Swiss SRO vs EU MiCA vs El Salvador: Choosing Between the Three Main Routes

The site already carries a side-by-side page setting out what each of the three routes is in law and how the decision factors compare — see the three-route comparison. This article does not repeat that table. It takes the next layer down: the supervisory architecture behind each status, the procedural milestones each authority actually publishes, what an authorisation permits at the level of individual services, and the boundary rules that decide what happens when your clients are somewhere your status is not.

Who supervises you, and who supervises them?

The three regimes answer this question in three structurally different ways, and the answer shapes everything from audit cycles to how a counterparty's onboarding team reads your file.

Switzerland. FINMA states that professional financial intermediaries under Article 2 paragraph 3 of the Anti-Money Laundering Act "must join an SRO recognised by FINMA", and that such intermediaries "are supervised by the SROs where they are affiliated, and not by FINMA". The regulator's leverage is exercised one level up: "SRO regulations and any amendments to them must be approved by FINMA", and those regulations define how members implement AMLA duties, including establishing the identity of all contractual partners and beneficial owners and the duty to report any suspicion of money laundering. So there are two tiers — the SRO supervises the member, FINMA recognises and supervises the SRO and approves its rulebook.

The European Union. Authorisation is granted by the competent authority of the applicant's home Member State under Article 63 of Regulation (EU) 2023/1114 (MiCA). Convergence between those national authorities is ESMA's work rather than a supervisory power over the individual firm; ESMA's MiCA page describes exactly that programme of supervisory convergence with national competent authorities on the authorisation regime. Article 63(5) also requires the authority to consult its counterpart in another Member State where the applicant is a subsidiary of, or is controlled by the same persons as, certain regulated entities there.

El Salvador. Registration and supervision sit with the Comisión Nacional de Activos Digitales. Its published procedure ends with the Commission notifying the Financial Investigation Unit of each newly registered service provider — the AML chain is wired in at the point of registration rather than delegated to a membership body.

What procedural milestones does each authority publish?

Read the following as what it is: published procedural steps and, in the EU's case, statutory deadlines. None of it is a prediction of how long an application takes, and none of it says anything about the likelihood of a favourable outcome.

One structural difference is worth pulling out. Only the EU route puts its clock in legislation, and that clock starts from the date a complete application is received — completeness being the competent authority's own assessment under Article 63(2). In practice this makes the quality of your responses to information requests a bigger determinant of elapsed time than your filing date. El Salvador publishes business-day maxima for its evaluation stage; Switzerland publishes the sequence of stages rather than durations. In every case the pace depends on both sides, and no authority is obliged to approve anything.

What does the authorisation actually permit?

English-language shorthand — "a licence" — hides an important difference in granularity. Article 59(6) requires competent authorities to ensure that a MiCA authorisation specifies the crypto-asset services the provider is authorised to provide. It is a schedule of permissions, not a general status. Article 59(8) then gives the upgrade path: a provider wanting to add services must ask the authority that granted the original authorisation for an extension, complementing and updating the Article 62 information, and the request is processed under the same procedure.

Because Annex IV ties permanent minimum capital to those same service classes — EUR 50 000 for the Class 1 services, EUR 125 000 once custody and administration or exchange services are added, EUR 150 000 once a trading platform is operated — widening the permission schedule widens the capital requirement and the filing burden in the same movement. Scope creep is not free.

Swiss SRO membership works differently: it confirms a status — that the firm sits within AML supervision through an SRO whose own rulebook is approved by FINMA — rather than enumerating permitted services. El Salvador's register is organised around the digital asset services listed in its own law, with CNAD maintaining separate public registries for service providers, issuers, issuances, certifiers and issuance platforms.

Where does each status stop?

This is the question the comparison page raises and this article answers with the operative provisions.

The EU perimeter is drawn around solicitation, not incorporation. Article 61(1) exempts a third-country firm from the Article 59 authorisation requirement where a client established or situated in the Union initiates the service at its own exclusive initiative — and then closes the gap twice over. Where the third-country firm, an entity acting on its behalf, an entity with close links to it, or any person acting for such an entity solicits clients or prospective clients in the Union — "regardless of the means of communication used for the solicitation, promotion or advertising" — the service is not treated as client-initiated. And that applies "notwithstanding any contractual clause or disclaimer purporting to state otherwise", including a clause saying the service is deemed client-initiated. Article 61(2) adds that a client's own initiative does not entitle the firm to market new types of crypto-assets or services to that client. Article 61(3) required ESMA to issue guidelines on when a third-country firm is deemed to solicit; a final report on those reverse solicitation guidelines is listed on ESMA's MiCA page.

El Salvador applies the same logic to its own market. CNAD defines a Digital Assets Service Provider as a natural or legal person whose ordinary business is providing one or more of the digital asset services listed in Article 19 of the law and who meets one of two conditions: domiciled in El Salvador, or not domiciled there but actively promoting or marketing its services to potential clients in the country. A registration duty can therefore arise from a marketing decision alone.

Switzerland does not draw an extraterritorial line, because it does not sell one. SRO membership is an affiliation within Swiss AML supervision. It confers no EU authorisation, and it is not intended to. What it does do is put the firm under continuing supervision by a body whose rulebook FINMA has approved — a fact that is checkable by a counterparty in the same way for every member.

Where does the client's money have to sit?

This constraint rarely appears in route comparisons and frequently determines the timetable. Article 70(1) and (2) require providers holding clients' crypto-assets or funds to make adequate arrangements safeguarding clients' ownership rights, particularly in insolvency, and to prevent use of client assets for their own account. Article 70(3) is specific: clients' funds other than e-money tokens must be placed with a credit institution or a central bank by the end of the business day following the day on which they were received, in an account separately identifiable from any account holding the provider's own funds.

That is a banking prerequisite expressed as a conduct rule. A MiCA applicant needs a workable EU banking relationship before Article 70 can be operated at all, which is why banking is treated here as a parallel workstream rather than a post-approval task — see bank accounts and card issuing.

Can these routes be stacked or upgraded?

Not interchangeably. Article 143(3) allowed providers that were serving clients in accordance with applicable law before 30 December 2024 to continue until 1 July 2026, or until they were granted or refused authorisation under Article 63, whichever came sooner — and permitted Member States to disapply or shorten that regime where their pre-existing national framework was less strict. ESMA's MiCA page sets out the same grandfathering clause alongside the simplified procedure in Article 143(6). The option of running on a legacy national registration has therefore closed.

What does exist is a staged path within MiCA, via the Article 59(8) extension: take the permissions that match the business you actually have, operate the compliance system properly, and extend when the client base changes. A Swiss membership or a Salvadoran registration cannot be converted into an EU authorisation; changing regime means applying again, and rebuilding substance for the new one.

How should a founder sequence the decision?

1. Fix the perimeter first. Where are the paying clients, and where will you market? Article 61 and CNAD's definition both make marketing itself a trigger.
2. Then fix the permission schedule. Freezing the service list fixes the Annex IV class, the capital, the filing pack and the later extension route in one decision.
3. Then fix substance and banking. People, address, AML function and the client-money account decide whether the file can be submitted at all. The four elements are broken down in local substance requirements explained.

For the underlying selection method see licence selection, for the Swiss path in stages see the Swiss SRO route, and for the side-by-side view of the three regimes see the three-route comparison.

A closing caveat

This is a description of published provisions and published procedures, not legal advice. CryptoLicense is the licensing advisory brand of CL GLOBAL SDN BHD (1421939-T), and is neither a regulator nor a law firm. No route guarantees an outcome: granting an authorisation or admitting a member is entirely at the discretion of the relevant authority or self-regulatory organisation under its own rules, and progress depends on both the applicant's responsiveness and the authority's own workload. Our coverage is 10+ Jurisdictions Covered; which of them fits a given business model is a conversation that starts with where your clients are and what you intend to do for them.

本文属于系列指南：完整指南见 牌照选型.