MiCA Passporting: One License for All EU Markets

MiCA passporting is the mechanism that lets a single crypto-asset service provider authorisation work across the entire European Union. Once a firm is authorised as a CASP in one Member State, it can serve clients in all 27 EU Member States by filing an Article 65 notification, not a second licence. One authorisation, Union-wide reach.

For founders and compliance officers weighing a European licensing strategy, this is the deciding feature of MiCA. Before MiCA, a crypto exchange or custodian that wanted to operate across Europe faced a patchwork of national registrations, each with its own application, fees and timelines. MiCA replaces that patchwork with a single-market passport built on two provisions of Regulation (EU) 2023/1114: Article 59, which grants Union-wide rights to an authorised CASP, and Article 65, which is the notification that switches cross-border operation on. This guide explains both, walks through the notification process and timeline, and shows what passporting does and does not change. It is grounded in the MiCA text as published by ESMA's Interactive Single Rulebook.

What is MiCA passporting?

MiCA passporting is the right of an authorised Crypto-Asset Service Provider to provide its crypto-asset services throughout the European Union under one authorisation, granted by its home regulator. Expansion to additional Member States is activated by an Article 65 notification, not by obtaining a new licence in each country. The reach is all 27 EU Member States.

The term "passporting" comes from EU financial-services law, where it describes the single passport that lets a regulated firm trade across the bloc on the strength of one home-state authorisation. MiCA applies that logic to crypto. The word "license" is colloquial here: the formal MiCA term is "authorisation," but the two describe the same thing, the legal permission to provide crypto-asset services. Throughout this page we use both, because that is how the market talks.

The single-license value proposition in one sentence

One CASP authorisation, granted by the National Competent Authority (NCA) of your home Member State, is the legal basis for operating across all 27 EU Member States under Article 59(7). You do not need a second authorisation per country.

Notification, not re-authorisation

This is the point that most often gets lost. Passporting is a notification regime, not a re-authorisation. When a CASP wants to operate beyond its home state, it does not re-apply, re-submit capital and AML documentation, or wait for a host-state regulator to approve it. It simply notifies its home NCA, which forwards the information onward. There is no host-state approval gate to clear, as confirmed by the Article 65 procedure published by ESMA.

The two legal pillars: Article 59 and Article 65

The single-market passport is not one rule but two provisions of MiCA working together. Article 59 establishes that an authorised CASP holds Union-wide rights. Article 65 is the procedural switch that lets the firm actually exercise those rights in a new Member State. Understanding the split matters, because it explains why expanding is a quick notification rather than a fresh licensing project.

Article 59(7): one authorisation, Union-wide rights

Article 59(1)(a) of MiCA states that crypto-asset services may only be provided in the Union by a legal person or other undertaking that has been authorised as a crypto-asset service provider. Article 59(7) then grants the cross-border right: an authorised CASP "shall be allowed to provide crypto-asset services throughout the Union, either through the right of establishment, including through a branch, or through the freedom to provide services," per Article 59. That single sentence is the legal foundation of the "one license for all EU markets" claim. It also names the two operating modes, establishment and freedom to provide services, that we cover further down.

Article 65: the cross-border notification mechanism

Article 59(7) gives you the right; Article 65 tells you how to exercise it. Titled "Cross-border provision of crypto-asset services," Article 65 sets out the notification a CASP files with its home NCA before serving a new Member State. The home NCA forwards that notification to the host regulators, and the firm may begin trading within a fixed, short window. No second authorisation is granted; the existing one simply travels.

How to activate passporting: the Article 65 notification process

Activating passporting follows three steps under Article 65. The sequence is the same whether you target one additional Member State or many: notify your home NCA, wait for it to forward the information, then start. The list below is the procedural core of the page, drawn verbatim from the Article 65 text.

Step 1: Notify your home NCA (what the notification must contain)

Before providing services in a host Member State, the CASP communicates four things to its home competent authority under Article 65(1):

1. the list of Member States in which it intends to provide crypto-asset services;
2. the crypto-asset services it intends to provide on a cross-border basis;
3. the starting date of the intended provision of those services;
4. a list of all other activities the CASP provides that are not covered by MiCA.

The fourth item, the non-MiCA activities, is a transparency requirement: the regulator wants a full picture of the firm, not only its MiCA-regulated lines, per Article 65(1).

Step 2: Home NCA forwards within 10 working days

Within 10 working days of receiving the notification, the home competent authority communicates the information to the single points of contact of the host Member States, to ESMA and to the EBA, under Article 65(2). You do not contact each host regulator yourself; the home NCA acts as the single channel. ESMA and the EBA are notified so the EU supervisory framework has visibility of the cross-border activity, as set out in the Article 65 procedure.

Step 3: Start serving the new market (commencement)

The CASP may begin providing crypto-asset services in a Member State other than its home Member State from the date it receives the home authority's communication, or at the latest from the 15th calendar day after submitting the Article 65(1) information, per ESMA's Single Rulebook entry for Article 65. In practice that means a fast, predictable go-live: if your home NCA forwards quickly, you can start on receipt; if it takes the full window, you are never left waiting beyond the 15th calendar day.

*Infographic 1 (timeline) sits here, immediately after the three steps.*

How long does MiCA passporting take?

MiCA passporting is fast: the home NCA forwards your notification within 10 working days, and you may begin serving the new market on receipt of that communication or, at the latest, on the 15th calendar day after you submitted. There is no separate host-state review period to budget for, which is the headline contrast with country-by-country licensing.

That speed is the commercial argument for passporting over building licences market by market. Obtaining a fresh national authorisation in each country meant months of work per jurisdiction; under MiCA, once you hold one CASP authorisation, each additional market is a matter of days, bounded by the 15-calendar-day backstop in Article 65.

The 15-calendar-day backstop explained

The 15-calendar-day rule is a backstop, not a target. It works in your favour because it caps the wait. Two scenarios follow from the Article 65 wording. If your home NCA forwards the notification quickly, you may start providing services the moment you receive that communication, which can be well inside 15 days. If the home authority uses the full 10 working days, the 15-calendar-day ceiling guarantees you can still commence shortly after, without any host-state authority needing to act first. Either way, the CASP is never left in open-ended limbo. This predictability is precisely what makes passporting a usable cross-border strategy rather than another waiting game.

Have questions about your specific situation? Book a free 15-minute discovery call with our licensed advisers, no commitment. Book a Call

Freedom to provide services vs establishment: the two expansion modes

Article 59(7) names two ways to exercise your Union-wide rights, and you can use either or both, market by market. The first, freedom to provide services, lets you serve host-state clients cross-border with no local entity. The second, the right of establishment, means setting up a physical presence or branch in the host state. Both operate under the same single CASP authorisation; the choice is operational, not a question of needing a new licence, per Article 59(7).

Freedom to provide services (no local entity)

Under the freedom to provide services, an authorised CASP serves clients in a host Member State on a purely cross-border basis, without establishing a local company, office or branch there. This is the lightest-touch expansion mode: it suits firms that want EU-wide reach from a single operational base in their home state. The activity is still covered by the firm's home authorisation and the full MiCA regime; only the notification under Article 65 is required to switch the host market on.

Right of establishment / branch (physical presence)

The right of establishment lets a CASP put a physical presence, including a branch, in the host Member State. Firms choose this mode when they want local staff, local client-facing operations or a market presence on the ground, for example to meet commercial expectations in a particular country. The branch operates under the same home-state authorisation; it is not a separately licensed entity. As with the cross-border mode, the Article 65 notification activates it.

*Infographic 2 (comparison) sits here.*

How many EU markets does one MiCA license cover?

One MiCA authorisation covers all 27 EU Member States. That is the firm, fully-sourced reach, grounded in the Union-wide right under Article 59(7). You will often see a "roughly 30 markets" figure that adds the three EEA-EFTA states; we treat that claim cautiously below, because its MiCA-incorporation status needs separate verification before it can be stated as fact.

All 27 EU Member States (the fully-sourced reach)

The reach you can rely on is the 27 EU Member States. MiCA is a Union regulation, and the Union-wide provision in Article 59(7) is what gives an authorised CASP the right to operate across them all on one authorisation. When we model a client's European footprint, this is the number we anchor to, because it is the claim the regulation supports without caveat.

What about the EEA states (Iceland, Liechtenstein, Norway)?

The three EEA-EFTA states, Iceland, Liechtenstein and Norway, are commonly bundled into a "30-market" footprint, on the basis that EU financial-services regulation is extended to them through the EEA Agreement. That logic is plausible, but the precise incorporation of MiCA into the EEA framework and its timing must be verified against an official EEA/EFTA source before any firm treats those three states as automatically in scope. Until that confirmation, we advise clients to plan on the 27 EU Member States as the firm reach and treat EEA access as a separate question to check market by market.

Who can passport: eligibility and non-EU firms

Passporting is only available to a firm that already holds a CASP authorisation in the Union. It is a right that attaches to an authorised CASP, not a standalone permission a firm can obtain on its own. That has a direct consequence for non-EU companies: there is no shortcut into the EU single market through passporting. A non-EU firm must first become an authorised CASP in a Member State.

You must be an authorised CASP first

Passporting presupposes a valid CASP authorisation under the full MiCA conduct, prudential, governance, custody and AML regime. In other words, the passport is the second step; the first is getting a CASP licence first. The Article 65 notification only switches on the markets covered by the services you are already authorised to provide, so the application work, capital, governance, AML and the rest, has to be done before passporting becomes relevant, per Article 59.

Non-EU firms cannot passport directly

A firm established outside the EU cannot passport into the Union without first obtaining EU CASP authorisation, because Article 59(1) requires the provider to be an authorised legal person or undertaking, per Article 59(1). The practical route for a non-EU group is to authorise an EU-established entity as a CASP and passport from there. The separate question of when a non-EU firm may serve EU clients on a client-initiated basis (reverse solicitation) is governed by a different ESMA regime and is out of scope here.

Choosing your home Member State (and what passporting does not change)

Because passporting flows from your home-state authorisation, the choice of home Member State is the most consequential strategic decision in an EU licensing plan. It sets your lead regulator, your supervisory relationship, your working language and your application timeline, and it does not limit your reach, since one authorisation passports to all 27 states regardless of where it was granted.

Why the home-state choice matters

Your home NCA authorises you, supervises you and forwards your Article 65 notifications. Different Member States vary in regulator workload, language of process and practical timelines, so the home-state decision is about fit and execution speed rather than reach. To weigh the options, choose your home Member State using a side-by-side jurisdiction comparison, and compare licensing costs before committing. The right home state can shorten your path to an authorisation that then travels across the Union.

Passporting covers only your authorised services

Passporting does not broaden the scope of what you may do; it broadens where you may do it. The passport covers only the crypto-asset services your CASP authorisation already includes. If you later want to offer additional services, that is an authorisation change, not a passporting question. Adding more Member States later is done via a further Article 65 notification covering the additional states. And throughout, the full MiCA regime, conduct, prudential, governance, custody and AML, continues to apply: passporting changes your geography, not your obligations. Keep the full MiCA compliance checklist in view as you expand, and read the MiCA regulation overview for the wider framework. Firms whose authorised services include stablecoins should also review the MiCA stablecoin (ART/EMT) rules.

How Crypto Valley Partners helps you passport across the EU

From our practice at Crypto Valley Partners AG in Zug, the firms that passport smoothly are the ones that get two things right early: they select a home Member State whose regulator fits their model and timeline, and they scope their CASP authorisation to cover every service they will eventually want to offer across the EU, so the Article 65 notification later switches on markets, not new services. We map that home-state decision against your business model, prepare the underlying CASP authorisation to the standard the regulation requires, and then handle the Article 65 notification mechanics, the target-state list, the service descriptions, the start date and the non-MiCA activity disclosure, so the forwarding clock starts cleanly.

We work entirely from the MiCA primary text and the supervisory practice of the home and host NCAs, not from marketing shortcuts. Where a claim cannot be sourced, such as the EEA "30-market" extension or any transitional deadline, we tell you it needs verification rather than presenting it as settled. That discipline is what makes a passporting plan hold up under regulatory scrutiny. If you are still deciding between building licences country by country or passporting from a single home state, a short call is usually the fastest way to see which path fits.