Licensed Crypto Exchanges in the EU: How to Check MiCA Authorisation

What counts as a licensed crypto exchange under MiCA?

MiCA does not define “crypto exchange”. Two of the crypto-asset services defined in Article 3(1)(16) cover what the term usually means: operating a trading platform for crypto-assets (Article 76) and exchanging crypto-assets for funds or other crypto-assets (Article 77).

Under Article 59(1), only two kinds of firm may provide these services in the Union:

• a legal person or other undertaking authorised as a crypto-asset service provider (CASP) under Article 63;
• a credit institution, central securities depository, investment firm, market operator, electronic money institution, UCITS management company or alternative investment fund manager that is allowed to provide crypto-asset services under Article 60.

An authorisation names the services it covers (Article 59(6)). A CASP that wants to add a service must ask the authority that granted its authorisation for an extension (Article 59(8)). An authorised CASP must have its registered office in a member state where it carries out part of its services, its place of effective management in the Union, and at least one director resident in the Union (Article 59(2)).

How many CASPs are authorised?

ESMA’s interim MiCA register listed 370 CASPs across the EEA on 7 October 2026. The file covers firms authorised under Article 63 and financial entities that notified under Article 60, so not every entry went through a CASP authorisation. Three points on reading that figure:

• It covers all crypto-asset services. Custodians, transfer-service providers, brokers and advisers sit in the same file as exchanges. To count exchanges, filter the services field.
• It can include Article 60 entities. The file records financial entities that provide crypto-asset services under Article 60 as well as CASPs authorised under Article 63.
• It changes. ESMA republishes the interim register at intervals. Quote the date with the number.

A firm’s home member state says little about where it operates. On 7 October 2026, 180 of the 370 had notified passporting into Poland, and none had Poland as home state.

We do not publish per-country counts. For the current figure in a member state, download the CASP file and filter by home member state. To see which CASPs have notified services into a member state, filter the host member state field.

How does authorisation work?

A firm applies to the competent authority of its home member state under Article 62. Article 63 sets the deadlines:

• acknowledgement of receipt within five working days (Article 63(1));
• completeness check within 25 working days of receipt (Article 63(2));
• a reasoned decision within 40 working days of receiving a complete application (Article 63(9));
• a request for further information, made no later than the 20th working day of that period, suspends the clock for up to 20 working days; later requests do not suspend it (Article 63(12)).

If no decision is taken within six months of an application that provides all the required information, the applicant can appeal to a court (Article 113(1)). Article 63(10) lists the grounds on which the authority must refuse. After granting authorisation, the authority sends the register details to ESMA within two working days (Article 63(13)).

Capital follows Article 67(1): the higher of the permanent minimum capital in Annex IV and one quarter of the previous year’s fixed overheads. Annex IV sets three classes:

Class	Services	Permanent minimum capital
Class 1	Execution of orders, placing, transfer services, reception and transmission of orders, advice, portfolio management	EUR 50,000
Class 2	Class 1 services plus custody and administration, and exchange of crypto-assets for funds or other crypto-assets	EUR 125,000
Class 3	Class 2 services plus operation of a trading platform for crypto-assets	EUR 150,000

A broker that exchanges crypto-assets for funds falls in class 2. A firm that runs a trading platform falls in class 3. For the full procedure, see the Article 63 authorisation deep dive.

How to verify a CASP’s authorisation

ESMA’s interim MiCA register is the EU-level record. ESMA publishes it as downloadable files on its MiCA page. Work through these steps:

1. Download the CASP file. Note the update date shown on ESMA’s page.
2. Search by legal name or LEI, not by brand. The file lists each CASP’s legal name, LEI, commercial name, address, website and, where relevant, the website of its trading platform.
3. Check the services. Each record lists the crypto-asset services covered. Confirm that the service you will use is there.
4. Check the member states. The file shows the home member state and the member states where the CASP intends to provide each service. Your country should be one of them.
5. Check the dates. The file shows the date of authorisation and, where relevant, of withdrawal. A withdrawal stays in the register for five years (Article 109(7)).
6. Cross-check with the home NCA. The file names the authority that granted authorisation. ESMA publishes the list of competent authorities designated under Article 93. Use it to find the NCA’s own register.
7. Check the non-compliant entities file and NCA warnings. ESMA’s file under Article 110 is non-exhaustive. Also check the warnings page of your own national authority.
8. Match the contracting entity. The terms of service name the legal entity you deal with. Make sure it is the one in the register.

What the register does not show

• Pending applications. Article 109(5) does not provide for them.
• Refusals. Authorities report refusals to ESMA (Article 63(13)), but the register contents in Article 109(5) do not include them.
• Fines. The NCA that imposed a fine publishes the decision on its own website (Article 114). The register does record withdrawals and certain suspension and prohibition measures under Article 94(1), and public precautionary measures under Article 102 (Article 109(6)).
• Article 85 significance. The CASP file has no field for it.
• Quality. Authorisation is a legal status. It says nothing about fees, security or service.

Exchange groups and brands

Authorisation attaches to a legal entity. A group trading under one brand may hold MiCA authorisation in one entity while other group entities serve other markets or offer other products. This page does not list exchange groups or their EU entities. The register is the authoritative record, and it changes with each update. Search it for the entity named in your terms of service.

Passporting and host-state oversight

A CASP that wants to provide services in other member states sends its home NCA a list of those states, the services, the starting date and its other activities (Article 65(1)). The home NCA passes the information to the host states’ single points of contact, ESMA and EBA within 10 working days (Article 65(2)). The CASP may start from the date it receives confirmation of that communication, or at the latest from the 15th calendar day after it submitted the information (Article 65(4)). It needs no physical presence in the host state (Article 59(7)).

Host authorities keep a role. Under Article 102, a host NCA with clear and demonstrable grounds to suspect irregularities notifies the home NCA and ESMA. If the irregularities persist and amount to an infringement, the host NCA can take measures to protect clients, including preventing further activity in its territory. For the operational side, see CASP passport in practice.

Significant CASPs (Article 85)

A CASP is significant if it has at least 15 million active users in the Union, on average over the previous calendar year (Article 85(1)). It notifies its NCA within two months of reaching that number. If the NCA agrees that the threshold is met, it notifies ESMA (Article 85(2)). The home NCA then gives ESMA’s Board of Supervisors annual updates on supervisory developments (Article 85(3)).

Significance does not move supervision. The home NCA remains the supervisor. MiCA gives ESMA no direct supervisory powers over significant CASPs. EBA’s direct supervisory role under Article 117 applies to issuers of significant asset-referenced tokens and e-money tokens, not to CASPs.

Pre-MiCA registrations

MiCA has applied since 30 December 2024. Firms that were providing services under national law before that date could rely on the Article 143(3) transitional period, which member states could shorten. Those periods have ended in every member state; the last closed on 1 July 2026. For the per-country dates, see the MiCA implementation status by country and VASP licence explained.

Practical takeaways

• Use the ESMA register, and quote its date. It is the EU-level record of authorisation. Exchange marketing is not.
• Check the entity and the service. Authorisation covers a named legal entity and a named list of services.
• Check the home NCA as well. It holds the authorisation, publishes enforcement decisions and may show changes before ESMA’s next update.

This page was revised on 24 October 2026. Earlier versions gave an unsourced EU-wide range and per-country counts of authorised CASPs; they have been replaced with ESMA’s dated figure and instructions for checking the register.

For corrections, updates, or counsel referrals on EU CASP authorisation, email [email protected].