MiCA license

MiCA defines a crypto-asset service provider in Article 3(1)(15) as a legal person whose business is the provision of crypto-asset services to clients on a professional basis, and Article 3(1)(16) lists the services: custody and administration, operation of a trading platform, exchange of crypto-assets for funds or for other crypto-assets, execution of orders, placing, reception and transmission of orders, advice, portfolio management and transfer services. The license names the services a firm may provide, so an entry for custody and transfers does not permit an order book. The application route under Articles 59 and 63 is described under CASP license, with the three capital classes of 50,000, 125,000 and 150,000 euros.

A bank, an investment firm, an e-money institution or a central securities depository does not apply for a MiCA license. Under Article 60 such a firm notifies its supervisor at least 40 working days before the first service and may then provide the services that match its existing license, which MiCA Article 60 explains. The ESMA file marks both routes: on 22 October 2026 it held 75 authorizations under Article 63 and 136 notifications under Article 60, and it left the field empty for the rest.

The license comes from the national competent authority of the home member state, never from ESMA. In Germany that is BaFin, in France the AMF, in the Netherlands the AFM, in Austria the FMA, in Luxembourg the CSSF, in Cyprus CySEC, in Malta the MFSA and in Ireland the Central Bank of Ireland. The authority checks the application against the technical standards under Article 62, confirms completeness within 25 working days and decides within 40 working days of a complete file, although BaFin took more than 15 months over the application of futurum bank, the operator of bitcoin.de, before it refused the license in October 2026.

ESMA, the European Securities and Markets Authority, collects the decisions of the national authorities in its interim register and publishes the file about once a week. A license granted in one state is valid in all others after a passport notification under Article 65, so Kraken serves German clients with an Irish license and OKX with a Maltese one. The European Commission proposed on 4 December 2025 to move the supervision of all CASPs to ESMA, which would end the choice of home state if the Parliament and the Council adopt it.

Before MiCA, a crypto firm held a national permission, such as the German crypto custody license under the Banking Act or the French PSAN registration. Article 143(3) let such a firm keep working for up to 18 months after 30 December 2024, and each state chose its own deadline: Germany ended the period on 31 December 2025 under section 50 of the KMAG, the Netherlands on 1 July 2025, and Luxembourg, Cyprus and Poland on 1 July 2026, as MiCA transitional period lists by country. ESMA wrote in its statement of 17 April 2026 that after 1 July 2026 any entity serving EU clients without a MiCA license breaks EU law and must cease those services.

A national permission therefore no longer counts as a MiCA license, and a firm that failed to obtain one had to wind down or hand its clients to an authorized provider. BaFin confirmed in a notice of 8 July 2026 (in German) that only licensed providers may offer crypto-asset services in the EU and asked licensed CASPs to check clients who move over from unlicensed platforms. Binance had no entry in the ESMA file of 22 October 2026, and bitcoin.de paused its trading on 12 June 2026 before its operator announced the refusal (in German) on 6 October 2026.

Finance Loop discussed compliance under MiCAR with Bybit EU, which has held a MiCA license from the Austrian FMA since 28 May 2025, at the Bybit EU Crypto Evening at TechQuartier in Frankfurt, where Mykolas Majauskas, Senior Director of Policy at Bybit EU, spoke on regulation. MiCAR and custody were topics of the Forum für Digitale Vermögenswerte, a German-language forum with Finance Loop as a partner. Compliance officers who want a structured course find the MiCAR certificate program of EBS Executive School and HEUKING in the Finance Loop education listings.

Among the exchanges in the ESMA register of 22 October 2026 are Kraken through Payward Europe Solutions in Ireland, OKX through OKX Europe in Malta, Coinbase through Coinbase Luxembourg, Crypto.com through Foris DAX MT in Malta, Bybit EU and KuCoin EU in Austria, Bitpanda in Austria and Germany, Bitvavo in the Netherlands and Gemini in Malta. Binance has no entry in that file, and the brand on an app is often a different company from the licensed entity, which European crypto exchanges compares in detail.

Cyprus had 25 entries in the ESMA register on 22 October 2026, Malta 23, Luxembourg 13 and Latvia 12, against 117 for Germany, 36 for France and 29 for the Netherlands. Cyprus and Malta attract brokers and trading platforms that passport across the EU, among them eToro, Trading 212 and Revolut in Cyprus and OKX, Crypto.com and Blockchain.com in Malta, while the Luxembourg entries include Coinbase, Bitstamp and Clearstream. The country pages crypto in Cyprus, crypto in Malta and MiCA in Luxembourg describe each regime.

Start with the legal entity named in the contract or in the imprint of the app, because one brand often runs several companies and the MiCA protection applies only to the authorized EU entity. Search that entity in the CASP file of the ESMA interim register, read the service letters and the countries of the entry, and confirm the status in the register of the national authority, in Germany the company database of BaFin. The files and the national registers are described under MiCA register, and every entry of 22 October 2026 is sorted by country in the MiCA CASP list.

An applicant files the form of Implementing Regulation (EU) 2025/306 with the content of the technical standards under Article 62: the program of operations, the governance and the management, the controls against money laundering, the IT setup under DORA, the complaints process and, for custody, the segregation of client assets. The minimum capital is 50,000 euros for advice, order execution or transfers, 125,000 euros for custody or exchange and 150,000 euros for a trading platform, or one quarter of the fixed overheads of the previous year when that is higher. BaFin charges a fee by the time spent, asks for an introductory meeting with its unit ZK 4 before the filing, and rejects a file that stays incomplete after a four-week deadline, as its page on crypto-asset services (in German) sets out.

In Germany the Kryptomärkteaufsichtsgesetz, described under KMAG, names BaFin as the competent authority for the license, and MiCA in Germany covers the national rules. The ESMA register of 22 October 2026 showed 117 entries with Germany as home state: eight MiCA licenses under Article 63, held by Boerse Stuttgart Digital Custody, Bitpanda Asset Management, Crypto Finance (Deutschland), BitGo Europe, Tangany, Bullish Europe, Hauck Aufhäuser Digital Custody and Tradevest Digital Assets, and 109 notifications by banks and investment firms, from Trade Republic and DZ BANK to dozens of Volksbanken. The German transitional period ended on 31 December 2025, so a firm with the old custody license under the Banking Act needs one of these two routes today.