Reverse Solicitation in Crypto Lives in the Ad Account

• Since 1 July 2026, MiCA Article 61 is the only route into the EU for a non-EU firm without EU authorization.
• Under MiCA, a client attestation cannot override evidence of ads, affiliates, paid influencers or sponsorships.
• The FCA says reverse solicitation is no exemption in itself under the UK cryptoasset regime starting in October 2027.
• SEC staff treat trades through a foreign broker’s website as ordinarily solicited.
• Japan expects offshore exchanges to keep its residents out, and Brazil cuts unauthorized VASPs off from local institutions from 6 November 2026.

The FCA settled its High Court case against HTX in late October 2026, and the undertakings it secured deal with marketing and access. Huobi Global, the entity behind the exchange, will not knowingly communicate a promotion that breaches section 21 of FSMA. New UK users can no longer sign up, and HTX “will not target, solicit or actively seek to engage UK consumers,” according to the FCA’s announcement. Steve Smart, the FCA’s enforcement director, said that being based overseas does not put crypto firms beyond the reach of UK law.

Offshore crypto firms usually file reverse solicitation under onboarding, as a statement the customer makes about how they arrived. The regulators that recognize the concept test it against the firm’s own conduct, looking at its ad accounts, affiliate contracts, influencer payments, website languages, sponsorships and location controls. A firm proves reverse solicitation from its own records, and a customer’s attestation adds very little to that file.

The concept also exists in far fewer places than crypto onboarding flows assume. MiCA contains a genuine exemption, and ESMA has drawn it narrowly enough to admit one client at a time. Guidance for the UK‘s incoming regime says reverse solicitation is no exemption in itself. US securities law offers a broker-dealer carve-out for unsolicited trades, Japan’s guidance asks offshore exchanges to keep Japanese residents out, and Singapore licenses the offshore-only business model itself.

The future of finance is here. Trade crypto and more

How MiCA Article 61 works for third-country firms

MiCA’s transitional period ended across the EU on 1 July 2026. ESMA’s statement ahead of that date, as published by the AMF, said entities established outside the EU “may not provide crypto-asset services to EU clients (apart from the limited exemption for reverse solicitation).” For a non-EU exchange with no EU entity holding CASP authorization, Article 61 is now the only lawful door.

Under Article 61 of MiCA, the Article 59 authorization requirement falls away when a client established or situated in the Union initiates a crypto-asset service at its own exclusive initiative. Solicitation defeats it, whether it comes from the firm, an entity acting on its behalf or having close links with it, or any other person acting on behalf of such an entity, “regardless of the means of communication used.” A contractual clause or disclaimer stating otherwise has no effect. Article 61(2) adds that the client’s initiative does not entitle the firm to market new types of crypto-assets or services to that client.

Tokens that qualify as financial instruments sit under MiFID II, where Article 42 uses the same “own exclusive initiative” wording for third-country investment firms. ESMA reminded firms in a January 2021 public statement that “every communication means used, such as press releases, advertising on internet, brochures, phone calls” counts toward solicitation. The same statement named online “I agree” pop-ups and general clauses in terms of business as attempts at circumvention. A firm has to classify the token before it knows which of the two exemptions it is testing.

What ESMA counts as solicitation under MiCA

ESMA’s final report on the reverse solicitation guidelines, dated 17 December 2024, describes the exemption as “very narrowly framed,” and the guidelines themselves followed in February 2025. They list internet commercials, brochures, invitations to events, affiliation campaigns and sponsorship deals as forms of solicitation. Brand advertisements of a general nature can qualify too. Sponsoring an EU-centric sporting event is likely solicitation, and a website in an EU language uncommon in international finance counts as an indicator alongside the others.

Third parties are attributed to the firm generously. A person can act on the firm’s behalf through a contract or “via an informal agreement,” influencers are named expressly, and payment is “a strong indication” that a third party is acting for the firm. An unprompted review by an outsider stays outside the definition only where the firm has no knowledge of it and has not “consented, encouraged or otherwise facilitated it.”

A firm may offer further services of the same type only “in the context of the original transaction.” In ESMA’s own example, a firm that executed a client-initiated trade in crypto-asset X may not market further X transactions to the same client a month later. The guidelines decline to set a fixed time limit. Firms are expected to “provide records tracking the relationship with the client,” and the guidelines list refusing new EU accounts and geo-blocking as precautionary measures for firms that want to stay out.

Belgium’s FSMA wrote the guidelines into its supervisory practice in a circular of 3 July 2026, two days after the transitional period closed, and uses them “to detect and prevent circumvention of the reverse solicitation exemption.”

The UK financial promotions regime and the 2027 perimeter

The UK runs two clocks, and the one already ticking is the financial promotions regime. Since 8 October 2023, a cryptoasset promotion to UK consumers has needed an FCA-authorized communicator or approver, an FCA-registered cryptoasset business behind it, or an exemption. The FCA’s guidance for firms marketing to UK consumers says the regime applies “regardless of whether the firm is based overseas,” and the HTX case was brought under it.

Buy bitcoin and stocks. Signup to Coinbase today

The FCA’s review of firms’ preparations shows where it draws the line. “Financial promotions do not need to be specifically directed at UK consumers to be capable of having effect in the UK.” The weakest firms ran global websites and social media accounts with “no controls to prevent UK consumers from accessing the services in the promotion,” and some had connected entities abroad likely to work with influencers. The strongest used geo-blocking and onboarding checks that caught customers giving a UK address or a UK-based payment method.

The second clock starts on 25 October 2027, when the Cryptoassets Regulations bring trading platforms, dealing, arranging, safeguarding, staking and stablecoin issuance inside the FSMA authorization perimeter, as the FCA confirmed in PS26/18 in September 2026. The new PERG 18 guidance settles the cross-border question in three paragraphs. Under section 418(6C), an overseas firm dealing with a UK consumer is deemed to carry on the activity in the UK. The deeming falls away only where a UK firm authorized to deal as principal or run a trading platform sits in between, and an intermediary holding only arranging or agency permissions is unlikely to break the chain. The overseas persons exclusion does not apply to the new activities. PERG 18.3.7 then states that “reverse solicitation is not, in itself, an exemption or exclusion from carrying on a regulated cryptoasset activity.”

For retail business after October 2027, an offshore exchange reaches UK consumers through a UK-authorized principal or not at all. Customer initiative feeds into the five questions PERG 18.1.11 asks about activity, UK nexus, business purpose, exclusions and exemptions, and the guidance says the customer’s approach is not decisive on any of them.

SEC Rule 15a-6 and CFTC access rules in the United States

US securities law has the closest analogue, and it was written for brokers. Rule 15a-6(a)(1) exempts a foreign broker-dealer from SEC registration for transactions with persons it has not solicited. The SEC reads solicitation as “any affirmative effort by a broker or dealer intended to induce transactional business,” and its staff FAQ on Rule 15a-6 adds two lines that rule out the app model. A transaction over a foreign broker-dealer’s website “ordinarily would be considered a solicited transaction.” Staff also read “a series of frequent transactions or a significant number of transactions” with one US investor as a sign of solicitation through an ongoing relationship.

The SEC set its location template in the 1998 Internet release. A prominent disclaimer works when the firm also refuses anyone it has reason to believe is a US person, judged on residence, mailing address, payment method or other grounds. The exemption fits a US fund that phones a foreign broker for a single trade in a security. It offers nothing to a retail account opened through a website and used weekly, and derivatives on commodity tokens belong to the CFTC in any case.

Commodity law offers no general client-initiative exemption. Under CFTC Part 48, a foreign board of trade needs a registration order before it gives participants located in the US direct access to its matching engine. Part 30 makes it unlawful to offer foreign futures or options to a customer located in the US except under its terms. The CFTC’s two largest offshore exchange cases both turned on location controls.

BitMEX settled in August 2021 with a $100 million civil monetary penalty, up to $50 million of which could be offset by payments under FinCEN’s parallel assessment. The CFTC order found that BitMEX offered leveraged derivatives to retail and institutional customers in the US and was aware US customers could reach the platform. BitMEX certified that US persons are barred, all active users are verified, and US and unverified users are blocked from trading and withdrawals.

Binance went further. Its December 2023 judgment required $1.35 billion in disgorgement and a $1.35 billion penalty, with $150 million more from Changpeng Zhao personally. The court found that Binance “actively solicited customers in the United States,” and the Zhao consent order describes the controls. An IP-based pop-up “did not block customers from logging in to their account, depositing assets, or trading on the platform.” A Binance guide recommended a VPN to users who wanted to keep their location private, and the order finds that Binance assisted and instructed customers in the US “to evade the compliance controls.”

Japan’s exclusion model and Hong Kong’s active marketing test

In Japan, the FSA’s guidelines for crypto-asset exchange service providers bar an unregistered foreign exchange from soliciting persons and treat advertising on a website as solicitation in principle. A foreign site escapes that reading through reasonable measures. It must state clearly that persons in Japan are not covered and collect address, mailing address, email and payment details to confirm where each user lives. It must also decline orders where there is reasonable cause to believe the person is clearly in Japan. A call center for Japanese users counts against it. Without such measures, the guidelines put the probability of solicitation at “extremely high” and expect the provider to prove it carried out no solicited trades with persons in Japan.

The future of finance is here. Trade crypto and more

Every element of that safe harbor keeps Japanese residents out, and the guideline offers no route for accepting one who applies unprompted. The FSA’s list of warned unregistered providers describes each overseas entry the same way, as running a crypto exchange business with residents of Japan over the internet. KuCoin, Bybit, MEXC, Bitget and bitcastle were added in November 2024, and the latest entry, a Hong Kong operator, was added in September 2026. The Diet passed amendments on 15 July 2026 that move crypto exchange regulation into the Financial Instruments and Exchange Act, according to a PwC Legal briefing. They raise the maximum penalty for unregistered business to ten years’ imprisonment and a ¥10 million fine, and the briefing gives no commencement date.

Hong Kong tests the firm’s marketing directly. Section 115 of the SFO catches a person who actively markets regulated services to the Hong Kong public from inside or outside Hong Kong. The SFC applies the same concept to virtual asset services under section 53ZRB of the AMLO. The SFC’s FAQ on active marketing lists the factors. They include a detailed marketing plan, extensive advertising through direct mail, local newspapers or internet push technology, and a concerted campaign run to a schedule. Packaging aimed at the Hong Kong public counts too, such as materials “written in Chinese and denominated in Hong Kong dollars.”

Whether customers sought out the services “on their own initiative” sits on the same list, so passive inbound demand counts in an offshore platform’s favor. The SFC’s alert list shows the other side. CoinUnited.io was added in July 2024 after claiming a flagship store in Hong Kong and advertising for staff there.

Home-state licensing in Singapore, the Cayman Islands and the BVI

Since 30 June 2025, digital token service providers in Singapore that serve only customers outside Singapore have needed a license. MAS said in its June 2025 clarification that it has set a high bar and will generally not grant one, citing higher money laundering risk and its inability to supervise firms whose substantive activity happens abroad. Providers already licensed to serve customers in Singapore may serve overseas customers too, and services involving only utility or governance tokens fall outside the regime. By September 2026, MAS had granted no DTSP license to a firm serving only overseas customers.

Cayman and the BVI both regulate by an “in or from within” test. Cayman’s VASP Act covers virtual asset services conducted in or from within the Cayman Islands. Since 1 April 2025, providers of custody and trading-platform services there “must obtain a license,” according to CIMA’s circular on the second phase of the regime. CIMA applied the same test to Gate.io in April 2025, stating that neither Gate.io nor Gate Global Corp had ever been registered, licensed or otherwise authorized by the authority. The BVI’s VASP Act took effect on 1 February 2023 and requires registration for VASPs operating in and from within the territory.

Express initiative in Switzerland and inducement in Australia

Switzerland has a genuine client-initiative rule, written into its financial services legislation. Under the Financial Services Ordinance, services are deemed not provided in Switzerland where a foreign provider’s client relationship began at the client’s express initiative. The rule also covers an individual service a client requested on that basis, as Baker McKenzie’s regulatory guide summarizes it. Institution licensing generally applies only where the firm is based in Switzerland or has a physical presence there, per the same guide. Client advisers of a foreign provider working in Switzerland must still sit on the Swiss adviser register unless the provider is supervised at home and serves only professional and institutional clients, according to FINMA.

Australia has no reverse solicitation rule. Its territorial test runs through section 911D of the Corporations Act. A financial services business counts as carried on in Australia where the firm engages in conduct intended or likely to induce people there to use its services. Avoiding inducement keeps a foreign firm clear of that deeming rule, and nothing in it turns on who made first contact.

ASIC’s FFSP guidance says the relief built around section 911D runs until 31 March 2027 for firms that notified ASIC before 31 March 2020, and that new statutory exemptions become available on 8 April 2027. Transitional arrangements are still to come. The new exemptions cover professional investors, comparable regulators and market makers, according to Baker McKenzie, whose April 2026 note dates them to 9 April 2027. ASIC, which administers the exemptions, gives 8 April in guidance updated in November 2026. Platform rules under the Corporations Amendment (Digital Assets Framework) Act 2026 also commence on 8 April 2027, according to ASIC. AUSTRAC already requires registration before anyone provides virtual asset services in Australia.

Brazil’s November 2026 cut-off and FATF’s offshore VASP findings

Resolution BCB 520 of 10 November 2025 governs the constitution and operation of virtual asset service providers. Its article 91 bars financial institutions, payment institutions and other BCB-authorized institutions from carrying out or enabling virtual-asset operations with providers that lack BCB authorization to operate in Brazil, outside the exceptions the resolution allows. The original start date was 30 October 2026. A BCB board vote of 22 September 2026 moved it to 6 November 2026, giving the central bank time to publish its official list of institutions in transition. The prohibition runs against Brazilian banks and payment firms, and an offshore provider’s account of how its Brazilian customers arrived plays no part in it.

Buy bitcoin and stocks. Signup to Coinbase today

FATF’s March 2026 report on offshore VASPs defines them as VASPs created under one jurisdiction’s laws, “with or without a physical presence,” that serve clients residing in another. It found that 46% of jurisdictions had adopted an activity-based approach to regulation and supervision. In the July 2026 targeted update, 34% of responding jurisdictions (39 of 114) said they require certain offshore VASPs to be licensed or registered. National authorities self-reported the July figures.

Building a reverse solicitation evidence file

Where client initiative is recognized, the evidence that holds up is generated at first contact and kept long after it. ESMA expects records that track the whole relationship, and the FCA, the SEC and Japan’s FSA have each described the location signals they expect a firm to check.

A client onboarded under Article 61 who lands in the general CRM receives the next staking campaign and the next token-listing email. Each of those messages is a fresh solicitation the client never initiated, and the suppression flag is the control that stops them.

Reverse solicitation is an exemption from a licensing or marketing rule, and AML sits outside it. Customer due diligence, sanctions screening and the Travel Rule apply in full to every client the exemption admits.