ESMA Reverse Solicitation Guidance MiCA

On 26 February 2025, ESMA published final guidelines clarifying when third‑country firms are deemed to solicit EU clients and how regulators will police attempts to rely on MiCA’s reverse solicitation exemption. The guidelines take effect 60 days after publication and will materially tighten what non‑EU providers can do without EU authorization.

What’s changed

• Solicitation is very broad and technology‑ Any promotion, advertisement or offer directed at EU clients can qualify, including websites, mobile apps, push notifications, social media posts, influencers, search engine optimisation (“SEO“), sponsorships, roadshows, press releases, brochures, messaging platforms, email, and phone calls. Even general brand advertising may be solicitation if it reaches EU audiences.
• Educational content is not a safe harbour if it promotes access to services. “Purely educational” materials become solicitation where they link to platforms, provide onboarding routes, distribute service brochures, collect client details, or otherwise promote the firm.
• Who does the soliciting does not matter. Activity by the firm, its group, affiliates, influencers, or anyone acting “on behalf of” or with close links to the firm counts. Payment is a strong indicator but is not required.
• Reverse solicitation is narrow. Services must be provided at the client’s own exclusive initiative. Disclaimers cannot override facts. Follow‑on marketing—even of the “same type” of service—outside the original transactional context is not permitted.
• “Same type” is construed narrowly. Firms must use a granular taxonomy based on asset and service categories and risk. ESMA gives examples of pairs that are not the same type (e.g., different e‑money token reference currencies; different technologies; liquid vs. illiquid assets; meme coins vs. asset‑referenced tokens).

What regulators will do

ESMA expects national authorities to actively monitor online activity, use marketing and social media monitoring tools, look for EU indicators (such as domains, subdirectories or contact details), exchange intelligence with tax and law enforcement, and act on complaints and whistleblowers.

Risky patterns ESMA highlights

• EU‑targeted SEO, country‑code domains, EU language sites without a clear non‑EU rationale, geo‑targeted ads, EU sponsorships.
• Use of EU influencers or EU affiliates’ websites to display logos, backlinks, or funnels that blur lines between EU‑authorised entities and non‑EU firms.
• App push notifications encouraging further trading or promoting different asset types after a client’s initial approach.
• Bundled service offers when a client requested a single service.

Practical steps for third‑country firms

• Freeze EU targeting: implement robust geo‑blocking on web and apps; remove EU app‑store availability; disable EU push notifications; exclude EU in ad platforms.
• Audit marketing and channels: review SEO, domains/subdirectories, languages, cookies, retargeting, sponsorships, press, and social. Remove EU‑facing content and funnels via affiliates or partners.
• Control third parties: update influencer and affiliate contracts to prohibit EU reach; monitor and log posts; require geo‑exclusions and pre‑
• Tighten client‑journey controls: ensure any EU interactions are demonstrably client‑initiated; no follow‑on marketing; no cross‑selling or bundling; disable in‑app prompts to EU IPs.
• Implement a product/service taxonomy: define “same type” narrowly; document rationale; train teams; strict restrictions on marketing tools.
• Record‑keeping and governance: maintain detailed logs evidencing client initiative; track changes to targeting; assign senior accountability; prepare a regulator‑ready dossier.