The MiCA non-compliant entities register: what a listing means, and why absence is not clearance

This article is for informational purposes only and does not constitute legal advice. Consult a qualified legal professional for advice specific to your situation.

What the register is and where it sits in MiCA

The Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114, MiCA) was adopted on 31 May 2023, published in the Official Journal on 9 June 2023 and entered into force on 29 June 2023. Titles III and IV applied from 30 June 2024, and the rest of the regulation, including the Title VII provisions on ESMA's registers, applied from 30 December 2024. ESMA maintains an interim register, distributed as a set of files and updated on a regular basis. That interim register is the data source behind the MiCA non-compliant entities list.

Two articles sit side by side in that part of MiCA, and they are easy to conflate. Article 109 requires ESMA to keep registers of crypto-asset white papers, of issuers of asset-referenced tokens and e-money tokens, and of authorised crypto-asset service providers. Article 110 is the one that matters here. Because ESMA publishes the interim register as a bundle and describes the two articles together, it is natural to attribute the non-compliant list to Article 109. A reader who goes to the primary text to check will find it in Article 110, and it is worth citing accurately.

Article 110 requires ESMA to establish a non-exhaustive register of entities that provide crypto-asset services in breach of Article 59, the authorisation requirement, or Article 61, which governs services provided at the exclusive initiative of the client. The register must contain at least the commercial name or the website of the entity and the name of the competent authority that submitted the information. It must be publicly available in a machine-readable format and updated regularly to reflect changes of circumstances and information brought to ESMA's attention. ESMA can also add entries on its own initiative in two situations: where it has adopted an individual decision addressed to an entity under Article 17 of the ESMA Regulation, and where a supervisory authority in a third country supplies information about an entity providing services without the necessary authorisation. In practice those routes are exceptions, and entries predominantly name a national competent authority as their source. For how the reverse solicitation exemption in Article 61 works and where it fails, see The myth of reverse solicitation under MiCA.

A listing is a report, not a verdict

Article 110 creates a publication vehicle. The substantive powers sit elsewhere, mainly in Article 94, which sets out the minimum powers competent authorities must have, to be exercised in accordance with national law. Two of them are directly relevant to unauthorised providers. Where there is reason to assume that a person is providing crypto-asset services without authorisation, an authority can order the immediate cessation of the activity without prior warning or a deadline. And where no other effective means are available to stop an infringement and there is a risk of serious harm to clients, an authority can require content to be removed or access to an online interface to be restricted, order an explicit warning to be shown to visitors, instruct a hosting provider to disable a site, or require a domain registry or registrar to delete a domain name.

Notice what is not framed as a stand-alone power in that minimum list: publishing a warning about a person who is not authorised specifically. The power to make public that a firm has failed to meet its obligations is framed around authorised providers, offerors and token issuers. Public notices about unauthorised firms therefore rest, in practice, on a mix of these MiCA powers and whatever national law adds on top. That is one reason a listing in the register cannot be read as a uniform kind of act. It may sit on top of a blocking order in one country and a consumer notice in another, and the statutory minimum does not require the register to tell you which.

The threshold matters as well. A cessation order can rest on a reason to assume that unauthorised services are being provided, which is a lower bar than a finding of infringement after adversarial proceedings. A listing may therefore reflect an early administrative response rather than an adjudicated outcome. MiCA acknowledges that by requiring, in Article 113, that decisions taken by competent authorities be properly reasoned and subject to the right of appeal before a court. Article 110 in turn requires the register to be updated for changes of circumstances. The sensible way to describe an entry internally is as a regulator's position at a point in time, for example "reported to ESMA by the named authority in the register as of a given date", and not as a confirmed finding about the operator.

The identity data is thinner than many readers expect. Article 109 requires the register of authorised providers to carry the name, legal form and legal entity identifier of each provider. Article 110 requires only a commercial name or a website. A scan of the current list shows what that looks like. Many entries pair a short alphanumeric label with a single country-code domain. Others list a dozen parallel domains under one label, and some pair a label with domains that share no visible naming with it. The entry identifies a site or a trading label, not a verified legal person. Two consequences follow. Screening that relies on matching legal entity names will miss most of the list. And because entries are keyed to names and addresses, a listing about a site that imitates a genuine firm's brand says nothing against the genuine firm.

Why a small number of authorities supply the entries

The register is dominated by entries from a small number of national authorities; at the time of writing, the most recent ESMA update was dated 24 September 2026. MiCA applies across 30 EEA states, and the register's entries come from a limited number of national authorities rather than from all of them. Reading that distribution as a map of where unauthorised crypto activity is concentrated would be a mistake.

Part of the explanation is in the statute. Article 110 obliges ESMA to keep the register and update it as information comes to its attention, but it does not set a deadline, a format or a procedure that obliges national authorities to report every domestic measure. Whether an authority feeds the register is largely a matter of its own practice.

The other part is what CONSOB does. Its published press releases describe orders directing internet connectivity providers to block access from Italy to sites offering crypto-asset services without authorisation, adopted under MiCAR and Legislative Decree No 129 of 5 September 2024, Italy's national implementing decree, alongside separate powers dating from 2019 for unauthorised financial intermediaries generally. By its press release of 24 September 2026, CONSOB reported 1,829 sites blocked since July 2019 across all financial services, of which 235 concerned crypto-assets. The orders arrive in regular batches and are domain-specific by nature. An authority that issues domain-level decisions as routine business, and passes them on, will produce a register full of domain-level entries. The register does not record the type of measure behind an entry, so the link between CONSOB's blocking activity and its share of the list is an inference, but it is a consistent one.

The practical consequence is about the authorities that are silent. An authority that publishes national warnings or investor alerts does so through its own channels, and nothing in Article 110 makes the ESMA register the only place those notices appear. A firm targeting consumers in a member state whose authority does not report to the register can be unauthorised, and even the subject of a national warning, without ever appearing on the EU-level list. For anyone assessing a firm active in a specific country, the home authority's own warning pages are part of the check, and the ESMA register is a supplement to them.

What an absence does and does not tell you

Absence tells you very little, and the statute says so. The register is non-exhaustive by definition, which means it makes no claim to capture every entity that lacks authorisation. Absence is also weak evidence for a second reason: entries are tied to a specific trading label or address. An operator whose site has been blocked can reappear under a new domain, and the pattern of one label with many parallel domains in the current list shows how quickly addresses multiply. A name that is not on the list says nothing about whether the same operator is active under another.

The timeline has changed as well. Article 143 allowed member states to let firms that were already providing crypto-asset services under national law continue for a transitional period, with an outer limit of 1 July 2026 in Article 143(3). Member states could choose shorter periods, so the end date differed by jurisdiction. On 17 April 2026 ESMA published a statement on the end of the transitional periods setting out that, after 1 July 2026, any entity providing crypto-asset services to EU clients without a MiCA licence is in breach of EU law and must stop, and that national authorities are expected to act. An absence from the positive list used to have a possible innocent explanation in a documented transitional arrangement. For any period after 1 July 2026 that explanation has expired, and the question that decides the analysis is simply whether the firm is authorised.

That leads to a sequence that fits how the two lists behave. A firm on the negative list should be treated as a stop signal and escalated. A firm on the positive list still needs its scope and passporting checked, as explained in The MiCA CASP registry: what it is, how to read it, and why authorisation status matters. A firm on neither list is the case that deserves the most attention, because it is unauthorised in the eyes of the positive list and has simply not yet been reported, or will never be reported by the authority that would be expected to do so.

Using the register in practice

For a retail client, the register is the last step in a short check and not the first. Confirm the legal entity name against the positive list, check the services and the countries covered, and only then look at whether the negative list or the home authority's warning pages say anything. A clean result on the negative list does not substitute for a positive result on the other.

For a CASP, bank, payment provider or fund, the register is a screening input for counterparties, outsourcing partners, marketing affiliates and the operators of any web property that the firm links to. ESMA's April 2026 statement also warns authorised providers against outsourcing or delegation arrangements that would let an unauthorised entity keep serving EU clients indirectly, which makes screening of service providers a reasonable control, though it should not be the only one. The data works best when it is matched on web addresses as well as names, refreshed at the cadence at which ESMA republishes it, and recorded with the date of each check. A listing should trigger escalation and enhanced due diligence, with the wording of any onward record kept to what the register supports.

What the tool covers and what it does not

The MiCA non-compliant entities list republishes the entries in ESMA's interim register and shows web addresses in defanged form, so that flagged domains cannot be followed or auto-linked by accident. It does not verify entries, identify the operator behind a label, assess the decision that sits behind an entry, or record whether an entity has since ceased trading or been removed. It does not list authorised firms either; that is the job of the MiCA CASP registry. This article names no individual entries, because the list changes between updates and a listing is a regulator's statement about an entity that the entity is entitled to contest.

Keeping the picture current

Three things move at different speeds. The register itself changes between updates. National blocking and notice practices shift as authorities settle into their post-transition enforcement routines. And the framework around MiCA continues to develop, including the questions covered in the MiCA compliance deadline tracker. For an overview of what monitoring tools do and miss in this area, see MiCA compliance monitoring: what tools actually help and what they miss.

Forseti monitors EU financial regulation continuously and delivers personalised impact analysis anchored to verified official sources. Start for free.