The MiCA passport: home state, host state and notification

The MiCA passport is the mechanism by which a provider already authorised in its home member state provides the notified services in other states of the European Economic Area. It is not a second Spanish licence, not a badge for the brand, and not the transitional window. Which authority grants the home authorisation, and which authority the file names in each country, is in MiCA licence by country. What the authorisation itself is sits in the licence guide. This page is only Article 65 and how it shows up on a row.

Home and host

Regulation (EU) 2023/1114, in the definition of home member state, says that for a crypto-asset service provider that state is the one where the provider has its registered office. The host member state is the one where the provider provides services, when it is different from the home state. The competent authority is the one each state designates under Article 93. In Spain, the CNMV’s MiCA page says the provider must be authorised by the CNMV or by another competent authority in the Union. Both sentences can be true: the CNMV authorises when Spain is home; another authority authorises when home is elsewhere and Spain is host.

So “did the CNMV authorise it?” and “can it serve me in Spain?” are not the same question. The first looks at *ae_homeMemberState* and *ae_competentAuthority*. The second looks at whether the service you will use includes ES in *ac_serviceCode_cou*. A row with home IE and Spain among the countries for that service is an Irish authorisation notified into Spain. On the Spain page that firm is not in the home block.

What has to be notified, Article 65

Article 65(1) says a CASP that intends to provide services in more than one member state submits to its home authority: the list of states, the services it will provide on a cross-border basis, the start date and a list of all other activities not covered by the regulation. Paragraph 2 gives that authority ten working days to communicate the information to the host states’ contact points, to ESMA and to the EBA. Paragraph 3 requires the provider to be informed of that communication without delay. Paragraph 4 allows the provider to start from receipt of that communication or, at the latest, on the fifteenth calendar day after submitting the information.

Those periods are in the regulation. They are not a promise by the CNMV, or by this site, about a particular file. CASPS.csv is the publication of what authorities notify to ESMA. A row can be ahead of, or behind, an email the firm shows you. If they disagree, keep the discrepancy and go back to the home authority. The pass is in the checklist.

What does not passport

The passport covers the notified services, not every product on the website. A derivative, a security, a payment account or the issue of an EMT can sit under another regime even though the company is a CASP. The service letters are in the services guide. A stablecoin the exchange lists is not authorised by the exchange’s passport: the token’s regime is separate, and it is in the EMT and ART guide.

The transitional period does not passport either. The transitional-period guide cites the CNMV’s view: a provider in another state that relies only on its home window cannot, on that fact alone, provide services in Spain. The passport requires the authorisation and the notification. The window is not in the host-country column of the CSV.

Where to read the country

These pages separate, for each state, who has their home authorisation there and who operates under the passport. Pick the registered office of the legal person, not the country of the app.

• Spain
• Germany
• France
• Ireland
• Italy
• Netherlands
• Luxembourg
• Malta
• Cyprus
• Lithuania
• Austria

The counts, without listing every profile, are on register data. A selection of brands with a profile, showing whether Spain is home or host, is on MiCA-licensed alternatives. It is not ESMA’s list.

Common questions