MiCA’s Passporting Showdown Tests Europe’s Unity

The single license meets political reality

MiCA promised a clean bargain: get licensed once in an EU member state, then operate across the bloc via passporting. In mid September that promise ran into politics and supervision. France’s markets watchdog warned it could challenge passports granted by other EU states and urged moving oversight of major crypto firms to ESMA, a move backed by Italy and Austria and opposed by Malta. The warning shot landed on September 15, 2025, when Reuters reported France’s threat to withhold access for firms passporting from jurisdictions it views as too soft, and its campaign to give ESMA direct supervisory power over large players (France threatens to block passporting).

MiCA’s architecture looks simple on paper. National competent authorities approve crypto asset service providers, which then passport. Stablecoin issuers face strict standards on backing assets, redemption at par, and disclosures. ESMA coordinates convergence; the EBA sets expectations for asset referenced and e‑money tokens. In practice, the path from application to cross border business has been uneven. Differences in how member states perform authorization and early supervision have already surfaced, including in ESMA critiques this summer. The mid September volley was the first time a large state openly threatened to put a wall inside the single market to force convergence.

The legal mechanics that make this messy

Passporting is not a courtesy. It is a right that flows from EU law to firms that meet the regulation and are authorized by one member state. Blocking a passport is legally complex. A national authority would need a defensible case that the firm poses risks under MiCA that the home authority failed to address, then navigate litigation and EU infringement risk. That is why French officials framed the option as a last resort. It may be a last resort that works. Even the hint of a veto can chill bank partnerships, delay product rollouts, and force firms to build redundant compliance controls to satisfy a potential host.

MiCA does not give ESMA a sweeping switch to take over day to day supervision of all CASPs. To transfer direct oversight of the largest platforms, lawmakers would likely need a targeted amendment or a follow on MiCA 2 package. The near term compromise lever is softer: ESMA can accelerate peer reviews, issue guidance that narrows discretion, and convene joint supervisory teams for cross border platforms. Expect that middle path to be exercised hard over the next two quarters.

Two paths ahead for Europe

Scenario 1: National pushback hardens

France, joined by a small coalition, exercises de facto vetoes by signaling it will challenge passports from selected jurisdictions.
Home regulators become more conservative, tightening authorization timelines, revisiting prior approvals, and front loading conditions related to governance, IT, cyber, and segregation of client assets.
Firms face uneven onboarding by banks and payment providers in key markets because counterparties fear a future legal fight.
Result: fragmentation risk rises, but the legal system remains a check. Litigation and Commission pressure keep outright bans rare, yet delays and duplicative expectations slow the single market.

Scenario 2: Centralize supervision at ESMA

Member states and EU institutions agree that the largest, most cross border CASPs move under direct ESMA oversight, mirroring the banking union’s single supervisor model for significant banks.
ESMA sets uniform playbooks for authorization, incident reporting, outsourcing, market abuse controls, and change in control reviews. National authorities act as the field force but to a tighter script.
Passporting becomes more automatic for ESMA supervised firms. Smaller, local platforms stay with national supervisors under converged standards.
Result: higher predictability, fewer arbitrage accusations, and a clearer path for global firms. Political resistance will be real, but if markets wobble or a major incident occurs, centralization gains momentum.

Scenario 3: Convergence without centralization

No formal shift of powers, but ESMA accelerates peer reviews and issues detailed Q&As that narrow member state discretion.
Joint supervisory colleges form for large CASPs and major stablecoin issuers. Host regulators participate early and often in authorization conditions.
Targeted fixes emerge, like harmonized requirements for IT penetration testing, third party risk, and wallet segregation.
Result: fewer flashpoints, modest speed gains for passports, and less litigation. The single market promise survives, even if the politics remain noisy.

Near term risks for CASPs

Passport uncertainty in key markets

If a host state telegraphs skepticism about a firm’s home authorization, customer onboarding slows. Expect lengthier due diligence by banks and payment firms and more conditional contracts.

Duplicate oversight in practice

Even without legal change, cross border platforms may see host regulators ask for parallel reporting, on site visits, or attestations tied to cyber, outsourcing, or market abuse surveillance. Build capacity for this now.

Litigation and delays

A challenged passport means months of legal wrangling. Business plans predicated on a Q4 launch in France, Germany, or Italy should include a contingency scenario with 6 to 9 months of slippage.

Incident reporting stress test

Divergent thresholds for what counts as a reportable IT or security incident can put firms in a bind. The prudent approach is to adopt the strictest interpretation across your footprint and pre align with all relevant authorities.

Change in control and group complexity

M&A and strategic investments trigger fresh reviews of fitness and governance. Cross border structures with multiple regulated entities will need crystal clear lines for client asset segregation and wallet governance to avoid authorization re openers.

Market conduct and surveillance uplift

Expect heightened scrutiny of cross venue manipulation, wash trading, and conflicts in market making. Host regulators will push for the ability to pull trade and order data in their preferred format on short notice.

Near term risks for stablecoin issuers

MiCA split the stablecoin regime into two phases. Core rules for issuers of asset referenced tokens and e money tokens began applying in mid 2024. The broader CASP regime kicked in at the end of 2024. That sequencing means the stablecoin perimeter is already under the microscope while CASPs are still bedding in.

Key pressure points:

Authorization hygiene. Issuers with complex group structures need watertight arrangements for backing asset custody, valuation, and daily reconciliation. Anything short of real time monitoring will draw questions in a post September climate.
Par redemption and disclosure. Redemption at par, within strict timeframes, must be supported by operational capacity. Issuers should publish reserve breakdowns with enough granularity that both regulators and counterparties can verify alignment with policy.
Non EU exposure. Offering, listing, or facilitating trading in non MiCA compliant stablecoins brings growing risk. Expect host regulators to query the depth of controls that prevent inadvertent distribution to EU retail users.
Distribution via CASPs. Even compliant issuers can be caught out if their distributors lack consistent controls across borders. Joint attestations, coordinated incident playbooks, and contractual right to audit clauses reduce that exposure.
Secondary market liquidity. If one or more large member states openly challenge a passport or signal a clampdown, spreads can widen and liquidity can migrate offshore. Issuers should plan for intraday volatility buffers and dynamic mint burn throttles to keep pegs tight.

If Europe fragments, who siphons the flow

The UK and the United States have been edging toward closer alignment on crypto market oversight, especially on stablecoins, custody, and market integrity. Four days after France’s warning, the Financial Times reported that London and Washington were preparing to announce enhanced cooperation on digital assets, including steps to align stablecoin frameworks and to enable cross border sandboxes for securities tokenization (UK and US coordination plan). That matters for Europe’s market share. If the EU’s single license looks conditional in practice, global platforms may prefer to anchor activity in London and route US facing flows through the transatlantic corridor, then federate into the EU when compliance is clean.

The UK’s own posture has tilted more pragmatic in 2025. The Financial Conduct Authority has sped up approvals, signaled a tailored rulebook for cryptoasset firms, and coordinated closely with the Bank of England on a two tier stablecoin regime. Add a Whitehall and Treasury emphasis on competitiveness and a White House that has embraced digital asset policy, and the gravitational pull is clear. For context on the US side, see our coverage of the GENIUS Act stablecoin push and the Treasury rulemaking playbook. For market plumbing effects, also see SEC generic ETF standards.

What to do now: a playbook for CASPs and issuers

Build a dual audience dossier. Prepare a consolidated package that anticipates questions from both home and host regulators. Include authorization conditions, governance charts, cyber and incident runbooks, outsourcing registers, wallet key management, and client asset segregation proof.
Map passport risk by market. Score each target country for legal risk, political signaling, and supervisory stance. Sequence market entry accordingly. If France is core to your growth plan, add time and capital buffers.
Pre clear bank partners. Engage transaction banks, payment firms, and market makers early with a standardized compliance binder. Offer host jurisdiction attestations even where not legally required.
Harmonize incident definitions. Adopt the strictest plausible threshold across your footprint and commit to near real time notices to all regulators who might claim an interest. The cost is small compared to the cost of a missed report.
Rehearse redemption stress. For stablecoin issuers, run tabletop exercises for intraday volume shocks, custodian outages, and cross border settlement frictions. Document your governance and remedial triggers in language regulators use.
Tighten data extraction. Be ready to deliver trade, order, and wallet movement data in the taxonomy preferred by key hosts. Build a single switch that can export the right format on 24 hours’ notice.
Prepare for joint supervision. If ESMA convenes a college around your group, designate a single team to handle cross authority interactions and to keep obligations synchronized.
Rebalance product roadmaps. Delay launches most exposed to legal uncertainty. Double down on custody, staking under clear legal bases, and tokenization services that align with securities rules. Keep retail offerings conservative where host risk is high.
Hedge geography. Maintain parallel buildouts in the UK or US where appropriate. If the EU path stretches, you will not be stuck in neutral.

Timeline and watchlist

June 30, 2024: Stablecoin issuer provisions began applying in the EU. Issuers faced new authorization, backing, and redemption standards.
December 30, 2024: Core CASP authorization regime began applying. First wave of national authorizations and early passports flowed in 2025.
July 2025: ESMA publicly identified weaknesses in at least one member state’s authorization process for a CASP and recommended fixes. Convergence efforts intensified over the summer.
September 15 to 17, 2025: France threatened to challenge passporting and, with Italy and Austria, urged direct ESMA supervision of major crypto firms. Malta opposed centralization. The UK and US signaled a plan for closer coordination on digital assets.
Q4 2025: Expect ESMA to accelerate peer reviews, publish detailed Q&As to tighten national discretion, and convene joint colleges for large cross border firms. Also watch UK consultations close and initial transatlantic announcements turn into workstreams.
2026: The EU faces a choice between codifying central oversight for the biggest platforms or pushing convergence without changing the law. Markets will price in whichever outcome looks most credible by midyear.

The bottom line

MiCA was designed to end the game of regulatory musical chairs in Europe. The mid September flare up shows that harmonizing text does not automatically harmonize supervision. France and allies are using the threat of passport vetoes to pull the bloc toward a single supervisory center of gravity. Others, defending national discretion, warn that centralization could sap efficiency and competitiveness. Either way, the next few quarters are the stress test for the single license.

If you run a CASP or issue a stablecoin, plan for a world where you must satisfy your home regulator and the most demanding host at the same time. Overdeliver on cyber, governance, and market conduct. Pre wire banks and counterparties with the evidence they need to stay comfortable if politics heat up. And keep a foot in jurisdictions that are moving in lockstep. A more coordinated UK and US corridor will be ready to catch any flows that leak from a fragmented EU. The firms that thrive will treat this not as regulatory whiplash, but as an operations and trust advantage they can scale across borders.