A crypto firm without a MiCA authorisation can still serve European clients in one narrow case: the client came to it on their own initiative. That is reverse solicitation (MiCA Art. 61). The exemption is fragile. Outbound marketing aimed at the EEA destroys it.

So the banks, payment rails, EMIs and custody providers that carry non-EEA crypto clients usually ask for one thing: a signed declaration that the client does not market into the EEA.

A declaration is unverifiable. It says what the client intends. It does not show what a visitor in Lisbon or Helsinki is shown when they open the site.

What "marketing into the EEA" looks like on a page

Our free check reads four kinds of signal on a single page:

  • EEA-language localisation — the page served in an EEA language
  • Country-specific promotions — an offer named for an EEA country or its residents
  • EUR / SEPA payment rails — euro deposits, SEPA transfers on the buy or deposit page
  • Availability or onboarding language aimed at EEA residents

Active solicitation with no explicit EEA exclusion is the exposure it flags. You can run it on any exchange's URL, or paste the copy: northpoint.fi/check/non-eea. It is free, and it reads one page from our server.

Why one page from one server is not enough

A page can show different things depending on where the visitor is. A check run from a server outside Europe can come back clean while an EEA visitor sees euro rails and a local-language promotion. And one page is not the firm's marketing: the app storefronts, the campaign pages and the terms all speak too.

That is the gap between the free check and a record you could put in a compliance file.

What a monthly record holds

The Non-EEA Marketing Monitor visits a client's public marketing surfaces every month from an EEA residential IP — the site and its languages, the buy and deposit pages, the app storefronts, the promotions and the terms. Each record has three parts:

  1. The surface map — every surface examined, what was checked on it, and what was out of scope.
  2. The dated record — every fetch with its UTC time, HTTP status and a SHA-256 of the body, diffed against last month's record.
  3. The flag list — each EEA-targeting signal, its severity and the evidence behind it.

Hashing every fetched body pins down exactly what was served at that minute, and the month-on-month diff turns a snapshot into a history — the question a reviewer actually asks is "what changed since last time?". The record itself can be checked too: northpoint.fi/verify confirms a record number was issued by NorthPoint, and if you drop the PDF in, whether your copy is unchanged (checked in your browser, never uploaded).

There is a redacted sample record from a real September 2026 scan: the firm, its domains, its app identifiers and the scanning IP are removed; the scope, the flags with their evidence and the full fetch ledger are as delivered.

What it is not

A record is evidence of what an EEA visitor was shown on the date it was taken. It is not a verdict on the client, and it is not legal advice.

If you carry non-EEA clients and want to talk about it, the form on the Monitor page goes straight to a person — two lines is enough.

Information, not legal advice.