Can CASPs serve EU clients? Yes, but the answer depends first on where the provider is established, whether it holds the right MiCA authorisation, and how it reaches the client. For crypto businesses, this is not a technical legal distinction. It determines whether an EU growth plan can be marketed openly, supported by payment partners and scaled across the bloc, or whether it rests on a fragile cross-border position.
MiCA has changed the commercial value of a European crypto licence. A properly authorised crypto-asset service provider can access the EU market through passporting. A third-country business that treats European clients as simply another online audience faces a far narrower route, particularly where its activity looks like active solicitation.
Can CASPs serve EU clients under MiCA?
An EU-authorised CASP can generally provide its authorised crypto-asset services across the European Union after completing the required passporting notification process with its home-state regulator. This is one of MiCA’s central commercial advantages: a business does not need to obtain a separate CASP authorisation in every Member State before expanding its services.
The passport is not a blank cheque. It covers the services specified in the authorisation, such as custody and administration of crypto-assets, operation of a trading platform, exchange services, execution of orders, placing, reception and transmission of orders, portfolio management, transfer services, advice, or crypto-asset portfolio management where applicable. A firm must remain within its approved perimeter and meet its ongoing conduct, prudential, governance and operational requirements.
For a founder building an exchange, brokerage, custody proposition or crypto payments business, the practical point is straightforward: European access should be designed around an EU operating company with a defensible licence strategy, rather than added to an offshore business as an afterthought.
What a CASP needs for EU-wide passporting
MiCA authorisation is granted by the national competent authority in an EU Member State. The applicant must be an EU legal person with its registered office in a Member State where it carries out at least part of its crypto-asset services. Its place of effective management must also be within the Union, and MiCA imposes local management expectations, including an EU-resident director requirement.
That substance matters. Regulators, banks, payment institutions and sophisticated counterparties will look beyond a company certificate. They will ask who makes strategic decisions, where risk is controlled, how client assets are safeguarded, whether outsourcing is supervised, and whether the firm has credible anti-money laundering controls.
Once authorised, the CASP submits a notification identifying the Member States in which it intends to operate and the services it plans to provide. The home regulator then transmits the relevant information through the supervisory process. This creates a more efficient path to expansion, but it does not remove local operational considerations. Consumer-facing disclosures, advertising rules, tax registrations, data protection, employment arrangements and payment-rail availability can still differ materially by market.
A Cyprus-based structure can be attractive for businesses seeking an EU base with experienced professional infrastructure and international commercial reach. However, jurisdiction should follow the operating reality, management team, target markets and service model. Selecting a Member State only for speed, while leaving all meaningful activity elsewhere, can create avoidable authorisation and banking pressure.
Third-country CASPs and the reverse-solicitation boundary
A CASP established outside the EU has a more restricted position. MiCA permits third-country firms to provide crypto-asset services to an EU client only where the service is initiated at the client’s own exclusive initiative. This is commonly called reverse solicitation.
It is a narrow exception, not a market-entry strategy. It does not permit a non-EU business to advertise to EU residents, use EU-focused affiliates, sponsor campaigns aimed at European markets, deploy local sales representatives, or otherwise encourage the client to request the service. A website written in local languages, paid search targeted to EU locations, country-specific social media activity or a European referral programme may all undermine the argument that the client acted exclusively on their own initiative.
The exception is also service-specific. If a client independently approaches a third-country provider for one service, that does not automatically allow the provider to cross-sell other services or crypto-assets. Extending the relationship beyond the original client-requested service can move the business outside the exemption.
Commercially, reverse solicitation creates uncertainty. It is difficult to build reliable acquisition forecasts around clients whom you cannot actively target, and difficult to persuade banks, institutional partners and investors that a European revenue stream is sustainable if its legal basis depends on a narrowly interpreted exception. For businesses with genuine EU ambitions, an authorised EU CASP route is usually the safer foundation.
MiCA is not the only regulatory test
A business may call itself a crypto platform, but the legal analysis starts with the actual product. If a token, derivative, structured product, lending arrangement or staking model falls within another financial-services regime, MiCA may not be the controlling framework. MiFID II, payment-services rules, electronic money requirements, consumer-credit restrictions and local financial-promotion laws may need separate analysis.
This is particularly relevant for platforms combining crypto trading with fiat accounts, cards, IBANs, yield products or leveraged exposure. The CASP licence may be necessary, yet insufficient. A payments partner may require a regulated payment institution or electronic money institution within the wider group or contractual structure. An investment product may require a different authorisation entirely.
Anti-money laundering duties are equally central. EU-facing CASPs must establish proportionate customer due diligence, transaction monitoring, sanctions screening, suspicious activity reporting and governance arrangements. The Transfer of Funds Regulation extends travel-rule expectations to crypto-asset transfers, affecting wallet verification, counterparty data collection and the way a platform manages unhosted-wallet risk.
These requirements should be built into onboarding, product design and vendor selection before launch. Retrofitting them after client acquisition is costly, disruptive and can weaken an authorisation application.
The transition period needs careful handling
MiCA became fully applicable to CASPs from 30 December 2024, but certain Member States may allow transitional arrangements for providers already operating lawfully under national rules. Those arrangements can run only until 1 July 2026, or until authorisation is granted or refused, depending on the national framework and the firm’s application status.
This does not mean every existing crypto business can continue serving every EU market without action. Transitional rights are national, conditional and time-limited. They are not the same as an EU passport, and they should not be treated as a substitute for a full MiCA strategy.
Founders should also avoid assuming that an old virtual asset service provider registration automatically converts into a CASP authorisation. MiCA applications demand a more developed operating model, including governance, capital, complaints handling, business continuity, safeguarding arrangements, ICT security, outsourcing controls and clear ownership information.
Building an EU client strategy that can scale
The strongest approach begins with a market and service-perimeter assessment. Identify the clients you want to serve, the jurisdictions from which you will market, the crypto services you will actually provide, and every fiat, payment, custody and technology component supporting the model. That assessment determines whether an EU CASP, a wider regulated group structure, or a carefully limited non-EU model is appropriate.
Next, align the corporate structure with operational substance. The EU entity should have real governance and decision-making capacity, while offshore or non-EU entities should have clearly defined roles in intellectual property, technology, support, treasury or international activities. Intercompany agreements, data flows, outsourcing arrangements and tax treatment must support the commercial story presented to regulators and financial partners.
Finally, treat licensing as the beginning of market access rather than the finish line. Authorisation should sit alongside banking strategy, payment-rail planning, AML operations, marketing controls, tax planning and a route for entering additional markets without rebuilding the group each time.
For ambitious crypto businesses, the question is not merely whether EU clients can be accepted. It is whether the business can serve them openly, safely and profitably when regulators, banks and institutional counterparties examine the model. A well-designed MiCA and corporate strategy gives that growth plan a structure worth building on.