A crypto payment platform may finally secure a MiCA crypto-asset service provider license, or CASP, and the next question usually comes fast: can it now open France, Germany, Spain, and the rest of the EU right away?
According to a MarsBit article by Shao Jiadian, that reading is understandable from a commercial standpoint. One of MiCA’s central aims is to create a single EU market for crypto-asset services, so firms do not have to apply again and again for the same custody, exchange, or transfer activity in each member state. But the article says the practical answer is narrower. A CASP can passport across borders, yet that does not mean every product in the company or group can move with it. Passporting carries approved service permissions. It does not hand a corporate group a universal European financial license.
What MiCA passporting actually fixes
Before MiCA, one of the biggest problems in Europe’s crypto market was regulatory fragmentation. A project might hold a VASP registration in one country, but still have to reassess local entry rules before going into another member state. National approaches to custody, exchange, wallets, and trading platforms were not fully aligned in name, standard, or market-access method.
MiCA changes that structure. Under the regulation, once a CASP is formally authorized in its home member state, it may extend already approved crypto-asset services into other EU member states either through a branch or on a freedom-of-services basis. In principle, a CASP offering services cross-border is not required to set up a separate entity in every target country.
That allows a firm to build one CASP entity as the core of its European business, instead of repeating the same crypto licensing architecture in France, Germany, Italy, and Spain.
Getting the license does not mean the whole EU opens the next day
The article stresses that passporting is not an automatic hidden feature that switches on the moment a CASP authorization is granted. If a company wants to enter other member states, it must first submit information to its home-state competent authority. That filing includes the target member states, which crypto-asset services it plans to provide cross-border, the expected start date, and any non-MiCA business the CASP also carries on.
Once the home authority receives complete information, it should pass the relevant material within 10 working days to the host member states, the European Securities and Markets Authority, or ESMA, and the European Banking Authority, or EBA. The CASP may begin providing cross-border services once it receives confirmation that the notification has been completed by the home authority. If that confirmation has not arrived, the article says the CASP may start no later than the 15th calendar day after submitting the relevant information.
The process is not especially complicated. Even so, it signals that passporting has to be built into an EU launch plan rather than treated as paperwork to patch in after the license is already secured.
Passporting carries existing permissions, not new ones
The article gives a simple example. If a CASP is authorized for only two activities, custody and administration of crypto-assets on behalf of clients, and transfer services for crypto-assets on behalf of clients, then those are still the only services it may provide after passporting into France, Germany, or Spain.
A cross-border notification does not automatically add crypto-to-fiat exchange, operation of a trading platform, execution of orders, or investment advice. MiCA requires the authorization to specify the concrete crypto-asset services a firm is allowed to provide. If the company wants to add another CASP service later, it must apply to its original home-state authority for an extension of authorization.
The article says that planning point matters early. Firms should not ask only what license is needed in the first phase. They also need to ask what products they intend to add over the next two or three years. If a project plans to add custody, stablecoin exchange, and institutional trading next year, but applies for its first CASP on a very narrow basis now, it will still have to go back through an authorization extension process later.
In short, passporting reproduces the edge of the license. It does not break through that edge.
For crypto payments, the harder part often sits outside CASP authorization
The article argues this issue matters even more than passporting itself for payment-focused crypto businesses. Many products look like a single user experience on the surface, but in regulatory terms they may involve two or even three separate business lines.
One example in the article is a customer paying a platform in stablecoins, the platform completing custody and asset transfer, then converting the assets into euros and settling the merchant. Some of those digital-asset activities may fit within CASP authorization. Fiat accounts, traditional payment execution, bank cards, merchant acquiring, or electronic money issuance do not become covered just because the CASP has been passported.
The article pays particular attention to EMTs, or electronic money tokens. EBA has already discussed the connection between MiCA and PSD2. For services that transfer EMTs on behalf of clients, and for some custodial wallet services that allow clients to send and receive EMTs to and from third parties, the business may also fall within payment-services regulation. After relevant transitional arrangements end on March 2, 2026, certain activities may need to address PSD2 authorization issues as well. By contrast, exchange between crypto-assets and funds, and exchange between different crypto-assets, does not automatically become a PSD2 payment service simply because an EMT is involved.
A CASP license can therefore be used cross-border, but it does not automatically become a PI license, an EMI license, a banking license, or a license covering securities, derivatives, and other financial services.
One CASP in the group does not put the whole app under MiCA
The article says this is especially common in large exchanges and global crypto groups. A company may establish one licensed CASP in the EU, while the wider group app or website also contains derivatives, lending, NFTs, some DeFi products, and other services provided by offshore affiliates.
From a user’s point of view, all of those offerings may sit under the same brand and inside the same app. That creates a very practical question: when a page says “MiCA regulated,” is it referring to one EU CASP entity, or to every product offered across the group?
The article notes that ESMA issued a dedicated warning in 2025 about this “halo effect.” Regulators are concerned that users may wrongly assume every product offered by a firm is protected by MiCA just because the firm has CASP status. ESMA therefore requires CASPs to explain clearly, during client interactions and sales processes, the regulatory status of different products so customers are not misled.
The article says the impact goes well beyond adding a disclaimer. If the boundaries are not clear, wider passporting coverage may expand the risk at the same time.
An EU CASP cannot simply serve as a funnel into offshore business
Another idea often raised is whether an EU CASP can first acquire customers and then direct them to an offshore platform in the same group for products the CASP itself cannot offer.
The article says that approach requires caution. MiCA takes a strict view of the reverse solicitation exception for third-country firms, where the service is requested at the exclusive initiative of the client. The core logic of ESMA’s guidance, as described in the article, is that a third-country firm cannot use marketing, promotion, or other active steps to work around MiCA market-access requirements.
That means if an EU CASP actively channels European customers to an offshore affiliated entity that does not hold the necessary EU authorization, and that offshore entity then provides regulated crypto services to those customers, the group cannot simply say the customer clicked through on their own and therefore requested the service independently.
For group structure, the article says a safer design is not to treat the EU CASP as a customer-acquisition gateway. It is to separate the product map first: which European clients are served by the CASP, which products the CASP may provide, which products should not yet be offered to EU clients, and whether offshore group companies only provide technology and back-end support or are in fact dealing with customers directly.
MiCA, in that reading, is not concerned only with where the license sits. It also looks at who is actually serving the customer.
Host countries still matter after passporting
With MiCA passporting, a CASP does not need to obtain the same crypto license again in every target member state. But the article says that does not mean a project can launch in France, Germany, or Italy by copying one Europe-wide webpage and calling the job finished.
MiCA itself requires CASPs to provide information to clients that is fair, clear, and not misleading, including in marketing communications. Beyond that, a specific product may still trigger local issues involving consumer protection, data protection, tax, contracts, complaints handling, and other areas that MiCA does not completely harmonize.
For products targeting retail users, local language, customer support, risk disclosure, and user agreements still need attention as well.
So the real saving from passporting is duplicate licensing. It is not local implementation work as a whole.
Plan the European structure before the first application
In the closing section, the author says projects intending to serve several EU member states should design their broader European business when applying for the first CASP, rather than waiting for the license to arrive and only then discussing entry into France or Germany.
The article says a project should answer at least six questions in advance, though the six questions themselves are not listed in the provided text. Its final point is direct: MiCA passporting solves duplicate authorization. A CASP can use home-state authorization and cross-border notification to extend already approved crypto-asset services into other member states.
But the service scope does not expand because of passporting. PI, EMI, banking, and securities licenses are not automatically replaced by a CASP, and offshore group business does not acquire MiCA status just because an EU entity in the group holds a license.
The article’s closing line sums up the argument this way: one CASP can cover the whole EU, but only for the things it was already allowed to do.