Articles

11 November 2026

Checklist for a non-EU group entering the French crypto market

Auteur

William O’Rorke

Since 1 July 2026, serving clients in France has required an authorisation under Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA), granted in France or in another Member State. A group established outside the European Union cannot obtain one from abroad: it needs an authorised entity in a Member State, or it keeps to the narrow reverse solicitation exemption. Seven decisions follow in a set order, and each calls for a document that proves it.

Take a fictitious group established in the United States. It runs a trading platform, holds clients’ crypto-assets and offers perpetual futures. It has never run a campaign aimed at France, but its website exists in French and several thousand of its users give a French address. We follow this group through each step.

STEP 1

Measure

Record what already links you to France and suspend what creates exposure.

STEP 2

Qualify

Match each service to MiCA, or to another regime.

STEP 3

Choose the route

French subsidiary, subsidiary elsewhere in the EU with a passport, or reverse solicitation alone.

STEP 4

Build the entity

Substance, management, shareholders, own funds, outsourcing.

STEP 5

Handle existing clients

Decide what happens to French clients while the AMF reviews the file.

STEP 6

Apply French rules

Consumer law, language, marketing, AML/CFT, asset freezes, tax reporting.

STEP 7

Deal with the AMF

Home or host authority: reporting, changes, inspections.

Measure your French exposure

The first question is factual. MiCA reserves crypto-asset services provided in the Union to authorised entities (Article 59 of MiCA). A third-country firm escapes that rule only where a client in the Union approached it on the client’s own exclusive initiative, and any solicitation of clients in the Union, whatever the means, ends that exemption (Article 61). Record what already links you to France:

the number of clients resident in France, and whether they are retail or professional clients;
the language of the website, the app, the terms and conditions and customer support;
campaigns, sponsorship, influencers and referral programmes visible from France;
the app’s presence on French app stores, euro payment methods and local partners or introducers.

Then suspend whatever creates that exposure until an authorisation is in place. Since 1 July 2026, the French Consumer Code has prohibited sponsorship and patronage that promote crypto-asset services, and electronic advertising that invites a person to make contact through a form with a view to such a service, unless the advertiser is authorised under Article 59 of MiCA (Articles L. 222-16-1 and L. 222-16-2). The president of the AMF (Autorité des marchés financiers, the French financial markets regulator) can serve formal notice on an unauthorised operator, require hosting providers to prevent access to its website and ask the president of the Paris judicial court to order access providers to block it (Article L. 621-13-5 of the French Monetary and Financial Code, CMF).

In our example

The French version of the website and the referral programme open to French users are enough, on ESMA’s reading, to rule out reverse solicitation. The group suspends both while it chooses its route.

Proof to keep: a dated map of French exposure, approved by management, and a record of what was suspended.

Qualify each service

MiCA lists ten crypto-asset services (Article 3(1)(16)): custody and administration on behalf of clients, operation of a trading platform, exchange for funds, exchange for other crypto-assets, execution of orders, placing, reception and transmission of orders, advice, portfolio management and transfer services. Authorisation is granted service by service, and the AMF reviews the file the same way.

Some activities fall outside MiCA, which does not apply to financial instruments (Article 2(4)). Derivatives on crypto-assets, such as CFDs and, in most cases, perpetual futures, are financial instruments under MiFID II and call for another status. Payment services and e-money tokens bring in the payment services rules and the ACPR (Autorité de contrôle prudentiel et de résolution, the French banking supervisor).

In our example

The platform and custody fall under MiCA. The perpetual futures do not: the group either stops offering them to French clients or seeks the investment firm status they require.

Proof to keep: a qualification memo, service by service, with the legal basis retained for each.

Choose your route

MiCA has no regime for branches of third-country firms. Authorisation goes to a legal person with its registered office in a Member State where it carries out at least part of its services, its place of effective management in the Union and at least one director resident in the Union (Article 59(2)). The routes open to a foreign provider serving France therefore narrow to three for a group established outside the Union:

a subsidiary authorised by the AMF in France, which serves France directly and the rest of the Union by passport;
a subsidiary authorised in another Member State, which then passports into France: the home authority forwards the notification to the AMF, ESMA and the EBA within 10 working days, and the provider may start from receipt of that communication, or at the latest from the 15th calendar day after filing (Article 65; see MiCA passporting into France);
reverse solicitation alone, without authorisation: ESMA reads the exemption narrowly in its guidelines of 17 December 2024, and the client’s initiative does not allow the firm to market new types of crypto-assets or services to that client (Article 61(2); see the limits of reverse solicitation).

Why France

The choice of Member State turns on four criteria: the language of work with the regulator, where your team will sit, the markets you target and the review time. France meets them with four concrete advantages:

the AMF has supervised crypto-asset providers since the French PSAN regime of 2019 (a registration for digital asset service providers that applied before MiCA) and processes applications in English as well as in French;
the French industry is organised, and its trade bodies, including ADAN (Association pour le développement des actifs numériques), hold a sustained dialogue with the AMF and the ACPR;
ESMA has its seat in Paris, and the EBA has had its seat there since 2019;
a subsidiary authorised in Paris serves the rest of the Union by passport.

In our experience, a CASP authorisation for custody or order execution takes six to nine months on average. In return, the AMF expects real substance in France.

In our example

The group chooses a French subsidiary, because its European sales team will be based in Paris.

Proof to keep: a board decision on the route, with its reasons.

Build an entity the AMF can authorise

The AMF reviews the entity, not the group. It expects a minimum of substance and independence in France: directors and control functions based in France, staff and resources in proportion to the services, and a programme of operations that the entity actually runs. ESMA set out the same line in its supervisory briefing of 31 January 2025, which warns national authorities against letter-box entities that rely on group companies outside the Union for the substance of their services. The application then documents four sets of points:

the registered office in France, the place of effective management in the Union and at least one director resident in the Union (Article 59(2));
managers of good repute with the knowledge and experience to run the business, and the identity of shareholders with qualifying holdings (Articles 62 and 68);
own funds: MiCA sets a minimum permanent capital by class of service (Article 67 and Annex IV), and in practice the business plan shows several hundred thousand euros at least, covering the needs of the first three years;
policies and procedures, including conflicts of interest, complaints, custody, AML/CFT (anti-money laundering and countering the financing of terrorism) and business continuity.

Outsourcing to the group remains possible, in particular for technology and commercial functions. Article 73 of MiCA sets the conditions: outsourcing must not delegate the entity’s responsibility or alter its relationship with clients and its conditions of authorisation, the entity keeps the expertise to supervise what it outsources, and a written agreement gives it the right to terminate. Where the group supplies ICT services, Regulation (EU) 2022/2554 (DORA) also applies, since CASPs are financial entities under it. Depending on the file and on the strategy set at the outset, an exchange with the AMF before filing is possible.

In our example

The group places a managing director, a compliance officer and an AML officer in Paris. The trading engine and part of the marketing stay with the group, under outsourcing agreements that the French entity supervises.

Proof to keep: the application for authorisation: programme of operations, governance, policies, outsourcing agreements and business plan.

Decide what happens to French clients during the review

Filing an application authorises nothing. Until the AMF grants authorisation, the group may serve French clients only within the reverse solicitation exemption, without any advertising aimed at France. Clients brought in by the French website or the referral programme fall outside that exemption.

Existing accounts call for a specific analysis: which clients came on their own initiative, which services they use, and how to stop new onboarding from France without cutting holders off from their assets. We review these accounts with the group before any decision is taken.

In our example

The group stops onboarding French residents on its global platform and commissions an analysis of the existing accounts.

Proof to keep: the onboarding freeze, a register of client-initiated requests and the analysis of existing accounts.

Apply the French rules that survive authorisation

MiCA harmonises authorisation and conduct of business. Several national rules still apply to any provider serving French clients, whether it is authorised in France or passports in from another Member State:

consumer law, including the rules on distance contracts for financial services and on unfair terms, and the act of 4 August 1994 on the use of the French language, which requires French in documents intended for consumers;
marketing rules: the bans on sponsorship and on certain electronic advertising already cited, the rules on démarchage (unsolicited financial solicitation under French law) set by the CMF and the act of 9 June 2023 on influencers (see crypto marketing rules in France);
AML/CFT: a provider established in France, including through a branch, applies French rules under the supervision of the ACPR and reports to Tracfin (the French financial intelligence unit), while a provider serving France cross-border applies the rules of its home State; French asset-freeze measures apply in both cases, and the travel rule of Regulation (EU) 2023/1113 applies to every transfer;
tax reporting: Directive (EU) 2023/2226 (DAC8) has required providers within its scope to collect client data since 1 January 2026, for a first exchange of information in 2027.

A passporting provider should open an early dialogue with the ACPR and Tracfin on how suspicious transaction reports concerning French residents will reach Tracfin.

In our example

The French subsidiary applies French AML/CFT rules from its first day and issues its terms, risk warnings and complaints process in French.

Proof to keep: a map of the French rules that apply, with an owner for each.

Organise your relationship with the AMF

Once authorised, the French subsidiary has the AMF as its home authority, and the ACPR for AML/CFT. Supervision is continuous: periodic reporting, notification of changes in management or shareholding, inspections. Where the group passports from another Member State instead, the AMF acts as host authority. It may question the provider and, if the home authority does not act on irregularities it has reported, take measures to protect French clients, up to preventing further activity in France (Article 102).

Name a single contact for the AMF from the outset and keep a record of every exchange.

Proof to keep: a regulatory relations procedure and a reporting calendar.

The checklist in one table

Step	Decision	Proof to keep
1. Measure	Which French clients, languages, campaigns and partners do you have?	Dated map of French exposure, approved by management
1. Measure	What do you suspend until authorisation?	Record of suspended campaigns, referral offers and French-language pages
2. Qualify	Which MiCA service matches each activity?	Qualification memo, service by service
2. Qualify	Which activities fall outside MiCA (derivatives, payments)?	Decision to stop them in France or to seek the matching status
3. Route	French subsidiary, EU subsidiary with passport, or reverse solicitation?	Board decision on the route, with its reasons
4. Entity	Where are the registered office, the effective management and the resident director?	Articles of association, management appointments, organisation chart
4. Entity	Who holds qualifying holdings, and who manages?	Shareholder and management files for the application
4. Entity	What own funds, for how long?	Business plan and own funds calculation over three years
4. Entity	What does the group provide, and on what terms?	Outsourcing agreements and outsourcing policy, ICT register under DORA
5. Clients	What happens to French accounts during the review?	Onboarding freeze, register of client-initiated requests, analysis of existing accounts
6. French rules	Are terms, warnings and complaints handled in French?	French-language consumer documents
6. French rules	Which AML/CFT and asset-freeze rules apply?	AML/CFT procedures, Tracfin contact, asset-freeze screening
6. French rules	Which tax reporting applies?	DAC8 data collection process
7. AMF	Who speaks to the AMF, and how are exchanges tracked?	Regulatory relations procedure and reporting calendar

Entering the French market from outside the EU?

We advise third-country groups from the first map of their French exposure to authorisation by the AMF, then on the French rules that apply once they operate. We have advised several third-country providers on this route. We work in English, with your usual counsel and with independent partners in your home country.

Or talk to a partner.

Serving the French crypto market from abroad

Frequently asked questions about entering the French crypto market

Can a company established outside the EU apply directly for a MiCA authorisation?

No. MiCA grants authorisation to a legal person with its registered office in a Member State where it carries out at least part of its services, its place of effective management in the Union and at least one director resident in the Union (Article 59(2)). A third-country group therefore sets up a subsidiary in a Member State and applies through it.

Can a third-country firm open a branch in France under MiCA?

No. MiCA has no regime for branches of third-country firms. Branches exist only for providers already authorised in a Member State, which may serve other Member States through a branch or on a cross-border basis (Article 59(7)).

Which Member State should a non-EU group choose for its MiCA authorisation?

The choice turns on the language of work with the regulator, where the team will sit, the target markets and the review time. France offers a regulator that has supervised crypto-asset providers since 2019 and works in English, an organised industry in regular dialogue with the regulators, and the seats of ESMA and the EBA in Paris.

How long does a CASP authorisation take in France?

In our experience, six to nine months on average for custody or order execution. The time depends on the quality of the file, on the answers to the AMF’s questions and on the substance the entity shows in France.

Can we keep serving French clients while our application is pending?

Only within the reverse solicitation exemption of Article 61 of MiCA, which ESMA reads narrowly, and without any advertising aimed at France. The fate of existing accounts calls for a specific analysis before any decision.

Do French rules still apply if we passport into France from another Member State?

Yes. Consumer law, the French language act of 4 August 1994, the rules on sponsorship, electronic advertising and influencers, French asset-freeze measures and tax reporting under DAC8 apply to providers serving French clients. AML/CFT rules depend on whether you serve France cross-border or through an establishment.

Can we deal with the AMF in English?

Yes. The AMF processes applications and holds meetings in English. Documents intended for French consumers must be in French.

What happens if we serve French clients without authorisation?

The president of the AMF (Autorité des marchés financiers, the French financial markets regulator) can serve formal notice on the operator, require hosting providers to prevent access to its website and ask the president of the Paris judicial court to order access providers to block it (Article L. 621-13-5 of the French Monetary and Financial Code). The AMF also lists unauthorised websites publicly.

We also advise providers listed by the AMF on getting off the AMF blacklist and groups preparing a CASP authorisation application to the AMF.