When passporting is refused: what to do first
When a passporting notification for a MiCA-authorised crypto-asset service provider is refused, the task is narrow at first. Obtain the written refusal. Identify which authority issued it. Log the exact ground stated in that document. Nothing else moves until the ground is confirmed, because the next step depends entirely on whether the refusal came from the home regulator or the host regulator.
Basis
The passporting route for an authorised crypto-asset service provider sits inside Regulation (EU) 2023/1114 (MiCA). It lets a provider authorised in one member state notify regulators in another and begin the same services there, without a separate licence in that second state. A refusal breaks the chain at one of two points: the home authority declines to forward the notification, or the host authority disputes what was forwarded.
Practical consequence
Until the ground is confirmed, the provider cannot lawfully solicit clients in the host state under the passported permission. Transfers tied to crypto-asset services in that state can also stall, because the information required to accompany such transfers under Regulation (EU) 2023/1113 (TFR) assumes an active, unrefused notification. Treating the refusal as a formality and continuing to market regardless is the most common mistake at this stage.
What to do
- Compliance officer requests the refusal in writing within the same week, addressed to the named contact at the issuing authority.
- Compliance officer confirms which authority refused: the home state regulator, or the host state regulator.
- General counsel maps the stated ground against the original notification file, line by line, before touching anything else.
- Do not resubmit before the ground is understood. A second refusal on the same file narrows the later challenge.
- Record the date the refusal was received. The challenge window runs from that date, not from the date of the original notification.
If the notification named a specific cloud region for record-keeping and that region changed after the file was signed, treat it as a separate item — see When cloud region changes after signature, because a mismatch there can sit inside the same refusal without being the same problem.
If the ground concerns the underlying client or transaction dataset, ask who actually built and holds it. Whether The database was built by a supplier ownership of results has been settled is worth closing before the challenge is drafted, not after.
Who decides
| Ground of refusal | Deciding authority | Forum for challenge |
|---|---|---|
| Home authority declined to forward the notification | Home state regulator | Applicable national administrative review procedure of the home state |
| Host authority disputes the notification received | Host state regulator | Applicable national administrative review procedure of the host state |
The forum, and the review deadline within it, are set by the procedure of whichever authority issued the refusal. There is no single EU-wide clock; the clock belongs to the refusing authority.
Forks
If the refusal cites marketing materials contested by a competitor, check first whether the branding itself is under a separate dispute. Whether When a colour or shape is claimed by a rival is already running its own track, that track and the passporting refusal need to be handled by different people on different timelines.
If the refusal turns on custody arrangements, check who actually controls the assets rather than who the notification names. What Custody is held by a platform tokenised rights describes in the client agreement often diverges from what the notification file states, and the gap is usually the real ground for refusal.
If the refusal names a documentation gap with no substantive objection behind it, closing the gap and resubmitting is often faster than a formal challenge — confirm this reading with the issuing authority before choosing either path.
Limit
This page does not assess whether the original application was compliant on its merits, and it does not replace the challenge itself. It does not set the timeframe for the substantive review — the authority named in the table above does. It also does not cover what changes once an authorisation itself is withdrawn rather than a single notification refused.
Verified
Verified: 10 March 2025. Sources: Regulation (EU) 2023/1114 (MiCA); Regulation (EU) 2023/1113 (TFR).
FAQ
What is the first step when passporting is refused?
Obtain the written refusal, identify the issuing authority, and log the exact ground stated. No other step follows until this is done.
Which deadline is already running?
The review deadline is set by the procedure of whichever authority issued the refusal, and it starts from the date the refusal is received, not from the date of the original notification.
Who decides, and on what evidence?
Whichever authority issued the refusal decides, on the notification file, the stated ground, and any correspondence exchanged since. The home regulator and the host regulator do not share one forum.
Related publications
A refusal is one friction point in a longer authorisation lifecycle. See An authorisation is withdrawn authorisation for what changes once a licence itself is pulled, rather than a single notification refused.