When cross-border services are added: what to do first
Adding a cross-border service to an already authorised digital-asset business triggers a notification duty before the first client in the new Member State is onboarded. The home competent authority reviews the notification and forwards it to the host state. Until that forwarding step is confirmed, the added service should not go live abroad, and any transfer element inside it carries its own information duties.
The legal basis
The passporting mechanism for an authorised crypto-asset service provider sits in Regulation (EU) 2023/1114 (MiCA). It lets a provider authorised in one Member State extend activity into others through notification rather than a fresh authorisation, provided the added service falls within the scope already granted.
Where the added service moves funds or crypto-assets across a border — a payout, a settlement leg, a transfer between wallets held with different providers — the information duties of Regulation (EU) 2023/1113 (TFR) apply to that transfer in parallel. The two regimes are read together rather than as alternatives.
What changes in practice
Three things shift the moment cross-border reach is added. First, the clock: a notification file has to exist and be filed before onboarding starts in the new market, not after. Second, the record: the authorisation register entry has to reflect the wider scope once the home authority confirms it. Third, the transfer chain: if the new market involves a different settlement path, the accompanying-information duty under the transfer regulation has to be checked for that path specifically, not assumed from the domestic setup.
A shift in the client channel across borders sometimes coincides with a change on the technology side. Where onboarding in the new market runs through an application with automated scoring or matching, the underlying data flow may change as well, and that question is covered separately: An AI feature changes the data flow data protection. Treat the two questions as related but distinct — one is about supervisory scope, the other about the data itself.
What to do first
- List every Member State the added service will reach, by client residence or by where the service is marketed — compliance officer.
- Confirm the current authorisation already covers this service type; a wider market is not a wider service category — legal or compliance lead.
- Prepare and file the notification with the home competent authority, describing the service and the target states — authorised representative.
- Hold the launch in the new state until the home authority confirms the notification has been forwarded — do not proceed on a filing receipt alone.
- Check whether any transfer inside the added service crosses into the accompanying-information duty under the transfer regulation, and update the transfer messaging accordingly — compliance officer.
- Update the public register entry and client-facing disclosures once the forwarding is confirmed — compliance officer.
Who decides, and how
The home competent authority decides on the basis of the notification file: the service description, the target states, and the scope of the existing authorisation. It does not re-open the original authorisation decision unless the file reveals a mismatch between what was granted and what is now proposed. The host state does not run its own authorisation process under this mechanism; it receives the forwarded notification and may seek clarification through the home authority.
| Authority | Role in the process | What it reviews |
|---|---|---|
| Home competent authority | Reviews the notification, decides whether to forward it | Notification file, existing authorisation scope, service description |
| Host competent authority | Receives the forwarded notification, may request clarification | Forwarded file, local market specifics of the service |
| Provider | Files the notification, holds launch until forwarding is confirmed | Own service description, target-state list, transfer chain |
If your situation differs
If the added service is genuinely new — a service type not covered by the current authorisation, rather than the same service reaching a new market — the notification route does not apply. A variation of the existing authorisation has to be sought first, and the cross-border notification follows once that variation is granted.
If the added service carries a royalty stream encoded on-chain that pays out across the new market, check that stream separately before launch: Royalties encoded on-chain are ignored tokenised rights. A notification that is otherwise complete does not fix a royalty mechanism that stops working once it crosses a border.
If the new market needs a local brand and the mark under which the service will trade has sat unused for a period of years, resolve that question before the launch date, not after: When the mark has not been used for years.
If the technology behind the added service was built under an arrangement that was carried out but never formally signed, settle the ownership question first: The assignment is unsigned but performed ownership of results. A notification filed on top of an unclear ownership chain does not make the chain any clearer.
What this page does not cover
This page does not set out the notification form, the specific information fields the home authority requires, or the length of the forwarding period — those sit inside the regulation itself and inside the home authority's own procedure, and they change with practice. It also does not cover authorisation from scratch, own funds thresholds, or a supervisory finding that the existing authorisation was exceeded. Each of those is a different starting point with a different first step.
Verified
Reviewed as of 3 February 2025. Primary sources: Regulation (EU) 2023/1114 (MiCA); Regulation (EU) 2023/1113 (TFR).
Frequently asked questions
What is the first step when cross-border services are added?
Map every Member State the service will reach, then confirm the existing authorisation already covers that service type. Only after that check does the notification to the home competent authority make sense as the next step.
Which deadline is already running?
The clock starts once the notification is filed with the home authority. From that point, launch in the new state has to wait for confirmation that the home authority has forwarded the file — the provider does not set that timing itself.
Who decides, and on what evidence?
The home competent authority decides, based on the notification file, the target-state list, and the scope of the authorisation already held. The host authority acts on the forwarded file rather than running a separate decision of its own.
Related publications
A parallel situation inside the same authorisation, with its own trigger and its own first step, is covered here: When own funds fall below the threshold.
Before you file
Get the notification file right before it leaves your organisation. A mismatch between the stated scope and the granted authorisation is easier to fix on a draft than after the home authority has already forwarded it.