Coredo

I have been leading COREDO since 2016, and from the early years I saw how international business in fintech faces not “barriers” but labyrinths. Company registration, obtaining financial licenses, AML/sanctions compliance, building processes across different jurisdictions — these are not a set of disparate tasks but a single architecture of risk management. The COREDO team builds this architecture in the EU, the United Kingdom, Singapore and Dubai, truly integrating legal, financial and technological solutions. Below I share how to think about MiCA, DeFi and compliance today so as not to “keep up with” regulation, but to get ahead of it and monetize predictability.

MiCA: regulation of crypto-assets in the EU

Who is responsible in DeFi under MiCA?

Requirements for stablecoin issuers

AML/KYC in DeFi – compliance with FATF/MiCA

How to implement KYC in a DEX without compromising UX

Smart contract risks and compliance

Consequences of MiCA for blockchain startups

COREDO launch plan under MiCA

• Jurisdictional strategy. Define the entry point into the EU considering the type of services (CASP), capital requirements and operational base. Take into account access to talent, regulatory practice and authorization timelines with the national regulator.
• Licensing and passporting. We assemble the licensing package, describe controls, and plan passporting to the second wave of EU countries. We embed MiCA technical reporting standards and procedures for interaction with ESMA/EBA.
• AML/sanctions and the travel rule. We design RBA, CDD, beneficial ownership, SAR and sanctions processes. We set up KYC for on‑ramp and off‑ramp; travel rule: technical and legal implementation, rejection policies.
• Technology and security. SDLC, audits and formal verification, upgrade policy, oracle SLA, MEV controls, custody architecture (multisig/TSS/MPC). We set up incident reporting and a response playbook.
• Transparency and disclosure. Whitepaper obligations under MiCA, best practices for risk disclosure (impermanent loss, oracle/MEV, liquidity), proof-of-reserves and methodology limitations.
• Governance and DAO. Legal wrapper for the DAO (foundation or corporate), allocation of responsibilities, on‑chain/off‑chain governance rules, front‑end liability and agreements with providers.
• Operational resilience. SLA, continuity plan, redundancy, third‑party and cloud risks, stress-scenario testing, incident reporting and interaction with law enforcement.
• Listing and scaling. Preparation for listings/integrations, compliance KPIs, passporting, inter-regulatory communications and a migration plan for MiCA updates.

Case studies: practice becomes the standard

Compliance: tools and automation

Frequently asked questions and answers

• CEX vs DEX: regulatory distinction. Centralized exchanges have the full range of CASP obligations, including custody. For DEXs, attention is on the interface, centralized components, AML on on-/off-ramps and the responsibility of DAOs/developers when there is de facto control.
• Who bears responsibility in permissionless protocols? Where there is control or influence (front-end, admin keys, oracles, treasury), the regulator sees those responsible. A legal wrapper for the DAO and distribution of functions reduce risks and improve manageability.
• How to apply the travel rule in decentralized applications? Through partner VASPs for fiat and centralized bridges, attribute exchange, refusing transfers when data is absent, and logic on the front-end/contracts.
• Proof‑of‑reserves: limitations. Without accounting for liabilities and affiliated risks, PoR is misleading. A combined methodology and regular independent audits are needed.
• MEV and frontrunning: how to reduce regulatory risk? Implement anti-frontrunning mechanisms, disclose risks, monitor abuses, document response policies and incident reporting.

Compliance as a scaling strategy

I founded COREDO in 2016, and since then I have seen every day how entrepreneurs lose momentum because of regulatory uncertainty. This is especially noticeable in projects with virtual assets: licensing, AML, bank accounts, infrastructure — too many things are moving at once. In this article I have compiled the practices our team has tested in the EU, the UK, Estonia, the Czech Republic, Cyprus, Singapore and Dubai, and I also examined in detail the topic “Crypto licensing in Bulgaria” with a focus on VASP registration in Bulgaria, AML requirements and the impact of MiCA. This is not a forward-looking overview, but practical steps, metrics and solutions that help teams launch on time, keep compliance risks under control and achieve a predictable ROI.

Bulgaria: an entry point for VASP

Bulgaria attracts with the simplicity of company incorporation, a modest corporate tax and flexible approaches to registering virtual asset service providers. crypto company registration in Bulgaria proceeds without excessive barriers: the corporate structure is set up quickly, and VASP registration relies on the EU anti‑money‑laundering requirements (AMLD5/AMLD6) and national rules. For a startup this means a shorter regulatory lead time and a manageable time‑to‑market.

AMLD5/AMLD6 and MiCA: the role of registers

Today Bulgaria applies a VASP registration model (exchange services and custodial wallets) in state registers and under AML supervision. The FIU (Financial Intelligence Unit) functions are performed by the Directorate of Financial Intelligence, and VASP accounting is conducted in accordance with national norms and the requirements of AMLD5/AMLD6. Licensing of virtual assets in Bulgaria is often used as a market term, but legally it is a registration regime with compliance, reporting and inspection obligations.

MiCA and Bulgaria

MiCA introduces a pan-European authorization for CASP (Crypto‑Asset Service Providers) and uniform standards: capital, governance, client protection, as well as passporting. The impact of MiCA on VASP licensing in Bulgaria is twofold: on one hand, the existing VASP registration serves as a “temporary berth” for launching; on the other, it creates a basis for future CASP authorization with minimal process refactoring. Our experience at COREDO has shown that the “migration” from a registration regime to MiCA authorization proceeds smoothly if you account in advance for the minimum capital requirements, governance and information security (IS).

EU passporting for VASP

MiCA opens full EU passporting for CASP: having obtained permission in one EU country, you can offer services across the Union. Before MiCA, companies have to rely on equivalence, local registrations or “mutual recognition” frameworks, which complicates cross‑border compliance. The solution developed at COREDO envisions choosing Bulgaria as the “base” state with a subsequent expansion plan via MiCA passporting once the rules are fully in force.

EU anti-money laundering legislation and the FIU

VASP in Bulgaria are obliged entities. They perform KYC/KYB, CDD and EDD, implement transaction monitoring and submit SARs (suspicious activity reports) to the FIU. Regulations for crypto exchangers in Bulgaria require an internal AML policy, risk assessment procedures, appointment of an MLRO (Money Laundering Reporting Officer) and staff training. The regulatory landscape also includes FATF requirements, including the Travel Rule for VASP‑to‑VASP and transactions to non-custodial wallets (VASP‑to‑OB) through additional checks.

VASP business models — compliance with regulations

Each model — exchange, brokerage, custodial service, OTC, payment gateways — carries its own risks and a set of prudential measures. I often ask founders to start with a risk appetite statement and a process map: without this it is difficult to align the AML framework, technical architecture and capital requirements.

Prudential capital requirements

Capital requirements for VASPs in Bulgaria are currently modest at the registration stage, but MiCA introduces threshold capital requirements and minimum reserves by type of service. Minimum registration capital requirements for VASPs in Bulgaria depend on the corporate form, while the future MiCA authorization foresees fixed levels (benchmarks of 50–150 thousand EUR by service type). I recommend building in a buffer: regulators value a conservative approach to capital and liquidity.

Corporate structure and governance

Legal structure, holding, subsidiaries, branches: determine the tax burden and the manageability of risks. Corporate governance and directors’ responsibilities require real control: regular meetings, a risk committee, minutes, independent audits. The COREDO team has implemented corporate frameworks where the duties of the MLRO, CTO and the risk director do not critically overlap, and backup authorities ensure business continuity (BCP/DR).

Tax optimization and transfer pricing

Taxation of crypto companies in Bulgaria is based on the general corporate tax (10%) and local VAT rules. Crypto–fiat exchange operations in the EU are often exempt from VAT, but the details depend on the specific service and the contract with the client. In transfer pricing, transparency and documentation are mandatory, especially for cross-border services within a group.

Company registration prior to VASP

The COREDO team regularly runs “end‑to‑end” projects where we take on the full cycle: from company formation to the “go‑live” launch of operations, including bank accounts, AML policy and technology implementation.

Company registration in Bulgaria

Opening a company in Bulgaria for a crypto project typically takes 5–10 business days after the package is prepared. Beneficial owners and directors are entered into the register, UBO (Beneficial ownership disclosure) is disclosed, and compliance officers are appointed. requirements for beneficiaries and the ownership structure for VASP in Bulgaria include transparent source of funds and clear control.

VASP in Bulgaria: documents and AML

Realistic timelines and cost

license processing times for VASP in Bulgaria (registration) depend on the completeness of the package and the readiness of the AML architecture. In our practice: 4–8 weeks for VASP registration after incorporation and agreement on the AML package. The cost of VASP licensing in Bulgaria consists of legal services, AML/IB consulting, notary and state fees, and the technology stack; TCO for the first year varies depending on the model (exchange vs custody) and the level of automation.

How to reduce the risk of rejection

The risks of license refusal for VASP in Bulgaria are most often associated with:

• a weak MLRO track record and lack of relevant cases;
• incomplete disclosure of UBO and source of funds;
• formal AML procedures without real control points;
• inadequate IT security.

Compliance architecture AML/KYC

Compliance procedures for small VASP require balance: excess control harms the customer experience, lack of it increases SARs and regulatory inquiries. I build a “layered” architecture: from risk policy to technology and KPIs.

Reporting to the FIU and AML requirements

AML requirements for VASP in Bulgaria include:

• Risk Assessment and Risk Appetite with annual updates;
• CDD/EDD scenarios and periodic KYC refresh;
• transaction monitoring in real time and rule engines;
• SARs, procedures for filing suspicious reports to the FIU;
• Reporting requirements for VASP in Bulgaria on training, incidents and internal audits.

KYC/KYB: sanctions and GDPR

KYC for crypto companies in Bulgaria is built on multi-level verification: document, biometrics, liveness, geo-risks. Best KYC practices for Bulgarian VASP include PEP screening and sanctions lists (OFAC/UN, EU), plus additional rules for legal entities (KYB). GDPR and personal data protection for VASP are a separate priority: data residency and storage of KYC data, data subject rights, DPIA for high-risk processes.

Blockchain transaction analytics

MLRO: independent review and audit

Requirements for the MLRO (qualifications, independence, access to the board of directors) set the tone for the entire function. Requirements for internal audit and independent review of compliance – an annual cycle, coverage of key processes, sample testing and a report to the board of directors. AML training and staff upskilling form the overall culture and reduce operational mistakes.

Compliance team KPIs

Custody, keys, access

The technology stack affects risks as much as the legal form. I rely on the principles of “security by design” and certification.

Custody key management

Custody models: custodial vs non-custodial define different depths of control. Requirements for cold and hot wallet management under Bulgarian regulations are described at a high level, so we cover them with best practices: HSM, MPC, threshold signatures and multi‑sig. Key management (custody) procedures for VASP Bulgaria include role separation, on-call shifts, segmentation and change control.

Information security and continuity

ISO 27001, SOC 2 and cybersecurity standards create a foundation of trust. Access control, IAM and least privilege principles reduce insider risks; audit trail and logging requirements help incident response and audits. Operational resilience and business continuity (BCP/DR) are a mandatory part of risk passports.

Integrations and liquidity

Integration with exchanges and liquidity pools requires API integration and security standards, as well as counterparty assessment. Technology stacks for VASP – from KYC/AML to Wallet and Custody – we select taking into account the target revenue model and TCO so as not to “overheat” CAPEX at launch.

Bank accounts and payment partners

Bank account for a crypto company in Bulgaria: a common question among founders. I always say: accounts are opened not by presentations, but by your compliance and case study.

Agreements with banks and EMIs

Agreements with banks and payment providers in the EU require clear limits, described VASP‑to‑OB scenarios, completion of Due Diligence and demonstration of a control environment. Interaction with banks and payment partners for VASPs in Bulgaria is built on a transparent risk assessment and clear SLAs for monitoring. When a bank is conservative, we add EMI solutions with SEPA and fast onboarding.

Data management

Entering EU markets

How to scale a VASP after obtaining a license in Bulgaria? I recommend a two‑track strategy: compliance maturity and commercial expansion.

How to bring the product to market

Market‑entry and go‑to‑market procedures for VASPs depend on the segment: retail, B2B, institutional. Revenue models, fee‑for‑service, spread, custody fees, dictate UX, SLAs and even compliance metrics. The COREDO solution: launching pilot segments with a controlled budget and measurable LTV/CAC to avoid “burning” capital at an early stage.

Cross-border license compatibility

Cross‑border compliance and a multi‑jurisdictional strategy involve matching local rules with the future MiCA passporting. Compatibility of a Bulgarian license with licenses of other EU countries becomes linear after MiCA: passporting replaces the cascade of local registrations. Until then we choose “core” markets and providers to avoid duplicating costs.

What regulatory sandboxes are

Regulatory sandboxes and pilot regimes in the EU can give an edge on time‑to‑market. In Bulgaria the focus is on careful pilots with banks and EMIs, where the compliance architecture is already in place and easily auditable.

TCO, unit economics and project ROI

The decision to obtain a license is about economics. I ask teams to record TCO and unit economics from day one.

TCO and compliance costs

Compliance costs and the TCO (Total Cost of Ownership) assessment include: legal support for the VASP in Bulgaria, AML/IB platforms, audits, training, independent checks, policy updates and insurance. Add overhead for regulatory lead time and capital reserves.

Unit economics: CAC/LTV and revenue models

Unit economics of the license: CAC and LTV for the VASP show the model’s resilience. For a spread model liquidity and turnover are important; for custody, AUC (assets under custody) and fees. Real-time transaction monitoring and rule engines are not only about risk but also about conversion: a low false-positive rate strengthens the UX.

ROI, NPV and payback

How to assess the ROI from licensing a VASP in Bulgaria? Compare NPV taking into account TCO, expected customer base growth and the timing for MiCA passporting. ROI metrics — payback period and NPV — become more predictable with a stable regulatory lead time and clear agreements with banks.

COREDO Case Studies: What Worked

I believe in the power of case studies: they are better than any declarations.

Small EU VASP: launch and risk control

Asian fintechs entering the EU via Bulgaria

Custodial platform: technical security

Founders’ Frequently Asked Questions

I’ve collected the questions I hear most often and the answers that work for us.

What documents are needed at the start?

Beneficiaries, personnel and partners

How to choose a legal partner

Relationship with banks and reputation

VASP registration in the EU via Bulgaria

If your clients are in the EU, Bulgaria provides a quick start, straightforward VASP registration and preparation for MiCA. The compatibility of Bulgaria’s license with the licenses of other EU countries will strengthen as MiCA and passporting are fully implemented. This reduces fragmentation and the costs of duplicating compliance.

VASP business model for Bulgaria

COREDO’s Position and Conclusions

I lead projects where speed is as important as reliability. Bulgaria gives entrepreneurs the chance to open a company quickly, complete VASP registration and simultaneously prepare for MiCA realities: EU passporting, common standards and predictable requirements. The COREDO team has implemented dozens of such routes, and I see consistent patterns: a strong MLRO, a mature AML architecture, technological discipline (HSM/MPC, IAM, ISO 27001/SOC 2), a transparent economic model (TCO, CAC/LTV, NPV) and a calibrated plan “registration – launch – scale: MiCA”.

Legal support for VASP in Bulgaria is not about paperwork; it’s about a strategy where compliance becomes a competitive advantage. If you are evaluating a crypto license in Bulgaria or a VASP license in Bulgaria as a route into the EU, lay the right foundations: uncompromising AML/KYC, managed operational security and a clear revenue logic. Then the “regulatory wind” will fill your sails, not blow in your face.

I founded COREDO in 2016, and since then our team has supported dozens of international projects: from company incorporations in the EU and Asia to obtaining crypto, payment and forex licenses. Over the years one topic consistently returns to the agenda of executives and CFOs: whether it is possible to work with clients from the EU without a license if the contacts originate from the clients themselves. This is MiCA reverse solicitation — a narrow corridor of lawful cross-border servicing where the time to market, compliance risks and profitability are at stake.

MiCA: what falls within the scope

MiCA rules for CASPs cover custody and administration of crypto-assets for clients, trading platform operations, exchange of crypto-assets for fiat or other assets, order execution, crypto-asset placements, receipt and transmission of orders, and crypto-asset advisory. If you perform these functions for EU clients from the territory of a third country, you must understand the boundaries of MiCA reverse solicitation and the national rules of complementation in individual member states.

The European Securities and Markets Authority coordinates practice together with national competent authorities (NCAs), but enforcement details are often shaped at the country level. Our experience at COREDO has shown: ignoring local guidelines is a short route to enforcement and regulatory inquiries, even if formally you rely on pan-EU rules.

What is reverse solicitation
I use a working definition: MiCA reverse solicitation is a situation where an EU client on their own initiative (client-initiated contact) approaches a provider in a third country, and that provider provides a service without prior individual or mass solicitation of demand in the EU. This is the passive reception doctrine: you accept a passive inbound, rather than creating an economic nexus by active measures in the Union.

MiCA licensing logic and exceptions
Exceptions to MiCA’s licensing obligation essentially boil down to the correct application of reverse solicitation, but national regulators calibrate the threshold of permissible actions differently. In one COREDO project for a client from Dubai we agreed with local lawyers in two EU jurisdictions the boundaries of permissible web communication: neutral content, no personalized offers, a strict ban on EU-ID retargeting.

MiCA transitional provisions are important for providers already operating under local regimes before full implementation. At the same time transitional provisions do not make reverse solicitation limitless: NCAs continue to apply their own economic presence tests, and ESMA publishes enforcement guidance that influences interpretations.

Servicing EU clients from a third country (onshore vs offshore servicing) is permissible in the absence of presence and substance in the EU, by forming a contractual structure outside the EU and building processes around passive reception. But as the share of EU clients grows and onshore teams, representative offices or agents appear in the Union, the risk of forced jurisdiction and enforcement arises.

Legally offering crypto-asset services
The key question is how to document inbound client requests. The solution developed at COREDO includes multi-level recording of client-initiated contacts in the CRM and web platform logs: recording the original click source, storing the voluntarily submitted contact form, timestamp, IP and geodata, as well as screenshots of user journeys.

Best practices for crypto service providers include an opt-in onboarding process where the client confirms they initiated the contact independently, understands the absence of an EU license and acknowledges that servicing is provided from a specific third country. Consent documentation and record-keeping requirements under MiCA require retaining these confirmations for periods at least equal to the document retention policy adopted in your jurisdiction and aligned with EU expectations.

The evidentiary basis in a dispute with a regulator relies on audit trails and IT logging. At COREDO we add to the legal memorandum an evidence preservation layer: captured versions of the site at the time of contact (web archives), cold campaign logs (showing zero EU targeting), internal instructions to managers prohibiting proactive contacts. Such COREDO practice demonstrates that even in the event of a regulatory request you can present a structured defense line.

KYC and EDD under reverse solicitation
AML principles under reverse solicitation are not weakened: a risk-based approach is mandatory just as it is for licensed activity. I recommend building KYC/CDD processes for non-residents from the outset, including PEP screening and EU sanctions lists, confirmation of beneficial ownership (UBO), and source-of-funds and wealth checks when internal thresholds are exceeded.

Enhanced Due Diligence for clients from the EU is necessary in cases of heightened risk related to jurisdiction, transaction typology or product category (for example, highly volatiletokens, participation in off-chain transactions, working with mixers). In some projects the COREDO team implemented a hybrid model: basic KYC in-house, while EDD and screening are carried out by a certified provider, with transparent outsourcing of compliance to a third party.Marketing: pre-contractual communication
Restrictions on advertising and cold outreach, the basic rule of reverse solicitation under MiCA. Any contact activity directed at EU residents, including partner programs with EU bloggers, referral payments, localized landing pages “for EU clients”, are red flags for NCAs. legal opinion drafting for reverse solicitation at our firm always includes a legal assessment of advertising campaigns and oversight of marketing materials.

Pre-contractual communication rules of MiCA allow responses to specific inquiries, but prohibit expanding the dialogue into mass mailings.

Structuring relationships with an EU client

Transparency and disclosure in reverse solicitation are an ally, not an obstacle. Proper product governance, client segmentation and territorial risk assessments, as well as a documented evaluation of the applicability of the MiCA scope to specific assets (for example, ART or EMT), will help demonstrate the model’s good faith to NCAs. At COREDO we formalize governance and board-level oversight in the form of a report to the board on the share of EU clients and triggers for migration to licensing.

Data protection and GDPR implications are also critical. Even if you are outside the EU, processing personal data of EU residents requires GDPR compliance: appointing a DPO where necessary, legal bases for processing, cross-border data transfers and contracts with processors. Confidentiality and information exchange with counterparties must take into account banking secrecy, local AML rules and NCAs’ requirements.

Risks: compliance, reputation, taxes

Limiting reputation risks requires a conservative information policy and readiness for regulatory inquiry. Evidence preservation and a document retention policy are not formalities: the absence of log records and screenshots often undermines the provider’s legal position. Our clients who had an established audit trail went through checks with minimal losses.

Tax consequences of cross-border services depend on economic presence. The economic nexus test and the risk of a permanent establishment (PE) in the EU depend on where key managerial decisions are made, where employees are located and where marketing is conducted from. We recommend assessing cross-border tax reporting implications together with tax advisors and taking into account CRS/FATCA when structuring.

Checklist for responding to a request from an EU client

• Confirm client-initiated contact: record the channel, time, IP, consent.
• Check geotargeting: exclude retargeting and personalized offers for the EU.
• Perform KYC/CDD, conduct PEP/sanctions screening, determine the risk profile.
• Assess tokens: MiCA scope and classification (ART/EMT/utility), product limitations.
• Provide disclosures: non-resident provider status, lack of an EU license, contract jurisdiction.
• Appoint the MLRO responsible for monitoring and the travel rule, record thresholds and alerts.
• Preserve all evidence: website screenshots, CRM logs and marketing platform logs.
• Assess the share of EU clients and thresholds for migration to EU licensing.
• Prepare a legal opinion on MiCA reverse solicitation and internal instructions for the team.

Licensing or reverse solicitation
Licensing vs servicing via reverse solicitation: a matter of cost-benefit analysis. The economic feasibility of operating without a license is high at early stages when you need to quickly test a product and reach initial transactions. But compliance cost modeling shows: as the share of EU revenue grows, the cost of marketing controls, legal opinions and enforcement risks begins to exceed the CAPEX for obtaining a license in the chosen EU jurisdiction.

Exit strategies include migrating the business to the EU or servicing remotely while obtaining a license in a country oriented towards CASP. A regulator sandbox program option sometimes accelerates testing of innovative products. Registration formalities in the EU and interaction with a local lawyer, preparation of governance documents, AML policies and procedures for CASP, this is an area where the COREDO team has implemented full cycles, including product governance and board supervision.

Practice and interaction with ESMA/NCAs

The COREDO team prepares legal opinions on MiCA reverse solicitation taking into account national nuances, including the legal position of third countries and MiCA, product mapping and assessment of the marketing footprint. We agree with the client in advance on a response playbook: who responds, what data is disclosed, how the internal compliance manual for CASP is demonstrated, and how evidence preservation is presented.

Practical tip: conduct a pre-emptive gap review of marketing, onboarding and IT logging before going live with EU traffic. It is faster and cheaper than urgently fixing traces after a regulatory letter.

Internal policies and controls
Drafting an internal control policy for CASP in the context of reverse solicitation is not a simplified version of the “full” license. Documents should cover the risk-based approach to AML/CFT, KYC/EDD, transaction monitoring algorithms, thresholds for SAR, travel rule, outsourcing governance and data quality controls. The internal compliance manual for CASP structures the roles of the MLRO, the second line of defense and escalations to the board.

Governance and board-level oversight address strategic issues: limits on the share of EU revenue, triggers for moving to licensing, a compliance and legal risk reserve budgeting model. It is at this level that it is decided whether reverse solicitation will remain an experiment or become a bridge to a full EU presence.

COREDO practice examples that work
Case 1: a Singaporean provider serving EU holdings on a request basis. The COREDO team built opt-in onboarding, centralized KYC with EDD for high-risk profiles and a strict “no EU marketing” policy. We prepared a legal opinion on MiCA reverse solicitation with a risk map and a migration plan to a Cypriot license upon reaching a 25% EU-share threshold. A regulatory inquiry from one of the NCAs was closed with an evidentiary base: logs, screenshots, instructions.

Case 2: a Dubai VASP with active content marketing. COREDO’s audit revealed hidden geotargeting to several EU countries and a referral network with EU bloggers. We froze the campaigns, rewrote public disclosures, implemented pre-clearance, trained the sales team and put in place a document retention policy. At the same time we started the licensing process in Estonia; after 8 months the company moved to an onshore model.

Case 3: a British fintech platform with utility tokens. The legal assessment showed exceptions for some tokens, but ancillary services fell within the MiCA scope. COREDO’s practice confirmed: mixed models more often err in classification. We separated product flows, for some — reverse solicitation with neutral web architecture, for others — an application for a license in Slovakia.

Contract models and data protection
Contract models with an EU client should include: choice of law and dispute jurisdiction outside the EU, clear product restrictions, terms for termination of service on regulatory grounds and notifications, disclosure of economic and legal risks. Contracts should set out mechanisms for KYC/EDD, consents for processing and transfer of data, as well as the provider’s rights to transaction monitoring and freezing operations upon red flags.

When reverse solicitation is not advantageous
Business model alignment with MiCA requires an honest assessment. If your growth depends on marketing, partnerships and public promotion, reverse solicitation will limit scaling and increase the cost of compliance. If the business case envisages a significant flow of clients from the EU, it is advisable to plan for EU licensing in advance, choosing jurisdictions with a clear NCA practice and accessible infrastructure (for example, Cyprus, Estonia, some Central European countries).

Compliance cost modeling helps management see where the breaking point lies between the costs of legal protection for the reverse model and the CAPEX/OPEX of a licensed presence. The COREDO team often calculates scenarios: a basic reverse for 6–9 months, a hybrid model with limited marketing and a full transition to a license with an onshore team and presence and substance requirements.

What the regulator will ask during an inspection
Preparation for a regulator’s inspection on client-initiated contacts: it is not only documents. Regulators check product governance, the continuity of the customer information trail, monitoring stability, response to alerts and the competence of the MLRO. We conduct simulated requests where the client team answers questions about site structure, onboarding logic, token classification and the use of EU sanctions lists.

The regulatory perimeter under MiCA changes as ESMA publications are released, and COREDO regularly updates templates of the internal compliance manual for CASP. This allows rapid implementation of changes: for example, strengthening requirements for pre-contractual disclosures or revising the passive client test procedure.

Nuances of ART, EMT and utility tokens
Asset-referenced tokens are regulated more strictly, especially regarding issuance, reserves and disclosures. E-money tokens under MiCA trend towards requirements similar to electronic money, including capital and safeguarding of funds. Utility tokens may be outside MiCA with a narrow functional purpose, but as soon as trading availability or an investment motive appears: we return to the MiCA scope.

COREDO helps clients with product mapping: a matrix of token functions, use scenarios, impact on AML/KYC and product restrictions in reverse solicitation. This reduces the risk of incorrect classification and NCA claims.

From hypothesis to a sustainable model

• Carry out a MiCA scope and applicability assessment to the product, taking into account national transpositions.
• Decide whether the model allows passive inbound without marketing in the EU.
• Build web and CRM architecture with inbound logging, disable EU targeting.
• Develop an internal compliance manual, AML policies, travel rule procedures and the MLRO role.
• Set up KYC/CDD/EDD, sanctions and PEP checks, transaction monitoring.
• Prepare a legal opinion on MiCA reverse solicitation and a response plan for inquiries.
• Agree on ToS, agreements, disclosures, a privacy notice and GDPR processes.
• Identify triggers for moving to licensing, calculate ROI and choose a jurisdiction.
• Maintain record-keeping, evidence preservation and regular board oversight.

Conclusions

The COREDO team has walked this path with clients many times: from the legal opinion and process setup to transitioning to a licensed model in the EU. I am convinced that resilience in the crypto-economy is built on two pillars – strategic clarity and operational excellence. Reverse solicitation can become your bridge to Europe if you define the boundaries in advance, stay within the regulatory perimeter and make a timely decision about licensing.