The rule: a passport, not 27 separate doors.
MiCA is a single-market regulation. A crypto-asset service provider authorised in one member state can, after notifying the relevant authorities, provide its authorised services across the entire EU — the “passport.” That is the upside. The catch is that the passport only carries the services your licence actually covers, only into states your firm has notified, and only once you hold the authorisation in the first place.
So “where can I still market?” resolves into three concrete tests applied per market:
1. Do I hold a MiCA authorisation? If not, see the deadline and the five-options pages — the prior question is licence, cease, or wind down. 2. Does my licence’s passport reach this member state, for these services? Passporting is per-service and per-state; a custody licence does not authorise exchange marketing. 3. Is there an authorised route into this market at all? Member states differ enormously in how many CASPs they have authorised — which shapes both where home-state licences exist to passport from and how mature the local supervisory picture is.
Only around 17% of pre-MiCA registered entities — roughly 210 of more than 1,200 — had obtained full CASP authorisation by mid-2026, leaving the large majority of formerly-registered firms unlicensed as the deadline arrives. Authorisations are also heavily concentrated: a handful of member states account for most granted CASP licences, while several member states show no public CASP authorisations in the register at all.
For a marketing team, that concentration is the whole story. It decides which home states firms are passporting out of, and it is why “the EU is open” is the wrong mental model. The EU is open to authorised firms, through the states that have authorised them.
The map: how to read it (not a verdict on any country).
The single source of truth is the public ESMA register of authorised CASPs, alongside each national competent authority’s own list. The pattern below is how to read that register for a marketing decision — it is a heuristic for where to look, not a determination that any named state is “non-compliant” or closed. Always confirm the live position before acting.
| Register pattern | What it means for marketing | Status |
|---|---|---|
| States with multiple published CASP authorisations Early movers that built MiCA authorisation pipelines — e.g. several large Western and Northern European markets and established fund/finance hubs. |
Mature home states to be authorised in and passport out of. If your licence is here and notified, marketing into other EU states via passport is the cleanest route. Confirm the per-service scope. | Passport-in routes exist |
| States with few or recent authorisations A small or newly-growing list of authorised CASPs in the register. |
Passport-in may be possible but the local picture is thin; lean on inbound passport from a mature home state rather than seeking a fresh local licence under deadline pressure. | Confirm per-state |
| States with no public CASP authorisations yet Roughly ten member states show no CASP authorisation records in the public register at this stage. |
There is no local home-state licence to point to, and no basis to assume a local authorised route exists. Do not assume the market is “open”; reach it only via a valid passport from a state where you are authorised, and otherwise treat active marketing into it as off. | No public record — verify |
“No public record” means exactly that — an absence in the register at a point in time, which can change week to week as authorisations are granted. It is not a finding that a state has banned crypto or that any firm there is operating unlawfully. The register is the authority; this table is only a lens for reading it.
The cross-border traps.
Three positions create the most marketing exposure the moment the transitional cover ends.
Running pan-EU paid campaigns, EU-wide influencer deals, and a single EU signup flow on the assumption that one home licence covers everything everywhere.
The passport is per-service and per-notified-state. Marketing that reaches a member state your passport does not cover — or a service your licence does not authorise — is solicitation outside the perimeter. Citation: MiCA passporting provisions; Art. 88.
A non-EU or unlicensed firm relying on “reverse solicitation” while still running EU-language ads, EU geo-targeting, and EU influencer content.
The Article 61 exemption is narrow and is destroyed by active marketing into the EU. It covers a service genuinely initiated by the client on their own exclusive initiative — not a campaign dressed up as inbound demand. Citation: MiCA Art. 61; ESMA guidance on reverse solicitation.
Geo-blocking a market with a banner promising you’ll “be back soon” when no re-entry is actually planned, while leaving acquisition funnels quietly live.
A misleading return claim is its own communication problem, and a half-closed funnel still solicits. If you withdraw, withdraw the marketing surface fully and describe the position honestly. Citation: Art. 88 (clear, fair, not misleading).
The marketing playbook, market by market.
NorthPoint does not file authorisations or opine on your licence — that sits with counsel and your national competent authority. What we own is the live marketing surface as the map changes. These steps run per market.
For each EU state you currently market into, record three facts: do you hold an authorisation whose passport reaches it; does that passport cover the specific services you advertise there; and what does the live ESMA register show for that state. The grid, not a gut feel, decides what stays on.
Leave acquisition live in the states your licence passports into, for the services it covers. Make sure each asset reflects only those authorised services and that member-state scope — the licence sets the marketing footprint, not the other way round.
Where there is no passport and no authorised route, turn off geo-targeted ads, EU-language pages aimed at that market, KOL contracts, and new-client signups from it. Do not lean on reverse solicitation to keep a campaign alive — active marketing is exactly what voids it.
Block signups from withdrawn jurisdictions at onboarding, not merely by hiding a landing page. A hidden page with a working funnel underneath still solicits. Document the geo-block so the position is defensible.
If you withdraw from a market, say so plainly — no misleading “temporary” or “returning soon” claims unless a return is genuinely planned. For existing clients, run the orderly wind-down: notice, withdrawals, close-outs. Every message still has to clear the Article 88 bar.
Related rules.
-
What changes on the day for an unlicensed CASP, and what the marketing surface should do about it.
-
The firm-level decision page: licence, cease, orderly wind-down, transfer clients, or merge — and the reverse-solicitation trap in detail.
-
The asset-level companion: which stablecoins remain marketable to EU users, and which are shut out.
-
The “clear, fair, and not misleading” rule every cross-border communication must still clear.
-
MiCA, FCA, SEC, GDPR — the marketing rules, quoted and explained.
This page is an operator-grade heuristic for marketing and communications teams, not legal advice and not a determination of any firm’s or any member state’s authorisation status. The passporting, reverse-solicitation, and marketing-communication points are plain-English renderings of MiCA; the “no public record” pattern reflects the public ESMA register at a point in time and changes as authorisations are granted. For your firm’s position, confirm against the live ESMA register and consult qualified counsel and the national competent authority in each client member state.