Marketing under MiCA: Why CASPs Are Underestimating the Risk

The Markets in Crypto-Assets Regulation (MiCA) marked a turning point for crypto in Europe. It transformed a patchwork of national regimes into a harmonised, single framework across Member States. Malta chose to be at the forefront of crypto-regulation. The early adoption of the local Virtual Financial Assets Act in 2018 allowed us to build expertise and achieve a seamless transition to MiCA. In fact, Malta has become the European hub for some of the largest names in the crypto industry.

Crypto-asset activity is borderless by design. Passporting rights under MiCA reflect this reality. A single authorisation in a home jurisdiction unlocks MiCA passporting by enabling access to the entire EU/EEA market. However, certain crypto-asset service provides (CASPs) are underestimating the risks – particularly when marketing to retail clients, running social media campaigns, and engaging influencers, affiliate marketers and brand ambassadors.

MiCA sets baseline marketing requirements. Communications must be fair, clear, and not misleading for investors. However, marketing is inherently local. A single, misaligned message or action could lead to enforcement action in a host Member State. For instance, the Comisión Nacional del Mercado de Valores in Spain has actively enforced local advertising rules for crypto-asset services, issuing sanctions for non-compliant communications

Consumer protection overlays make marketing tricky. Several Member States impose enhanced disclosure or transparency obligations, including detailed risk warnings, specific fee disclosures, and clear pre-contractual information. They may also require CASPs to follow rules on complaint handling and client redress mechanisms – which go beyond MiCA’s harmonised standards.

Rules governing online and social media advertising can also vary widely. Minor missteps – such as a poorly translated risk warning – can trigger regulatory scrutiny. In Germany, the Unfair Competition Act prohibits ‘aggressive’ advertising practices that could mislead or pressure consumers. In Italy and other jurisdictions, marketing content must be provided in the local language to ensure clarity, transparency, and general consumer protection. The Netherlands requires influencers to register with the Dutch Media Authority if certain thresholds are met. France also has strict laws on influencers and unsolicited contact.

Mitigating risks requires proactive, continuous diligence. CASPs should map the regulatory landscape in each target country by covering language requirements, disclosure obligations, and restrictions on marketing techniques. Implementing pre-publication content reviews, multi-language checks, and a formal sign-off process by senior management will prevent inadvertent breaches. Furthermore, clear documentation of these processes provides a critical audit trail in case of regulatory inquiries.

CASPs that manage local requirements and leverage MiCA passporting effectively can build credibility and a strong footprint across Europe.