The MiCA CASP registry: what it is, how to read it, and why authorisation status matters

This article is for informational purposes only and does not constitute legal advice. Consult a qualified legal professional for advice specific to your situation.

The MiCA registry is the authoritative source for verifying whether a crypto-asset service provider is legally permitted to operate in the EU. It lists every CASP authorised under Regulation (EU) 2023/1114 across EEA member states, sourced from national competent authority data. For current data on authorised providers and their distribution across jurisdictions, see the MiCA CASP registry.
Authorisation under MiCA is a legal prerequisite for providing crypto-asset services in the EU, not a quality signal. A firm providing crypto-asset services in the EEA without valid MiCA authorisation is operating unlawfully, regardless of its global reputation, trading volumes, or prior registration under transitional arrangements. Engaging with an unauthorised provider does not transfer liability away from the client.
The registry records what a CASP is authorised to do, not just that it is authorised. A firm authorised to operate a trading platform is not automatically authorised to hold client assets in custody or provide portfolio management. Checking that a provider is in the registry is necessary but not sufficient; checking the scope of its authorisation is equally important.
Passporting allows a CASP authorised in one EEA member state to provide services across the entire EEA. A CASP that has notified its home regulator of its intention to passport into your jurisdiction has a legal basis to serve you there. One that has not done so does not, regardless of whether its home state authorisation is entirely valid.
Authorisation status changes. Licences are withdrawn, surrendered, and subject to supervisory conditions. The registry reflects current status; a firm that was authorised when you engaged with it may not be authorised now. Periodic re-verification is basic counterparty due diligence for anyone transacting with crypto-asset service providers.

What MiCA created and why the registry exists

The Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114, MiCA) entered into full application on 30 December 2024. It is the first comprehensive EU-wide framework for regulating crypto-asset service providers, replacing the patchwork of national regimes that preceded it and establishing a single authorisation passport that covers all 30 EEA member states.

Before MiCA, a firm seeking to provide crypto-asset services across the EU had to navigate up to 30 different national frameworks, with different definitions, different authorisation requirements, and different supervisory relationships. Some member states had established detailed licensing regimes; others had none. The result was regulatory arbitrage, uneven consumer protection, and a market in which the legal status of any given provider depended entirely on which jurisdiction you looked from.

MiCA resolves this by establishing a single regulatory category, the crypto-asset service provider, with a defined list of regulated services, uniform authorisation requirements, and a passporting mechanism that mirrors the one long established for investment firms under MiFID and payment institutions under PSD2. National competent authorities authorise CASPs in their home member state, report those authorisations to ESMA, and ESMA maintains a public central registry of all authorised entities across the EEA.

The registry exists because the EU legislature recognised, as it did for payment services and investment services before, that a single market for crypto-asset services requires a single, publicly accessible source of truth about who is permitted to provide those services. The registry is that source of truth. It is also, for anyone conducting counterparty due diligence on a crypto-asset service provider, the only reliable one.

📋

See which firms are authorised to provide crypto-asset services in the EU: The MiCA CASP registry lists all authorised crypto-asset service providers across all EEA countries, including their home state, authorised services, and passporting coverage.

The services a CASP is authorised for matter

MiCA defines ten categories of crypto-asset service, from custody and trading platform operation through to portfolio management and advice. The full scope of what MiCA covers and who it applies to is set out in What is MiCA and who does it affect?; the point to understand for registry purposes is that each category requires separate authorisation.

The MiCA registry does not simply record whether a firm is authorised or not. It records what that firm is authorised to do. A firm authorised to operate a trading platform is authorised to match buyers and sellers of crypto-assets. It is not automatically authorised to hold client assets in custody, to provide portfolio management, or to offer crypto-asset advice. A CASP's licence may cover one service category, several, or all of them depending on what it applied for and what its national competent authority granted.

This is directly analogous to the position under MiFID for investment firms, where a firm authorised to execute orders on behalf of clients is not thereby authorised to manage portfolios or provide investment advice. A blanket licence to "do crypto" is not what MiCA creates.

When verifying a CASP's authorisation, the relevant questions are: is this firm in the registry, and is the specific service you are using, or that this firm is marketing to you, within the scope of what it is authorised for? A firm that is in the registry but is providing a service outside its authorised scope is operating outside its licence for that service, with the same legal implications as if it had no licence at all.

How passporting works under MiCA

A CASP authorised in its home member state can provide services across the EEA through MiCA's passporting mechanism, without seeking separate authorisation in each host member state. The process requires the CASP to notify its home NCA of its intention to provide services in one or more other member states, specifying the services it intends to provide and the member states concerned. The home NCA transmits that notification to the relevant host NCAs, and the CASP may commence activities in the host member state within a defined period unless the host NCA raises objections within its competence.

Passporting is the mechanism that makes MiCA a single market framework rather than a harmonised national licensing regime. A firm authorised in Ireland or Lithuania can lawfully serve clients in France, Germany, the Netherlands, and every other EEA member state without those clients needing to verify separate local authorisations in each case.

The practical implication for due diligence is the same as under PSD2: a CASP's home state authorisation is valid EEA-wide only where it has completed the passporting notification for the relevant host member state and the relevant services. A CASP that is authorised in its home state but has not passported into your member state has no MiCA legal basis to provide services to you there.

The registry is the place to check passporting coverage. A verification of home state authorisation without also checking passporting status is an incomplete verification for clients in any member state other than the CASP's home state.

The geography of MiCA authorisation

The MiCA registry currently lists around 350 authorised CASPs across the EEA. That number is expected to grow as the transitional period winds down and firms that previously operated under national transitional arrangements either obtain MiCA authorisation or exit the market.

The distribution across member states reflects the location of existing crypto-asset businesses, the efficiency of national competent authorities in processing MiCA applications, and deliberate decisions by firms to establish EU operations in jurisdictions perceived as more accessible or responsive.

Germany accounts for a significant share of authorised entities, with a notably large cluster of cooperative and regional banks, Volksbanken and Raiffeisenbanken, alongside specialist crypto firms and established financial institutions. This reflects BaFin's prior crypto custody licensing regime, which gave German-supervised institutions a head start in building the compliance infrastructure MiCA requires, and the willingness of Germany's established banking sector to move into crypto-asset services under a regulated framework.

Malta has a concentration of authorised CASPs disproportionate to its size. The Malta Financial Services Authority was among the first EEA regulators to develop a crypto licensing framework, and a number of the firms now holding MiCA authorisation in Malta operated under its predecessor Virtual Financial Assets regime.

Cyprus features prominently, including several entities that have transitioned from CySEC registration under prior national frameworks. Luxembourg hosts a cluster of institutions including Bitstamp, Coinbase, and several asset managers and banks, reflecting the jurisdiction's established role in EU financial market infrastructure.

France has a notable concentration of pure-play crypto firms authorised under MiCA, building on AMF's prior PSAN registration regime. Liechtenstein, despite being a small EEA member state, hosts a number of authorised CASPs including several Swiss-headquartered firms that have established EU entities there to access the EEA passport.

Transitional arrangements and what they mean for the registry

MiCA's full application date of 30 December 2024 did not mean that every firm providing crypto-asset services in the EU immediately either held MiCA authorisation or ceased operating. The regulation includes transitional provisions allowing firms that were providing crypto-asset services in a member state under applicable national law before 30 December 2024 to continue doing so for a limited period while their MiCA authorisation application is processed, subject to member state discretion on the length of the transitional period (up to 18 months).

This means the registry does not represent a complete picture of all firms currently providing crypto-asset services in the EU. Some firms operating under transitional arrangements are not yet in the registry because their MiCA authorisation has not yet been granted. Others will never appear in the registry because they will not successfully obtain MiCA authorisation and will exit the market.

A firm's absence from the registry during the transitional period does not automatically mean it is operating unlawfully; it may be operating under a valid national transitional arrangement. But the transitional period has an end date, and firms that have not obtained MiCA authorisation by the time their transitional cover expires will no longer have a legal basis to provide services. As the transitional period concludes across member states, the registry will increasingly become the definitive and exhaustive list of lawfully operating CASPs in the EU.

For due diligence conducted from late 2025 onwards, the transitional caveat becomes progressively less relevant. A firm not in the registry and not covered by a documented transitional arrangement is operating without a legal basis.

What authorisation means for client protections

The detail of what MiCA authorisation requires of CASPs (capital requirements, safeguarding, wind-down planning, conduct obligations) is covered in MiCA CASP authorisation requirements. The point for registry purposes is simpler: these protections exist only where the CASP is properly authorised. An unauthorised provider is not subject to any of them.

If an unauthorised provider fails, client assets may be commingled with the firm's own assets, segregation may not exist, and there is no regulatory framework governing the return of those assets in an insolvency. The collapse of several large unregulated crypto platforms in 2022 and 2023 demonstrated precisely what this means in practice: client funds became claims in insolvency proceedings rather than segregated assets to be returned. MiCA's authorisation requirements are a direct regulatory response to those failures.

How to verify a crypto-asset service provider before engaging

Search by legal entity name. Many crypto-asset businesses operate consumer-facing brands that differ significantly from their registered legal entity name. Coinbase's EEA entity is Coinbase Luxembourg S.A. The firm's own terms and conditions, regulatory disclosures, and the "about" section of its user agreement should identify the legal entity name and home state.

Check what the firm is authorised for. Confirm not just that the entity appears in the registry but which specific crypto-asset services it is authorised to provide. A firm authorised to operate a trading platform that is also offering custody or portfolio management may be providing those additional services outside the scope of its authorisation.

Check passporting coverage. If you are in a member state other than the CASP's home state, confirm that it has passported into your jurisdiction. An entity that has not completed the passporting notification for your member state does not have a MiCA legal basis to serve you there.

Confirm current authorisation status. Licences can be withdrawn, suspended, or made subject to conditions. The registry reflects current status; a verification conducted at account opening does not remain valid indefinitely, particularly for larger or ongoing relationships.

Note the competent authority. Complaints, disputes, and regulatory concerns involving a CASP are primarily directed to its home state NCA: BaFin for German-authorised entities, AMF for French entities, MFSA for Malta, CBI for Ireland, CySEC for Cyprus. The registry entry identifies the home state.

MiCA in context

MiCA does not operate in isolation. It sits alongside the revised Transfer of Funds Regulation (which extends travel rule requirements to crypto-asset transfers), DORA (which applies operational resilience requirements to CASPs), and the EU AML framework. A CASP holding MiCA authorisation is not thereby compliant with all of these; MiCA authorisation establishes the licence to provide the relevant services, and compliance with travel rule, AML/CFT, and operational resilience obligations is a separate matter.

For a broader overview of EU financial regulation in which MiCA sits, see EU financial regulation in 2026. For the specific requirements that CASP authorisation entails, see MiCA CASP authorisation requirements. For ongoing developments in MiCA implementation and enforcement, see MiCA compliance deadline tracker.

Forseti monitors EU financial regulation continuously and delivers personalised impact analysis anchored to verified official sources. Start for free.