MiFID II has an equivalence mechanism that allows non-EU firms to serve professional clients in the EU if their home country’s regime is deemed equivalent by the European Commission. MiCA has no equivalent provision. There is no third-country equivalence route, no recognition regime, and no grandfather period for firms that were operating in the EU before MiCA came into force.

This is a deliberate policy choice by the EU. The result is that every company — regardless of where it is incorporated or what licence it holds — needs a MiCA authorisation to actively provide crypto-asset services to EU retail clients. Your VARA licence, your Mauritius FSC VASP licence, your MAS exemption: none of these provide any form of EU market access under MiCA. They are jurisdictionally irrelevant for the purpose of EU retail access.

MiCA’s scope is determined by where you provide services — not where you are incorporated. If you are actively marketing crypto-asset services to EU residents, onboarding EU retail clients, or providing ongoing services to EU retail users, you are providing crypto-asset services within the EU under MiCA. The fact that your servers are in Singapore and your company is registered in the Seychelles is irrelevant to the question of regulatory scope.

The extraterritorial reach of MiCA is similar to GDPR in this respect. EU national competent authorities (NCAs) are already pursuing enforcement actions against non-EU platforms with EU user bases. The risk is not theoretical — it is operational and it is escalating. If you have EU retail clients and you are not on a path to MiCA authorisation, you need to make a decision about your EU strategy now, not when an NCA sends you a letter.

Count your EU users by member state. Calculate EU revenue as a percentage of total revenue. Identify every EU institutional client relationship. Map which services you are actively marketing to EU residents versus which are genuinely client-initiated.

This assessment tells you exactly what you are dealing with. If retail EU users are above zero and you are marketing to them, you cannot avoid MiCA — the only question is how quickly you get authorised and what interim measures you take in the meantime. If your EU exposure is genuinely zero or limited to institutional clients, your position is different and your options are broader. Do not skip this step — it drives every other decision.

Blocking EU IP addresses and removing EU residents from your onboarding flow stops the accumulation of new EU retail clients while you complete your CASP application. This is a legitimate interim measure — it demonstrates to NCAs that you identified the issue and took steps to stop the breach while pursuing authorisation.

The geo-block must be genuinely implemented — not cosmetic. NCAs and enforcement teams regularly test geo-blocking implementations. A geo-block that can be circumvented with a VPN and no friction will not be considered effective. Implement it properly: IP-level block, KYC residency check at onboarding, and documented enforcement logs. Document the implementation date and the decision to apply for authorisation — this creates a timeline that regulators can review.

If you are relying on the reverse solicitation exception (Article 61) for any existing EU client relationships, document every EU client relationship individually to confirm — with evidence — that no active solicitation occurred. This is an audit-ready position, not a policy statement in your terms and conditions.

For each EU institutional client: document the origin of the relationship, the first contact, any marketing materials they received, and their professional client classification. If any client received a marketing communication from you before initiating contact themselves, the reverse solicitation defence does not apply to that relationship. Clean up your EU client base before regulators examine it — not during an enforcement investigation.