Key takeaways
- The EU is moving against the arrangement that lets a firm authorised in one member state serve all 27 under MiCA.
- Passporting is not an oversight in the regulation — it is the single biggest thing MiCA was designed to deliver.
- The real issue is supervisory mismatch: authorisation passports across the union, but day-to-day supervision stays with the home regulator.
- That creates an incentive to seek authorisation wherever the process is fastest or most accommodating, which is forum shopping rather than fraud.
- For a user it decides something concrete: which country's regulator actually handles your complaint, and how well resourced it is.
European policymakers are moving against what is being described as a MiCA loophole: the arrangement under which a crypto firm authorised in one member state can serve customers in all twenty-seven.
Calling it a loophole is slightly misleading, and the distinction matters. Passporting is not something that slipped through. It is the central thing the regulation was built to do.
Passporting was the whole point
Before MiCA, operating across Europe meant assembling national permissions one country at a time, each with its own process and interpretation. For a firm of any size that was a serious barrier, and it fragmented the market.
MiCA replaced it with a single authorisation that carries across the union. Authorise once, serve everywhere. That is the same mechanism European financial regulation has used for decades in banking, funds and payments, and the industry welcomed it for exactly that reason.
So the thing now being targeted is the regulation working as designed. What has changed is the appetite for one of its consequences.
The actual problem is who supervises
Here is the asymmetry at the heart of it, and it is worth being precise.
Authorisation passports across the union. Ongoing supervision does not. The regulator that authorised a firm remains its principal supervisor, even once that firm serves tens of millions of people in other member states.
A national regulator in a small member state can therefore end up as the effective supervisor of a platform whose customer base dwarfs its own population — with the staff, budget and expertise of a small authority rather than a union-wide one. Nothing improper has to happen for that to be a mismatch.
And because firms choose where to apply, there is an incentive to pick whichever competent authority is fastest, most familiar with the sector, or most accommodating in its interpretation. That is forum shopping. It is legal, it is rational, and it happens in every regime with passporting.
Europe has had this argument before
None of this is new, which is the most useful context available.
The same pattern produced the banking union after 2012, when supervision of significant banks was moved from national authorities to the European Central Bank precisely because national supervisors had proved unable to oversee institutions far larger than their domestic economies. Investment funds domiciled in a handful of small member states and sold across the whole union raised the identical question. So did payment institutions.
The resolution has consistently been the same direction of travel: centralise supervision of the largest firms while leaving smaller ones national. The proposals now circulating for ESMA to supervise significant crypto firms directly follow that template exactly.
What it would change in practice
For large platforms, a different and better-resourced supervisor, probably with more consistent interpretation across borders, and almost certainly higher compliance cost. Whether that is good depends on what you weigh.
For smaller firms, likely not much directly, though a two-tier regime tends to widen the gap between the two tiers over time.
For the market overall, more consolidation. This is the second time in a week the same mechanism has appeared here: authorisation is expensive, and raising its cost reduces the number of firms that can carry it. Fewer, larger, more heavily supervised venues is the predictable result, and reasonable people disagree about whether that trade is worth making.
The part that affects you directly
Strip out the policy argument and one practical question remains, which almost nobody can answer about their own platform.
Which country authorised it, and therefore which regulator supervises it. That determines who handles a complaint you cannot resolve, which language and procedure that runs in, what compensation or redress arrangements apply, and how quickly anybody would act if the firm got into difficulty.
Under passporting, a platform marketed to you in your own language, with local payment methods and a domestic feel, may be supervised somewhere you have never dealt with. That is not hidden — authorisation details are published, usually in the footer and in the regulator's own register — and it is rarely read.
Knowing the answer costs five minutes and is the difference between having recourse and discovering where it lives at the worst possible moment.
Education, not investment advice.
Frequently asked questions
What is passporting under MiCA?
A firm authorised as a crypto-asset service provider in one EU member state can serve customers across all twenty-seven without separate national authorisations. It mirrors how European banking, funds and payments regulation has worked for decades.
Is it really a loophole?
Not in the sense of an oversight. Passporting is the single biggest thing MiCA was designed to deliver, and the industry welcomed it. What is being questioned is one of its consequences, not an accident in the drafting.
So what is the actual problem?
Supervisory mismatch. Authorisation passports across the union but ongoing supervision stays with the home regulator. A small member state's authority can end up as principal supervisor of a platform serving tens of millions elsewhere, with the resources of a small authority.
What is forum shopping?
Choosing to apply in whichever member state has the fastest, most familiar or most accommodating authorisation process, then passporting from there. It is legal and rational, and it occurs in every regime that allows passporting.
Has the EU solved this before?
Repeatedly, in the same direction. Supervision of significant banks moved to the European Central Bank after 2012 for exactly this reason. Funds and payment institutions raised the same question. The pattern is to centralise supervision of the largest firms and leave smaller ones national.
What should I actually check about my platform?
Which country authorised it, and therefore which regulator supervises it. That determines who handles an unresolved complaint, in what language and procedure, what redress applies, and how fast anyone would act if the firm struggled. It is published, usually in the site footer and the regulator's register.
Sources
Every figure and quote above traces to one of these. Checked on publication day.
- cryptoslate.com — EU targets MiCA loophole that lets crypto exchanges serve 27 countries with one license
- coingape.com — Europe's Crypto Rulebook Has a New Boss: Who is Carlo Comporti?
- coingape.com — CRCL Stock Outlook as FSB Warns G20 Policymakers of Cross-Border Stablecoin Risks
- cryptoslate.com — Thailand wants a piece of the $120 billion Bitcoin and Ethereum ETF market, but on its own terms
- coindesk.com — Standard Chartered offers RLUSD custody in Dubai and plans LMAX collateral link
Deepmoni Das, Editor
I read the primary filings, exchange notices and post-mortems behind each story and write up what they actually say — with every source linked so you can check me. I am not a trader and I do not hold positions in anything covered here. Research and drafting are AI-assisted; the sourcing, the edits and the mistakes are mine.
Not financial advice. Crypto assets are volatile and unregulated in many jurisdictions. In India, gains are taxed at 30% with 1% TDS on transfers. Do your own research and never invest money you cannot afford to lose.
Editorial note: Crypto Shakti uses an AI-assisted research and drafting workflow. Every article is grounded in the linked primary sources and live market data captured at publication time.