Choosing a Home Supervisor: How MiCA’s Passport Changes the Calculus for Non-EU Crypto Businesses

For most firms arriving from outside the European Union, the question of where to seek authorisation under the Markets in Crypto-Assets Regulation is handled as a sourcing exercise. Jurisdictions are compared on fees, expected timetable and the perceived receptiveness of the regulator, and the cheapest credible route wins. That framing holds together only while the licence is treated as a document to be obtained. Understood instead as the opening of a relationship — which is what the EU-wide passport makes it — the arithmetic changes. Because an authorised crypto-asset service provider can serve clients across member states on a single permission, the choice of authorising state stops being a procurement decision and becomes a decision about how the business will be run, staffed and examined for as long as it holds that permission.

The Supervisor Becomes Part of the Business

Authorisation under MiCA is granted by a national competent authority in a chosen member state, and that authority does not step aside once the file is closed; it supervises the firm thereafter. Its reading of the regime shapes what the firm reports and how often, what counts as adequate governance, how much outsourcing is tolerated and how quickly a remediation point must be closed. Supervisory practice, technical capacity and appetite differ meaningfully between authorities, and those differences are felt in ordinary weeks rather than only in a crisis.

This is where the search for the lightest touch tends to misfire. An authority with thin resources may be easier at the gate and considerably less predictable afterwards, because judgements arrive late, unevenly and with little published practice to anchor them. A more demanding authority asks harder questions up front — on the fitness and propriety of management, on capital, on custody and safeguarding, on the credibility of the business plan — but its expectations tend to be legible, and its sign-off carries more weight with banks, counterparties and authorities elsewhere in the bloc. Firms rarely price that asymmetry.

The application pack is worth seeing for what it becomes. The governance description, the outsourcing arrangements, the ICT documentation and the AML and counter-terrorist-financing framework submitted to win the licence are not a one-off submission; they are the operating model the supervisor will hold the firm to. A structure assembled to satisfy an assessor, rather than one the firm intends to run, creates a permanent gap between paperwork and business — and that gap is what supervision is designed to find.

Operational Fit Is Not a Detail

The second trade-off is prosaic and routinely underweighted: day-to-day compliance is denominated in the local language and practice of the authorising state. Correspondence, filings, board documentation and often audit conventions follow the home jurisdiction. So do expectations about who sits on the board, who is genuinely accountable and where decisions are actually taken. Regulators across the bloc expect real substance in the authorising member state rather than a letterbox entity, which means the choice quietly commits the firm to hiring there, to finding qualified compliance staff and non-executives who understand the regime, and to locating enough decision-making there to withstand scrutiny.

DORA sharpens the point. Operational-resilience obligations across EU financial entities bring ICT third-party risk management and the maintenance of a register of information on ICT arrangements into the supervisory conversation, and each authority will form its own view of what good looks like in those areas. A firm whose technology function sits far from its supervisor will spend considerable effort translating one into the language of the other. Those who work on these applications repeatedly tend to frame the decision in these terms rather than as a race: FINHOLD ADVISORY, an EU regulatory and compliance advisory firm, works with businesses on the practicalities of MiCA authorisation, including cases where a licence was pursued in one member state while the firm’s operating capability had already been built somewhere else. Unwinding that mismatch after the fact is slower and more expensive than choosing differently at the outset.

The Host-State Reality

The passport removes the need for separate authorisations; it does not make a firm invisible outside its home state. Business is conducted in markets whose own authorities hold views on consumer protection, marketing conduct and local-language communication, and they notice a firm whose commercial centre of gravity sits in their territory while its supervisor sits elsewhere. Queries then travel a longer path, through a home authority with little familiarity with the market in question, and every exchange carries translation and delay.

Consider, purely as an illustration, a firm that selects its authorising state on expected timetable alone, while its customers, staff and revenue remain concentrated in a different member state. It may well be authorised, and then spend years explaining a structure that was never designed to be supervised. The pressure to make exactly that choice is real: transitional arrangements that allowed firms operating under national regimes to come into compliance have been closing, and the resulting queue makes any door that appears to be moving look attractive.

None of this yields a single correct jurisdiction, which is the point. It yields a better set of board questions: which authority do we want examining our books once the business is at scale, and can we live with how it behaves when something goes wrong? Where is the business genuinely run, and can we staff a credible presence there? Which markets will actually generate our revenue, and how will their authorities view a firm supervised elsewhere? Can we operate — file, correspond, escalate — in the working language of the supervisor we are choosing? A board that answers those honestly may still choose a smaller jurisdiction, but it will be choosing the supervisor it wants to be examined by, rather than the one it believes is easiest to get past. On a licence with no expiry date, that is the more durable basis for a decision.