MiCA CASP list

Every entry comes from the file of authorized crypto-asset service providers in the interim MiCA register, last updated on 16 October 2026 and downloaded on 18 October 2026. National authorities report their decisions to ESMA, and ESMA publishes the file about once a week, so a new authorization can appear in a national register days or weeks earlier.

The national registers are authoritative for the license status of a firm, for example the BaFin database for Germany. ESMA itself grants no CASP license, and its file is a compilation that lags behind the decisions of the national authorities.

Three gaps in the ESMA file matter when reading the entries. The legal basis field is empty for 173 entries from 19 home states, the Italian dates have no year, and three German notifications carry dates after the update of 16 October 2026, which mark the start of the notified services.

An entry under Article 63 means that a national authority authorized the firm as a CASP after a full application, the route described under CASP license. The register shows 75 such authorizations, including those of Bitvavo and MoonPay in the Netherlands and BitGo in Germany.

An entry under Article 60 means that a firm with an existing license, such as a bank, an investment firm, a central securities depository or an e-money institution, notified its supervisor before offering crypto-asset services. The rules for that route are set out under MiCA Article 60, and the register marks 128 entries this way.

The basis column shows "not stated" for the 173 entries where the ESMA file leaves the field empty, mostly in France, Cyprus, Malta, Ireland and Luxembourg. The national register of the authority named for each home state settles the question for those entries.

MiCA lists ten crypto-asset services, and the services column uses their letters from Article 3(1)(16) of the regulation:

• a: custody and administration of crypto-assets for clients
• b: operation of a trading platform for crypto-assets
• c: exchange of crypto-assets for funds
• d: exchange of crypto-assets for other crypto-assets
• e: execution of orders for clients
• f: placing of crypto-assets
• g: reception and transmission of orders
• h: advice on crypto-assets
• i: portfolio management on crypto-assets
• j: transfer services for clients

The countries column counts the EU and EEA states in which the firm intends to offer at least one service, as the ESMA file lists them. A count near 30 means a firm uses the MiCA passport across the whole market, while 1 usually means the home state only.

The 376 active entries come from 27 of the 30 EU and EEA states, and Poland has none because it had no law naming a MiCA authority, as described under MiCA in Poland. Germany has the most entries, while Iceland, Portugal and Sweden have one entry each.

The Federal Financial Supervisory Authority (BaFin) is the competent authority for all 109 entries with Germany as home member state. The register marks 8 entries as authorizations under Article 63 and 101 entries as notifications under Article 60 by already licensed financial firms. Most notifications come from Volksbanken and Raiffeisenbanken, and 56 cooperative banks each notified order execution for their own customers.

The Autorité des Marchés Financiers (AMF) is the competent authority for all 36 entries with France as home member state. The ESMA file leaves the legal basis empty for every entry from this home state, so the national register shows whether a firm was authorized or notified.

The Netherlands Authority for the Financial Markets (AFM) is the competent authority for all 28 entries with the Netherlands as home member state. The register marks 21 entries as authorizations under Article 63 and 7 entries as notifications under Article 60 by already licensed financial firms.

The Cyprus Securities and Exchange Commission (CySEC) is the competent authority for all 24 entries with Cyprus as home member state. The ESMA file leaves the legal basis empty for every entry from this home state, so the national register shows whether a firm was authorized or notified.

The Malta Financial Services Authority (MFSA) is the competent authority for all 23 entries with Malta as home member state. The register marks one entry as notifications under Article 60 and leaves the legal basis empty for 22 entries.

The Comision Nacional del Mercado de Valores (CNMV) is the competent authority for all 16 entries with Spain as home member state. The register marks 10 entries as authorizations under Article 63 and 6 entries as notifications under Article 60 by already licensed financial firms.

The Commission de Surveillance du Secteur Financier (CSSF) is the competent authority for all 13 entries with Luxembourg as home member state. The register marks one entry as notifications under Article 60 and leaves the legal basis empty for 12 entries.

The Austrian Financial Market Authority (FMA) is the competent authority for all 12 entries with Austria as home member state. Every entry from this home state is an authorization under Article 63, granted to a firm that applied for a CASP license.

The Czech National Bank (CNB) is the competent authority for all 12 entries with the Czech Republic as home member state. The register marks 11 entries as authorizations under Article 63 and one entry as notifications under Article 60 by already licensed financial firms.

The Central Bank of Ireland (CBI) is the competent authority for all 12 entries with Ireland as home member state. The ESMA file leaves the legal basis empty for every entry from this home state, so the national register shows whether a firm was authorized or notified.

The Latvijas Banka is the competent authority for all 12 entries with Latvia as home member state. The ESMA file leaves the legal basis empty for every entry from this home state, so the national register shows whether a firm was authorized or notified.

The Finanzmarktaufsicht (FMA) is the competent authority for all 12 entries with Liechtenstein as home member state. The register marks 6 entries as authorizations under Article 63 and 6 entries as notifications under Article 60 by already licensed financial firms.

The Commissione Nazionale per le Societa e la Borsa (CONSOB) is the competent authority for all 10 entries with Italy as home member state. The ESMA file leaves the legal basis empty for every entry from this home state, so the national register shows whether a firm was authorized or notified. The ESMA file gives the Italian dates without a year, and CONSOB announcements and company releases place all ten entries in 2026.

Two authorities report for Croatia: the Croatian Financial Services Supervisory Agency (HANFA) for 5 entries and the Croatian National Bank for one entry. The ESMA file leaves the legal basis empty for every entry from this home state, so the national register shows whether a firm was authorized or notified.

The Finanstilsynet is the competent authority for all 6 entries with Denmark as home member state. The ESMA file leaves the legal basis empty for every entry from this home state, so the national register shows whether a firm was authorized or notified.

The Bank of Lithuania (LSC) is the competent authority for all 6 entries with Lithuania as home member state. The register marks 2 entries as notifications under Article 60 and leaves the legal basis empty for 4 entries. Newrails and Blue EMI issue their own e-money tokens and provide custody or transfer services for those tokens under Article 60(4).

The Norwegian Financial Supervisory Authority (Finanstilsynet) is the competent authority for all 6 entries with Norway as home member state. The ESMA file leaves the legal basis empty for every entry from this home state, so the national register shows whether a firm was authorized or notified.

The National Bank of Slovakia (NBS) is the competent authority for all 6 entries with Slovakia as home member state. The ESMA file leaves the legal basis empty for every entry from this home state, so the national register shows whether a firm was authorized or notified.

The Financial Supervision Commission (FSC) is the competent authority for all 5 entries with Bulgaria as home member state. The register marks 4 entries as authorizations under Article 63 and one entry as notifications under Article 60 by already licensed financial firms.

The Finanssivalvonta (FIN-FSA) is the competent authority for all 5 entries with Finland as home member state. The ESMA file leaves the legal basis empty for every entry from this home state, so the national register shows whether a firm was authorized or notified.

The Securities Market Agency (ATVP) is the competent authority for all 5 entries with Slovenia as home member state. The ESMA file leaves the legal basis empty for every entry from this home state, so the national register shows whether a firm was authorized or notified.

Two authorities report for Greece: the Hellenic Capital Market Commission (HCMC) for 3 entries and the Bank of Greece for one entry. The register marks 3 entries as authorizations under Article 63 and one entry as notifications under Article 60 by already licensed financial firms.

The Estonian Financial Supervision Authority (EFSA) is the competent authority for all 3 entries with Estonia as home member state. The ESMA file leaves the legal basis empty for every entry from this home state, so the national register shows whether a firm was authorized or notified.

The National Bank of Belgium (NBB) is the competent authority for all 2 entries with Belgium as home member state. The register marks one entry as notifications under Article 60 and leaves the legal basis empty for one entry. The file gives no date for the KBC entry, and BNY could start its crypto-asset services in July 2026 after the NBB confirmed its file as complete.

The Central Bank of Iceland is the competent authority for the one entry with Iceland as home member state. The ESMA file leaves the legal basis empty for every entry from this home state, so the national register shows whether a firm was authorized or notified.

The Banco de Portugal is the competent authority for the one entry with Portugal as home member state. The ESMA file leaves the legal basis empty for every entry from this home state, so the national register shows whether a firm was authorized or notified.

The Finansinspektionen is the competent authority for the one entry with Sweden as home member state. The ESMA file leaves the legal basis empty for every entry from this home state, so the national register shows whether a firm was authorized or notified.

ESMA keeps a withdrawn authorization in the file and adds the end date, and two entries carry one. The AFM authorized Decubate B.V. on 31 July 2025, and the authorization ended on 26 March 2026 after the firm asked for its revocation.

Stratos Europe Ltd, trading as Tradu, entered the register through CySEC on 14 October 2025 and shows an end date of 24 April 2026. Neither firm is counted among the 376 active entries, because neither holds a MiCA authorization today.

The same ESMA register has a separate file of non-compliant entities, which held 178 names on 16 October 2026. These are firms that national authorities found offering crypto-asset services without the required authorization, and 169 of the names come from orders of the Italian CONSOB.

A firm on that list holds no MiCA license, and none of those names appear among the authorized and notified companies. The end of the grace period for older national registrations is described under MiCA transitional period.

Finance Loop discussed MiCA compliance with Bybit EU, which the Austrian FMA authorized on 28 May 2025, at the Bybit EU Crypto Evening in Frankfurt. Mykolas Majauskas, Senior Director of Policy at Bybit EU, was a speaker at TechQuartier on regulation under MiCAR.

EBS Executive School and the law firm HEUKING run a MiCAR certificate program for compliance officers who want a structured course, and Finance Loop lists it among its education offers.

MiCA licensed companies in Germany fall into two groups in the register: BaFin authorized 8 firms under Article 63, and 101 banks and investment firms notified it under Article 60. The authorized firms are Boerse Stuttgart Digital Custody, Bitpanda Asset Management, Crypto Finance, BitGo, Tangany, Bullish, Hauck Aufhäuser Digital Custody and Tradevest Digital Assets, and the national rules are set out under MiCA rules in Germany.

The ESMA register counted 378 entries on 16 October 2026, of which 376 were active and two had ended. By date, 4 entries fall in 2024, 148 in 2025 and 225 in 2026, and the file marks 75 entries as Article 63 authorizations and 128 as Article 60 notifications.

A crypto exchange in the strict MiCA sense operates a trading platform, which is service b, and 22 entries list it, among them OKX, Bitvavo, Bitstamp, Kraken, Revolut and Gate. Many brokers and apps reach customers through the exchange services c and d instead, and the larger names are compared under European crypto exchanges.

Revolut appears through Revolut Digital Assets (Europe) Ltd, entered by CySEC on 20 October 2025, and Kraken through two Payward entities entered by the Central Bank of Ireland on 25 June 2025. Binance has no entry in the file of 16 October 2026, and MEXC appears only on the list of non-compliant entities, flagged by the Dutch AFM.

A MiCA license lookup starts with the legal entity named in the contract or the app imprint, because one brand often runs several companies. Search that entity in the ESMA file, check the service letters and the countries, then confirm the status in the register of the national authority.