Since 1 July 2026, “Is It Licensed?” Has a Yes-or-No Answer
For years, asking whether a European crypto platform was “regulated” got you a shrug. Each of the 27 member states ran its own regime. Some issued anti-money-laundering registrations, some issued licences, and some did nothing at all. A firm could truthfully say it was “registered in the EU” while being supervised for almost nothing that protected its customers.
That ended when MiCA’s last transitional periods expired on 1 July 2026. Every firm providing crypto-asset services to EU clients now needs a MiCA authorisation, and every authorisation is recorded in one place: the register kept by the European Securities and Markets Authority (ESMA).
ESMA’s message to retail investors on 23 June 2026 was direct. Clients of unauthorised providers, whether based inside or outside the EU, “do not benefit from MiCA safeguards, including protections for client assets.” Its advice: check whether your provider is authorised in the ESMA register, and if it is not, act promptly — by moving to an authorised provider or to a self-hosted wallet.
The check takes about two minutes once you know where to look and how to read what you find. Most people get the first part right and the second part wrong. This guide covers both.
Where the register stood in late August 2026: 331 authorised crypto-asset service providers (CASPs), led by Germany (79), France (35) and the Netherlands (29). ESMA’s list of e-money tokens held 43 entries, and its list of non-compliant entities — firms flagged for offering services without authorisation — held 167. The numbers move every few weeks, which is exactly why you check the register rather than a list in an article.
The Two-Minute Check
Step 1: Open the ESMA register yourself
Type esma.europa.eu into your browser and find the MiCA register from ESMA’s MiCA page. Never reach a register through a link in an email, a message, an advert or a search result. Scammers know careful people verify, and fake “verification” pages are part of the playbook. Related: MiCA Created a Scam Wave: How Fake “Licensed” Exchanges Are Targeting EU Users
ESMA compiles the register from information national regulators send it and refreshes it periodically — there were several updates a month after the deadline. That has two consequences: a firm authorised in the last few days may not appear yet, and a firm that has just lost its authorisation may linger briefly. When something doesn’t add up, the national regulator’s own register (step 4) is the tiebreaker.
Step 2: Search for the legal entity, not the brand
This is where most checks go wrong. Large exchanges serve Europe through local subsidiaries with names like “[Brand] Europe Ltd” or “[Brand] EU GmbH”. The brand on the app is almost never the name on the licence.
Find the legal entity in the platform’s terms of service or its legal notice — the company you actually contract with. That name, ideally with its registration number or LEI (legal entity identifier), is what you search for.
Step 3: Read the entry — four fields matter
- Home member state and regulator. Which country authorised the firm, and which authority supervises it. Complaints and escalation go there.
- The services it is authorised for. MiCA defines ten crypto-asset services: custody, operating a trading platform, exchanging crypto for money, exchanging crypto for other crypto, executing orders, placing, receiving and transmitting orders, advice, portfolio management, and transfer services. A firm can be authorised for some and not others.
- Where it may serve clients. An authorisation from one member state can be “passported” to others by notification. Check that your country is covered.
- Its name and website. Compare the commercial name and web address in the entry with the site or app you are actually using.
Step 4: Cross-check the national register
Every national regulator keeps its own register, and the home regulator’s version is often the most current. For a firm authorised elsewhere and passported into your country, your own regulator usually lists it too — the AFM’s crypto register, for instance, covers both AFM-authorised firms and firms notified by other EU supervisors.
Step 5: Search the warning lists
Finally, search the firm’s name and web address in the warning lists below. A hit is decisive. A miss means very little — more on that shortly.
Where to Look, Country by Country
Type the regulator’s address yourself, then use its register and warnings pages.
| Country | Regulator | What to check |
|---|---|---|
| EU-wide | ESMA — esma.europa.eu | MiCA register of authorised CASPs; list of non-compliant entities; e-money token register |
| Netherlands | AFM — afm.nl | Crypto register (AFM-authorised firms plus notifications from other EU supervisors); AFM warnings |
| Germany | BaFin — bafin.de | Company database; consumer warnings |
| France | AMF — amf-france.org | White list of authorised CASPs; blacklist of unauthorised websites |
| Malta | MFSA — mfsa.mt | Financial Services Register; warnings |
| Cyprus | CySEC — cysec.gov.cy | Regulated entities; warnings |
| Ireland | Central Bank of Ireland — centralbank.ie | Registers; unauthorised-firm warnings |
| Luxembourg | CSSF — cssf.lu | Entity search; warnings |
| Austria | FMA — fma.gv.at | Company database; investor warnings |
| Italy | CONSOB — consob.it | Warnings; orders blocking unauthorised websites |
| Spain | CNMV — cnmv.es | Registers; warnings |
| Worldwide | IOSCO I-SCAN — iosco.org | Warnings from securities regulators worldwide, in one search |
A few things worth knowing about these lists. Germany has the most MiCA-authorised firms, partly because many cooperative banks have added crypto services — so expect plenty of unfamiliar bank names. France’s AMF runs both a white list and a blacklist; it added 16 crypto websites to the blacklist on 8 July 2026 alone, and 38 in the year to that date. IOSCO’s I-SCAN pulls warnings from regulators across the world into one search, which is useful when a platform claims to be based somewhere exotic.
Five Traps That Fool Careful People
1. “Registered” is not “authorised”
Before MiCA, most EU countries ran anti-money-laundering registrations for crypto firms. In the Netherlands, that meant registration with De Nederlandsche Bank between May 2020 and December 2024. These registrations checked money-laundering controls — not capital, custody, segregation of client assets or conduct. They are not MiCA authorisations, and since 1 July 2026 they don’t permit a firm to serve you.
Binance is the clearest example. It held national registrations in countries including France, Italy, Poland and Spain, but missed the 1 July deadline without MiCA authorisation after withdrawing its Greek application on 24 June. As of late August 2026, neither Binance nor its related entities appeared in ESMA’s register of authorised providers.
2. The group is licensed; your entity isn’t
“We’re MiCA-licensed” can be literally true about a corporate group and false about the entity that holds your money. If you signed up years ago, you may still be contracting with an older, non-EU entity. Check the name in your current terms, not on the homepage.
3. The licence doesn’t cover the product you use
MiCA authorises specific services. It does not regulate crypto lending or borrowing at all, and derivatives fall under different EU rules. “Earn”, lending and some staking products can sit outside the licence entirely, even on a fully authorised platform. Find out which service your product actually is before you assume it’s covered.
4. Clone firms
Scammers copy the name, registration number and even the regulator’s logo of a genuinely authorised firm. The register entry is real; the website isn’t. That’s why step 3 ends with comparing the web address. Regulators publish clone warnings, but those always lag the clones.
5. “Applied for”, “licensed elsewhere” and sign-up pages that work
“Our application is pending” means unauthorised. So does “licensed in Dubai”, “regulated in the Seychelles” or any other non-EU licence: none of them permits a firm to market to or onboard EU clients. The narrow “reverse solicitation” exception covers services provided strictly at the client’s own exclusive initiative — not a platform that advertises to you.
And a sign-up flow that works proves nothing. A Crowdfund Insider report in August 2026, citing tests by the analytics firm Sandmark, said new EU accounts could still be opened and funded on Binance after the deadline, with no warning that the firm lacked MiCA authorisation. Binance said availability depends on jurisdiction, product and individual circumstances. The register, not the onboarding screen, tells you who is authorised.
Absence From a Warning List Proves Nothing
Warning lists are compiled after complaints, investigations and legal review. New scam domains go up every day. The AMF says plainly that its blacklist is updated regularly but is not exhaustive, because new unauthorised actors keep appearing. ESMA’s list of non-compliant entities — 167 names in August 2026 — has the same limitation.
Treat warning lists as a filter for “definitely bad”, never as evidence of “probably fine”. The only positive proof is an authorisation entry that matches the exact legal entity, service and website you are dealing with.
What a Licence Does — and Doesn’t — Protect
What a MiCA authorisation gives you:
- Segregation. Crypto held in custody must be legally separated from the provider’s own estate, so its creditors have no claim on it — including in insolvency.
- Liability. A custodian is liable for losses of your crypto, or of your means of access to it, that are attributable to the provider — capped at the market value of the asset when it was lost.
- Statements. At least once a quarter, and on request, a statement of your positions and transfers.
- A wind-down plan. Custodians, trading platforms and exchange services must keep a plan to wind down without causing undue economic harm to clients.
- Supervision. Fit-and-proper management, capital requirements, a complaints procedure and a regulator you can escalate to.
What it doesn’t give you:
- Price protection. Authorisation says nothing about whether a token is a good idea.
- Protection from your own signatures. If you approve a drainer or send funds to a scammer, the licence doesn’t reverse it.
- A deposit guarantee. EU deposit guarantee schemes cover bank deposits up to €100,000. They don’t cover crypto-assets, and investor compensation schemes aren’t designed for them either.
For what happens when an authorisation is withdrawn or a provider exits the market: Related: What Happens to Your Crypto If Your Exchange Loses Its Licence — or Never Had One
For Readers in the Netherlands
Dutch users went through this a year early. The Netherlands chose a short transitional period that ended on 30 June 2025, so since 1 July 2025 any provider serving Dutch clients has needed a MiCA licence. The AFM is the authority that authorises crypto-asset service providers here, and its crypto register is the national place to check.
Enforcement is real, but slow. In March 2024, DNB published a €2.85 million fine on an unnamed crypto firm for serving Dutch clients without the registration then required. A Rotterdam court reduced it to €2,277,500 in December 2025, and DNB appealed in January 2026 — more than two years after the fine was imposed. Don’t wait for a regulator to settle a question your own two-minute check can answer today.
If you come across a fake platform or lose money to one, report it to the Fraudehelpdesk (fraudehelpdesk.nl) and the police, and notify the AFM.
Outside the EU
United Kingdom: check the FCA’s Financial Services Register and its warning list. The UK is building its own crypto licensing regime, so expect the register to change.
Everywhere else: find the national securities or financial regulator, search its register and warnings, and run the name through IOSCO’s I-SCAN.
The Checklist
- ☐ Found the legal entity name in the platform’s terms, not just the brand
- ☐ The entity appears in the ESMA register as an authorised CASP
- ☐ The service I use is on its list of authorised services
- ☐ My country is covered (home state or passport notification)
- ☐ The website in the register matches the site or app I’m using
- ☐ No hits on ESMA’s non-compliant list, my national warning list or I-SCAN
- ☐ Re-checked within the last three months
Frequently Asked Questions
Is the ESMA register the official source?
Yes. Under MiCA, ESMA maintains the central register of authorised crypto-asset service providers, compiled from national regulators’ data. If the two ever disagree, your provider’s home regulator is the tiebreaker.
My exchange says it’s “regulated in the EU”. Isn’t that enough?
No. Find the legal entity in your terms and check it in the register yourself. “Regulated” can describe an old anti-money-laundering registration, a licence held by another company in the group, or a licence for a different service.
What should I do if my platform isn’t in the register?
ESMA’s advice is to act promptly: move your crypto to an authorised provider or to a self-hosted wallet. Navigate to every platform manually and start with a small test transfer. Related: What Happens to Your Crypto If Your Exchange Loses Its Licence — or Never Had One
Can a non-EU exchange serve me if I signed up on my own?
Only under the narrow reverse-solicitation exception — services provided at your own exclusive initiative. A platform that markets to EU users, or keeps onboarding them, cannot rely on it.
How often should I re-check?
At least once a quarter, and whenever a platform changes its terms, its legal entity or its app. Authorisations can be withdrawn, or restricted to particular services.
Transparency: TrueToCrypto may earn affiliate commissions from links in articles; this article contains none. This article is educational and is not legal, financial or regulatory advice. Always verify a provider’s current status in the official registers before acting.
Contact: info@truetocrypto.com
Register figures reflect ESMA updates of July and August 2026 as reported by Cointelegraph. Regulator statements from ESMA (23 June 2026), the AMF (8 July 2026) and DNB. Binance’s status reflects Reuters reporting via The Block (24 June 2026), Trending Topics (26 June 2026) and Crowdfund Insider (23 August 2026). Verified October 2026.
