Where a Crypto License Lets a Business Operate
Image Source: Created with AI
A crypto license gives a business permission to perform particular activities within a defined legal framework. Its reach depends on which company holds it, which services it covers, and where those services are offered. Those details explain why a single brand can serve different markets through different companies, and why access to a crypto app does not, by itself, establish which regulatory permissions apply.
The European Union’s Markets in Crypto-Assets Regulation, known as MiCA, provides a shared framework for crypto-asset service providers. The CLARITY Act remains a proposal after failing to advance in the Senate in September 2026. Troutman Pepper Locke’s analysis distinguishes that procedural setback from the continuing regulation of crypto businesses under existing law. A proposed market structure does not itself supply an operating permission.
The existing EU regime and proposed US structure form the basis of a side-by-side of the Clarity Act and MiCA. Their designs can be compared without treating them as equivalent permissions. For a business, geographic reach begins with the entity providing the service and the activities covered by its authorization. The territory where that permission can be used follows from those details, rather than from the global accessibility of the underlying technology.
What an EU authorization covers
MiCA authorization attaches to a legal entity: the company holding the permission. It also covers specified services. AGPLAW’s explanation of the authorization framework describes how these limits apply together. The company’s identity establishes who holds the authorization, while the service scope identifies the activities it covers. A business’s presence on a register therefore needs to be understood alongside the services it is authorized or notified to provide.
Custody and administration concern crypto-assets held for clients. Exchange services cover two categories: exchanging crypto-assets for funds or for other crypto-assets. Operating a crypto-asset trading platform is another separately identified activity. Each description concerns work the provider performs, even when several services appear within the same product. Authorization has to cover the activity being offered. Calling a company a crypto platform leaves those distinctions unresolved; its permitted service list identifies the functions covered.
How passporting extends cross-border reach
Passporting extends authorized services across the European Economic Area: EU countries plus Iceland, Liechtenstein, and Norway. It operates through the applicable cross-border notifications, connecting the home authorization with the markets where the covered services will be provided. This route does not add activities outside the original permission or establish authorization in unrelated markets, including the United States. An online product’s technical accessibility can therefore be wider than its provider’s authorized reach.
Image Source: Created with AI
An earlier national registration does not, by itself, establish that cross-border permission. MiCA’s broader service-provider regime has applied since December 2024.
July 1, 2026 was the final possible deadline for qualifying providers continuing under earlier national arrangements. Some jurisdictions shortened that transition. A pending application did not itself preserve permission to continue after that date. Authorization, or entitlement through an applicable specific notification route, remained necessary for regulated services.
The US comparison concerns a proposed framework
CLARITY proposes a federal division of oversight. The Commodity Futures Trading Commission (CFTC) would oversee digital commodity intermediaries, while the Securities and Exchange Commission would retain securities oversight. Proposed registration categories would cover digital commodity exchanges, brokers, and dealers. Those categories describe a system Congress could establish, rather than permissions that businesses can already obtain under the bill.
Troutman identifies a distinction behind the proposed registration system. The CFTC’s powers over spot markets, where digital commodities themselves are bought and sold, include enforcement against fraud and manipulation. Those powers do not create a general licensing program for those spot exchanges, brokers, and dealers. CLARITY would supply that statutory structure. Its absence does not erase existing federal powers or state requirements applying to crypto businesses.
Agency action continues within existing statutory authority. It can address particular activities without creating the comprehensive spot-market registration program described in CLARITY. Geographic operating scope in the US consequently remains connected to the existing combination of federal powers and state requirements. EU passporting and the proposed US registration system describe different routes, with different present legal effects.
A shared brand can contain different service providers
The identity of the company delivering a service remains relevant within a corporate group. An authorization held by one member does not automatically extend to every company using the same brand, website, or infrastructure. Shared technology describes an operational connection between businesses; it does not merge their legal identities or enlarge the activities covered by a particular authorization.
The contractual provider connects the customer-facing product with the permission being relied on. Customer documentation identifies that company, while custody arrangements establish who holds client assets and controls access to them. Order-routing and execution arrangements identify who performs the trading functions. These details connect the legal entity with the work delivered through the product, including when several companies share infrastructure.
Custody and other regulated functions need to remain consistent with that arrangement. Technical support from another company does not, by itself, describe who provides the regulated service. An outsourcing arrangement or group structure cannot simply transfer an authorization’s scope to an otherwise unauthorized company performing regulated custody.
The boundary of a crypto service can run through a corporate group as well as across a map. Connecting the named provider with its activities and the territory covered by its permission explains how an international product is supplied. Its authorized reach follows that service relationship, even when the brand has a much wider presence.
