How to check if a crypto exchange is MiCA licensed

Since 1 July 2026, a company that offers crypto services to people in the European Union needs a licence under MiCA, the EU's Markets in Crypto-Assets Regulation. The transitional period that let older firms keep going under national rules is over in every Member State. So the question "is this exchange regulated?" now has a precise answer, and you can check it yourself in about ten minutes. This guide shows where to look, how to read the record, and the traps that make an unlicensed firm look licensed. It also shows what a licence does not do, because a MiCA licence makes a firm accountable, it does not make your money safe.

What a MiCA licence is

MiCA calls exchanges, brokers, custodians and similar firms crypto-asset service providers, or CASPs. Under Article 59, nobody may provide crypto-asset services in the EU unless they are either authorised as a CASP by a national regulator, or are one of the already regulated financial firms allowed to do it by notification under Article 60: banks, investment firms, e-money institutions, fund managers, market operators and central securities depositories, each only for the services that match their existing licence. A notifying firm must tell its regulator at least 40 working days before it starts.

An authorised CASP must have its registered office in a Member State where it actually provides some of its services, its place of effective management in the EU, and at least one director resident in the EU.

A licence is not all-or-nothing. MiCA lists ten crypto-asset services, and each firm is authorised for specific ones:

a. custody and administration of crypto-assets for clients
b. operating a trading platform for crypto-assets
c. exchanging crypto-assets for funds (euros, for example)
d. exchanging crypto-assets for other crypto-assets
e. executing orders for clients
f. placing crypto-assets
g. receiving and transmitting orders for clients
h. giving advice on crypto-assets
i. portfolio management
j. transfer services for crypto-assets

If you buy BTC or ETH with euros and leave them on the app, look for custody (a) and exchange for funds (c) at least. If the service you use is not on the firm's list, the licence does not cover it.

The ESMA register: the one list for the whole EU

The European Securities and Markets Authority (ESMA) publishes the central list. It is called the interim MiCA register, and it is not a search page: it is a set of CSV files you download from ESMA's MiCA page and open in a spreadsheet. ESMA says it aims to update the files weekly, so a firm authorised a few days ago may appear in its national regulator's list first. The version we used for this guide was dated 22 October 2026. ESMA had said the register would move into its IT systems around mid-2026; as of late October 2026 it is still published as CSV files.

There are five files. Two matter for this check:

Authorised CASPs (CASPS.csv): every firm authorised under Article 63 or notified under Article 60. In the 22 October 2026 version it held about 380 firms, two of them with a withdrawal date.
Non-compliant entities (NCASP.csv): firms a national regulator has flagged for providing crypto services without the required authorisation. It held 178 entries, 169 of them from Italy's CONSOB. Many are websites rather than companies, and some use addresses that imitate known brands.

The other three files list crypto-asset white papers and issuers of stablecoin-type tokens. They are about tokens, not about the firm you trade with.

How to read a register entry

These are the columns of the authorised CASPs file and what each one tells you.

Column	What it means	What to check
Competent Authority	The national regulator that granted the licence	That it is a real EU regulator, and the one the firm names on its website
Home Member State	The country of that regulator	That it matches the country in your contract
Name of the CASP	The legal name of the licensed company	That it is exactly the company in your terms of service, not a sister company
LEI of the CASP	A 20-character Legal Entity Identifier	Look it up for free in GLEIF's index to confirm the name and address
Commercial name	The brand the firm trades under	A brand can be shared by several companies; this field alone proves nothing
Website of the CASP / of the trading platform	The official web address	That the address in your browser is exactly this one
Date of the authorisation	When the licence was granted	That it is a real date in the past
Date of the withdrawal	When the licence ended, if it did	Must be blank
List of crypto-asset services	The services (a to j) the firm may offer	That the service you use is on the list
Member States where the CASP intends to provide the service	Where it has passported each service	That your country is on the list for that service
Legal basis	Article 63 (CASP authorisation) or Article 60 (notification)	Either is valid; many rows leave it blank

The file has one row per service, so a firm usually appears on several rows. Read all of them before you decide what it is allowed to do.

National registers

Every EU country has a competent authority that grants the licences, and ESMA's register names it for each firm in the Competent Authority field. If the regulator's own website tells a different story from ESMA's files, ask the regulator. The joint warning of the three European supervisors also points to IOSCO's I-SCAN list, which gathers warnings from regulators worldwide.

The transitional period is over

MiCA has applied in full since 30 December 2024. Article 143(3) let firms that were already legally providing crypto services under national law carry on until they were authorised or refused, or until 1 July 2026, whichever came first. Each country could shorten that window. ESMA's list of national choices showed 18 months in many countries, 12 in others such as Ireland, Spain and Austria, and six months in countries such as the Netherlands and Poland. ESMA noted that some of those periods were not yet in national law when the list was published.

On 17 April 2026 ESMA confirmed that the transitional period would expire across the EU on 1 July 2026, and that any firm serving EU clients without a MiCA licence after that date is in breach of EU law and must stop. On 23 June 2026 it added that some significant providers serving EU clients under national regimes might not be authorised in time, and that unauthorised firms must stop onboarding and marketing and limit themselves to letting clients sell, transfer or close positions. In Belgium, the FSMA said that no CASP held a licence granted by the FSMA at the time of its notice, which shows why passporting, below, matters.

Passporting: one licence, many countries

A CASP licensed in one Member State can serve the others without a second licence. Under Article 65 it notifies its home regulator of the countries, the services and the start date. The regulator passes this on to the host countries, ESMA and the EBA within 10 working days, and the firm may start once it is told this has been done, or at the latest on the 15th calendar day after it notified.

That is why the register column with country codes matters. A firm does not have to passport every service to every country, so check your country against the service you use.

How to check an exchange, step by step

Open the exchange's terms of service and write down the exact legal name of the company you contract with, and its country.
Download the authorised CASPs file from ESMA's MiCA page and search it for that legal name, not the brand.
Copy the LEI from the row and look it up in GLEIF's free index. The name and address should match your contract.
Check that the date of withdrawal is blank and that the service you use is listed, with your country in the passport column.
Compare the website in the register with the address in your browser, character by character.
Search the non-compliant entities file and your national regulator's warnings for the brand and the web address.
If anything does not match, ask the exchange which entity serves you, and confirm the answer with the regulator before you deposit.

Whether you hold BTC, ETH or a stablecoin, the check is about the firm that holds them for you, not about the coin.

Red flags

What you see	Why it matters
"Licensed in the EU", but the licensed company is not the one in your contract	ESMA says MiCA protections apply only to the specific authorised EU legal entity, not to other companies in the same group or to non-EU entities
A national registration from before MiCA, often called a VASP registration	Several countries ran registers of virtual asset service providers before MiCA; Italy's, for example, was an anti-money-laundering register. Since 1 July 2026 that is not enough to serve EU clients
A licence for some services, but you use another	Firms can be authorised for only part of their activities
A website one letter away from the register entry	Fraudsters claim to be authorised when they are not; the register lists the official address
A non-EU firm that "accepts EU clients"	Outside the narrow reverse solicitation exception, non-EU firms may not provide MiCA services to EU clients or solicit them
A brand on the non-compliant list	A regulator has already found it operating without authorisation

What MiCA does not protect

A licence brings real rules. Under Article 70, a CASP that holds your crypto must protect your ownership rights, especially if it becomes insolvent, and may not use your crypto for its own account. Client money other than e-money tokens must be placed with a bank or central bank by the end of the next business day, in an account kept separate from the firm's own. There are also capital requirements and complaint procedures.

But there are clear limits:

No compensation scheme. The three European supervisors state that MiCA protections are less extensive than for traditional financial products and that you will not benefit from compensation schemes. MiCA itself requires firms that give crypto advice or manage portfolios to warn clients that crypto-assets are not covered by investor compensation or deposit protection schemes. Coins at an exchange are not a bank deposit.
No protection from price falls. A licensed firm can still sell you something that loses most of its value. The licence is about how the firm behaves, not about what you buy, and it says nothing about tokens no licensed exchange lists.
Not every product. MiCA does not apply to crypto-assets that qualify as financial instruments. Perpetual futures, and the funding rate that comes with them, are derivatives and are not among the ten MiCA services, so a CASP licence alone does not tell you a firm may offer them to you.
Not funds. A MiCA check tells you nothing about exchange-traded products. The spot ETFs are a US product, approved by the US SEC in January 2024 and outside MiCA altogether.
Not your own keys. If you move coins to a self-hosted wallet, MiCA no longer stands between you and a lost key. The supervisors warn that losing private keys means permanent loss of access.

FAQ

How do I know if a crypto exchange is MiCA licensed?

Find the legal name of the company in your contract, then look for it in the authorised CASPs file of ESMA's interim MiCA register, or in your national regulator's list. Check that there is no withdrawal date, that the service you use is listed and that your country is in the passport column.

Is there a list of MiCA licensed exchanges?

Yes. ESMA publishes the authorised CASPs as a downloadable CSV file on its MiCA page. In the 22 October 2026 version it held about 380 firms, including banks and investment firms that notified their regulator instead of applying for a CASP licence. Not all of them are exchanges.

Can an exchange without a MiCA licence still serve EU clients?

Not since 1 July 2026. ESMA expects unauthorised firms to wind down, stop taking on EU clients and only let existing clients sell, transfer or close positions. A non-EU firm may only serve you if you approached it entirely on your own initiative, a narrow exception.

Does a MiCA licence protect my deposits like a bank?

No. There is no compensation scheme for crypto held at a CASP. MiCA requires the firm to keep your crypto and money separate from its own and to protect your ownership if it fails, which helps, but it is not a safety net that pays you back.