Your Growth Stack Is Now Evidence
European regulators published a list of things that suggest a crypto firm is soliciting EU clients. Read it as a designer and it is a list of website, SEO and distribution decisions. MiCA and design, part one of two. Written with Serhii Barinov of SBLC.
A crypto client asks for the usual work. Localise the site into German. Put it on a country subdirectory. Build some links from European publications. Run retargeting. Find a creator in the space who will talk about the product.
Every item on that list now appears in an ESMA annex as a circumstance suggesting the firm is soliciting clients in the European Union.
I spent a long time going through this with Serhii Barinov, a lawyer at SBLC who works on licensing and compliance for web3 companies. What follows is what I took away from it as someone who builds these sites, plus his answers in his own words further down.
Why this matters now
The MiCA transition period ended on 1 July 2026. A week before the deadline ESMA published a statement confirming there would be no extension. From that date, serving clients in the EU without CASP authorisation is a breach.
The scale is worth sitting with. Around 1,350 VASPs were providing crypto services in the European Economic Area under national regimes. By the deadline, 281 firms had been authorised. The ESMA register listed 331 authorised CASPs as of 2 September 2026.
So most companies that used to serve European clients now cannot. Some are applying for authorisation. Some are turning to clients outside the EU. And some are trying to solve it by changing how the website looks, which is where this stops being a legal question and becomes a design one. I wrote earlier about the aesthetic European crypto has been converging on under this pressure.
The exemption everyone is leaning on
Article 61 of MiCA lets a firm outside the EU serve an EU client if that client approached them at their own exclusive initiative. Reverse solicitation.
The regulation itself says that any solicitation of clients in the Union, by any means of communication, means the service was not provided on the client's own initiative. In February 2025 ESMA published guidelines on how that works in practice, and an annex listing the circumstances that suggest a firm is doing exactly that.
The annex, read as a brief
Here is what is on it, grouped the way a studio would group it.
Domain and information architecture. A national top level domain such as .fr, .es or .at. A generic domain with country subdirectories such as .com/fr or .org/es. Brand and navigation choices inside a group that do not let a client tell an EU-regulated entity apart from a third-country one.
SEO. A generic domain with geo-targeting set in SEO tools. Geo-targeted link building, meaning backlinks from sites on European domains or subdirectories.
Language. A site, or part of one, in an official EU language that is not customary in international finance, or built-in translation tools, unless there is a sign the firm comes from a jurisdiction using that language. English reads as neutral. A German, French, Polish or Spanish version does not.
Paid distribution. Geo-targeted advertising in search or social aimed at prospective clients in the EU. Retargeting. Affiliate campaigns. Sponsorship of an event centred on the EU or a member state. A paid European influencer or content creator promoting the service or building a profile. A logo or backlink placed on a European affiliate's site.
Content marketing. Purely educational material is carved out. It stops being carved out when the audience is directed to the firm's site, given the means to access its services, or invited to fill in a client profile.
That last one deserves a moment. The standard advice in this industry is to publish educational content instead of pushing ads. Under these guidelines that advice only survives in its literal form. An educational article with no route back to your own domain is fine. The same article with a button is a different thing.
I asked Serhii Barinov
Serhii is a lawyer at SBLC, a firm working with software, blockchain and licensing since 2019. The answers below are translated from his own written analysis of the guidelines.
Why does a financial regulator care about domain architecture and SEO settings at all?
"We are used to thinking about UI design, brand strategy and content for crypto services on one side, and compliance on the other, as parallel things. The lawyer approves the offer and the disclaimers, and the product stays on the marketing and development floor. Under MiCA the connection is deeper. The regulator is less interested in how your service looks than in how it functions. Which domain zone you are registered in, what language the site version is in, which queries your search visibility is optimised for, where the CTA elements lead, and who you let onto the page by geolocation. All of that is taken from ESMA guidance. Domain architecture, localisation, SEO strategy, distribution, partner integrations and branding. The regulator assesses the functional behaviour of the product, not its appearance."
What surprises companies most when they read the annex?
"Solicitation is interpreted broadly and in a technology-neutral way. The list includes banners and pop-ups on sites and social networks, mobile applications, affiliate campaigns, ad retargeting, messengers, sponsorship agreements, and invitations to fill in a form or take a training course. It is stated separately that advertising of a general nature, including brand advertising with wide reach, can also constitute solicitation. There is a footnote saying that if a firm sponsors international sporting competitions involving national teams of member states or athletes from the EU, MiCA does not prohibit such agreements, but the firm will be considered to be soliciting clients in the EU, and it loses the exemption."
Does the educational content carve-out survive in practice?
"Purely educational material is not solicitation. But it becomes solicitation as soon as a European audience is directed to the firm's site, given the means to access its services, or invited to fill in a client profile. So the popular advice to do pull content instead of push works only literally. An educational article on a European resource without an active link to your own resource is fine, but the same article with a 'learn more' link is already in question. What matters is whether the CTA opens a route to the service."
A company rewrites its homepage to look more solid, adds words like licensed, regulated, insured, bank-grade security, guaranteed, and removes the risk warnings because they spoil the impression. What happens legally?
"Legally, every one of those words is a regulatory representation: a statement the company has to be ready to prove. 'Regulated' without a valid authorisation, or 'guaranteed' next to a yield figure, will not pass the fair, clear and not misleading test in Article 66, and it turns marketing into a breach."
If a firm has already been doing all of this, does redesigning the site fix it?
"If there is no authorisation, neither design nor wording will replace it. Rebuilding a site so that it does not look like solicitation, while the actual activity stays the same, does not create legal protection. It creates a documentary trail: a set of decisions demonstrating awareness of the requirement. A supervisor does not assess the elements one by one, they put them together. And the ESMA guidelines expressly instruct competent authorities to look for exactly those traces."
What this changes in the work
Three things, from where I sit.
The first is sequencing. Domain strategy, language versions, SEO targeting and partnership plans now need a legal read at the design stage rather than after launch. Not the copy. The architecture.
The second is that the growth playbook stops being generic. A messaging framework for a company in this position has to be built knowing which claims are regulatory representations. Localisation, local link building and creator partnerships are standard services, and for a client in this position they are the specific things that create exposure. A studio that sells them without asking about authorisation status is selling a liability.
The third is uncomfortable and worth saying plainly. If a firm is not authorised and is still serving EU clients, no amount of design work fixes that. What design can do is make the situation legible, which is a different job from making it look acceptable.
In the next issue: what ESMA does recognise as protection, why disclaimers are explicitly worth nothing, and the part that is squarely a branding problem, when a group's own brand architecture becomes the evidence.
Sources
The legal analysis in this issue comes from Serhii Barinov, lawyer at SBLC, who works on licensing and compliance for software and blockchain companies. The quoted answers are translated from his written analysis and published with his approval.
Primary sources: Regulation (EU) 2023/1114 (MiCA), articles 61 and 66. ESMA Guidelines on reverse solicitation under MiCA, ESMA35-1872330276-2030, 26 February 2025, and its annex. ESMA public statement on the end of the transitional period, ESMA75-113276571-1710, 23 June 2026. ESMA register of authorised CASPs. TRM Labs, EU VASPs After MiCA, 7 August 2026.
Earlier in this series: Going Light Won't Make You a Neobank, A Brand Is Never Finished, and Your Hardest Reader Is Not a User. Part two: The Only Defence ESMA Accepts Is Technical.