An authorisation as a crypto-asset service provider (CASP) under Regulation (EU) 2023/1114 (MiCA) is valid throughout the European Union. That is its main commercial advantage over the national regimes that preceded it. But the passport does not work automatically, and the authorisation brings continuing obligations from the day it is granted. This guide explains the cross-border notification under Article 65 of MiCA and what ongoing compliance involves, with our two add-ons for authorised CASPs: the cross-border services notification and ongoing MiCA compliance support.
The guide is general information, not legal advice. Supervisory decisions belong to the competent authorities.
The passport: Article 65 of MiCA
A CASP that intends to provide crypto-asset services in more than one Member State must notify its home competent authority — for a CASP authorised in Estonia, the Financial Supervision Authority (Finantsinspektsioon) — before it starts. Under Article 65(1) the notification contains:
- the list of Member States in which the CASP intends to provide services;
- the crypto-asset services it intends to provide on a cross-border basis;
- the starting date of those services; and
- a list of all other activities it provides that are not covered by MiCA.
The home authority forwards the information to the competent authorities of the host Member States (and to ESMA) within ten working days. The CASP may begin providing services in the host Member State from the date it receives the home authority's communication, and at the latest from the fifteenth calendar day after it submitted the complete information (Article 65(3)–(5)).
The notification is short, but it must be consistent with the authorisation: a CASP can passport only the services it is authorised for. It is also only the regulatory side. Local consumer, marketing, language and tax rules in each host state still apply, and the CASP's own policies — complaints handling, marketing communications, the Travel Rule — must work for customers in those states.
Ongoing compliance after authorisation
Once authorised, a CASP must meet MiCA's organisational and conduct requirements at all times, not only on the day of the application. The most important are:
- Prudential safeguards at all times at least equal to the higher of the Annex IV minimum capital and one quarter of the previous year's fixed overheads (Article 67).
- Governance — fit and proper management, sound internal control, business continuity and record-keeping (Article 68).
- Complaints handling — a published, effective procedure (Article 71).
- Conflicts of interest policy and disclosure (Article 72).
- Outsourcing controls where functions are outsourced (Article 73).
- for custody: the custody policy and the segregation of clients' crypto-assets (Article 75); for trading platforms, the operating rules (Article 76).
- Operational resilience under Regulation (EU) 2022/2554 (DORA), which applies to authorised CASPs.
- AML/CFT duties and the Travel Rule under Regulation (EU) 2023/1113.
These obligations change as ESMA and the EBA publish technical standards and guidelines. A policy written for the application can be out of date a year later.
What our add-ons include
Cross-border services notification —
A fixed price for preparing the Article 65 notification: the list of Member States and services, a programme-of-operations extract for the host states, and the correspondence with the authority on the notification. Not included: a review of local marketing or consumer law in each host state, and supervisory fees.
Ongoing MiCA compliance support — from
A monthly retainer after authorisation, quoted individually: answers by email to regulatory questions, updates of your policies after changes in the rules, and a compliance calendar for supervisory reporting. It does not make us your compliance officer or a member of your management board — those roles must be filled by your own people, who are assessed by the authority — and it does not include supervisory fees or a statutory audit.
Both add-ons are available with a Class 1, Class 2 or Class 3 authorisation. The state and supervisory fees of the Financial Supervision Authority are never included in our prices.
How to request a quote
Open the quote form on the MiCA licensing page, choose your authorisation class and tick the add-ons. The notification has a fixed price; the compliance support is confirmed in our written quote. No payment is taken on the page, and all communication takes place by email.
Frequently asked questions
How does a MiCA-authorised CASP provide services in other Member States?
It notifies its home authority under Article 65 of MiCA with the list of Member States, the services, the starting date and its other activities. The home authority forwards the information within ten working days; the CASP may start from the date of that communication and at the latest on the fifteenth calendar day after its complete submission.
Does the passport notification cover local rules in the host country?
No. It activates the regulatory passport. Local consumer, marketing, language and tax rules in each host state still apply; a review of them is not part of this service.
What ongoing obligations does a CASP have after authorisation?
Among others: prudential safeguards at all times (Article 67 of MiCA), governance and internal control (Article 68), complaints handling (Article 71), conflicts of interest (Article 72), outsourcing controls (Article 73), custody rules where relevant (Article 75), DORA and the Travel Rule. Our monthly support helps you keep policies and reporting current.
Does the compliance support make you our compliance officer?
No. Your compliance officer and management board must be your own people, assessed by the authority. The support gives them answers, updated policies and a reporting calendar.