, platform operation, custody, and transfer services. Upon authorization, Gate Technology Limited initiated the MiCA passporting process and, according to Gate Group’s public disclosures, has extended services to 29 EEA member states, including Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, and Sweden.

What Does Passporting Mean for Users?

For EEA users, the CASP entity they interact with should be listed in the ESMA public register. MiCA rules on client asset segregation (Article 70), capital adequacy, complaints handling, and fee transparency apply to all passported host country services. Users should confirm the contracting legal entity, home country, and authorized scope—not just the brand domain. The ESMA CASP register can be used to verify the LEI, home NCA, and host country list.

MiCA authorization applies to specific services of a specific legal entity, not all global products under the brand. A platform may offer spot and custody services in the EEA via a licensed entity, while other products may be provided by other group entities. Users should review local terms of service to distinguish between MiCA-covered and non-MiCA products.

How Does Passporting Relate to National Transition Periods?

Article 143 of MiCA provides a transition period for CASPs operating under national law before December 30, 2024, with a maximum duration until July 1, 2026 (subject to earlier deadlines set by each country). Transitional registration does not equal MiCA authorization and does not confer passporting rights—only CASPs with Article 63 authorization can initiate Article 65 notifications. After July 1, 2026, CASPs without MiCA authorization providing regulated services in the EU will be in violation.

This table highlights the legal distinction. CASPs with authorization and completed passporting are not subject to the transition period; those relying on the transition regime must monitor local deadlines in each host country.

How Does Passporting Differ from Reverse Solicitation?

Passporting applies to CASPs authorized in an EEA home country actively entering a host country. Reverse solicitation applies to non-EEA CASPs responding to unsolicited contact from EU users without targeted marketing. If a CASP conducts local advertising or targeted promotion in a host country, MiCA authorization and passporting are generally required—reliance on the reverse solicitation exemption is not permitted. See MiCA reverse solicitation rules for details. The two frameworks differ in client protection, asset segregation, and supervisory recourse.

Summary

The MiCA passporting mechanism enables CASPs with Article 63 authorization to provide authorized services across the 27 EU countries and three EEA countries (Iceland, Liechtenstein, and Norway) via Article 65 notification. The home NCA is responsible for primary supervision and notification forwarding; the host NCA focuses on local market conduct and AML oversight. Passporting only covers services listed in the authorization; transitional arrangements do not grant passporting rights. Gate Technology Limited, after receiving MFSA authorization, has implemented EU passporting, extending CASP services to 29 EEA member states.

FAQ

What Is the MiCA Passporting Mechanism?

The MiCA passporting mechanism allows a CASP authorized by its home NCA to submit an Article 65 cross-border notification, which the home NCA forwards to the host NCA, ESMA, and EBA. The CASP can then provide authorized crypto-asset services in the notified EU and EEA member states without reapplying for a license in each host country.

How Many Countries Can One MiCA License Cover?

A MiCA CASP authorization, combined with Article 65 passport notification, can theoretically cover all 27 EU member states plus Iceland, Liechtenstein, and Norway—30 jurisdictions in total. The actual scope depends on the host countries and service types listed in the notification and authorization.

Does Passport Notification Require a Separate Application to the Host Country?

No. CASPs only submit the Article 65 notification to their home NCA, which will forward it to the host NCA, ESMA, and EBA within 10 business days. The host NCA does not reauthorize but retains local market conduct and AML oversight powers.

Can CASPs Operating During the Transition Period Use Passporting?

No. Transitional arrangements allow CASPs to operate under national law while awaiting authorization, but this does not constitute MiCA authorization or grant Article 65 passporting rights. Only CASPs with formal Article 63 authorization can initiate passport notification.

How Do I Check a CASP’s Passport Coverage?

You can verify the entity name, LEI, home NCA, authorized services, and notified host countries in the ESMA-maintained public CASP register. This register is the primary source for confirming MiCA authorization and passport status and should be cross-checked with the home NCA’s local registry.

What’s the Difference Between Passporting and Reverse Solicitation?

Passporting applies to CASPs authorized in an EEA home country providing cross-border services to a host country; reverse solicitation applies to non-EEA CASPs responding to unsolicited EU user contact, without active marketing. The two differ in compliance requirements, client protection, and supervisory recourse.