MSTR Cat

Crypto Law/Level III · Tokens and securities law/3.3 Europe and beyond/Lesson 7

Licences, passporting and the reverse-solicitation trap

Why crypto licences follow customers rather than company addresses, how the EU passport works, and why ‘the customer came to us’ rarely protects a firm that advertises.

Education, not legal, tax or investment advice. Crypto law differs between countries and states and changes often. Check the current rules where you live with a qualified lawyer or tax adviser before you act.

The lean path

The cheapest, lowest-tax, simplest and most private route the law allows, best first. Each step names the rule it rests on and the condition that keeps it lawful.

  1. Cheapest lawful position for an unlicensed firm: refuse new accounts and geo-block jurisdictions where it holds no licence, including EU IP addresses and app stores; disclaimers alone do not satisfy MiCA Article 61, and records of who initiated each relationship must be kept.
  2. Reverse solicitation covers only services an EU client initiates on its own exclusive initiative; ads, sponsorships, affiliates, retargeting, paid influencers and country-targeted search optimisation forfeit it, and new crypto-asset types may not be marketed to that client.
  3. One MiCA authorisation passports across the EU under Article 59(7): notify the home authority and start within 15 calendar days at the latest (Article 65), far cheaper than national licences; the passport covers only the named legal entity and authorised services.
  4. Choose a home authority for thoroughness, not speed; ESMA’s July 2025 peer review of Malta shows weak authorisations draw later scrutiny. Outside the EU, licences follow customers, so the UK, Hong Kong and UAE each need separate permission.

MaterialsMiCA Articles 59, 61 and 65 on EUR-LexESMA’s Final Report on Guidelines on reverse solicitation under MiCA (17 December 2024), especially the Annex of examplesESMA’s Statement on the End of Transitional Periods under MiCA (17 April 2026)Your own product’s marketing channels, sign-up flow and list of countries served

Wonder

  1. If a customer finds my platform on their own, do I need a licence in their country?
  2. Does a licence in one EU country let a firm serve the whole EU?
  3. Is a geo-block or a disclaimer in the terms of service enough?

Explore

  1. Crypto licensing is mostly triggered by where customers are and where services are directed, not where the company is registered. Lessons 3.3.4 to 3.3.6 show the pattern: the UK promotions regime applies to overseas firms marketing to UK consumers; Hong Kong requires a licence for platforms actively marketing to Hong Kong investors; the UAE Central Bank’s regulation covers services within the UAE or directed to persons there. A passport is the exception that lets one licence travel. Under MiCA Article 59(7), an authorised crypto-asset service provider may serve clients across the EU, through a branch or cross-border, without a physical presence in each member state.
  2. The passport has limits. Under Article 65, the firm notifies its home authority of the member states and services it plans to cover; the authority forwards this within 10 working days, and the firm may begin once told, or at the latest on the 15th calendar day after notifying. It covers only the services in the authorisation and only the authorised legal entity. ESMA’s statement of 17 April 2026 warned that MiCA protections do not extend to other group companies sharing a brand, or to non-EU entities. A passport is also only as strong as the home authority’s review, which is why ESMA checks how national authorities grant licences.
  3. ESMA’s fast-track peer review of Malta’s Financial Services Authority, published on 10 July 2025, concerned the authorisation of one crypto-asset service provider. The peer review committee found that the overall authorisation process should have been more thorough and that the entity’s supervisory history was not adequately considered. It urged all national authorities to scrutinise business growth, conflicts of interest, group arrangements and IT systems before granting a licence. For builders, the lesson is that choosing a home state with a reputation for speed can mean later scrutiny. Regulators in other countries can also coordinate on an application, as the reported joint tracking of Binance’s 2026 Greek application showed.
  4. Reverse solicitation is the narrow exception for firms outside the EU. Under MiCA Article 61, no authorisation is needed when an EU client initiates a service at its own exclusive initiative. But if the firm, or anyone acting on its behalf or closely linked to it, solicits EU clients by any means, the exemption is lost, regardless of any contract clause or disclaimer saying otherwise. Even a genuine client approach does not let the firm market new types of crypto-assets or services to that client. ESMA’s guidelines say the exemption must be construed narrowly and that contractual arrangements or disclaimers cannot override contrary facts.
  5. ESMA’s guidelines, final report dated 17 December 2024, read solicitation broadly and in a technology-neutral way: online ads, social media, banners and pop-ups, sponsorship deals, affiliate campaigns, retargeting, events and even general brand advertising can count. Paying an influencer, in money or benefits, strongly indicates that the influencer acts for the firm. Timing matters: if a client asks to buy token X, the firm may offer same-type assets in that transaction, but not market more trades a month later. The annex flags country-specific search engine optimisation as solicitation. Firms that want to stay out can refuse new EU accounts or geo-block access, for example by blocking EU IP addresses and app-store availability.
  6. The cost of getting this wrong is real. ESMA stated that after 1 July 2026 non-EU firms may serve EU clients only within the narrow reverse-solicitation exception. On 17 June 2026 Dubai’s VARA recorded cease-and-desist orders and penalties against Peken Global Limited (KuCoin) and MX Holdings Ltd (MEXC) for unlicensed activity in Dubai. Singapore shows the mirror image: since 30 June 2025 it requires a licence even for Singapore firms serving only foreign customers. A practical check: list every country where you have users, every marketing channel aimed at them, and whether onboarding actually blocks the places where you hold no licence; keep records showing who initiated each relationship.

Key facts

  • Under MiCA Article 59(7), an authorised crypto-asset service provider may serve clients throughout the EU without a physical presence in each host member state.
  • Under MiCA Article 65(4), a passporting provider may begin cross-border services at the latest on the 15th calendar day after notifying its home authority.
  • MiCA Article 61 exempts a non-EU firm only when an EU client acts on its own exclusive initiative, and any solicitation defeats the exemption regardless of contractual disclaimers.
  • ESMA’s reverse-solicitation guidelines treat sponsorship deals, affiliate campaigns, retargeting and paid influencers as possible solicitation.
  • ESMA’s July 2025 peer review of Malta’s MFSA concluded that one crypto-asset service provider’s authorisation process should have been more thorough.
  • On 17 June 2026 VARA recorded cease-and-desist orders and financial penalties against KuCoin and MEXC entities for unlicensed virtual asset activity in Dubai.

Exercise nine, six, three, one

9CollectList up to 9 ways a crypto product you know reaches users in other countries, such as ads, influencers, sponsorships, local-language pages, app-store listings or referral links.
6ClusterSort them into 6 categories: paid advertising, influencer or affiliate promotion, sponsorships and events, localised websites and search optimisation, purely educational content, and genuinely user-initiated contact.
3DistillReduce the 6 categories to 3 groups: clearly solicitation, possibly solicitation depending on facts, and unlikely to be solicitation.
1CrystallizeWrite 1 sentence explaining why a terms-of-service clause saying ‘all customers approach us on their own initiative’ does not by itself satisfy MiCA’s reverse-solicitation exemption.

Fact check

Dates, figures and claims checked against the published sources listed below.

Open in the interactive academy →

PT ES ZH JA KO RU DE FR MS