Data and methodology

Every fact on this site comes from one source: the interim MiCA register published by the European Securities and Markets Authority. This page explains what we do with it, so you can judge how far to trust a page here versus the original.

Source

ESMA publishes five CSV files under Articles 109–110 of MiCA: CASPS.csv (authorised crypto-asset service providers), NCASP.csv (non-compliant entities), EMTWP.csv and ARTZZ.csv (issuers of e-money and asset-referenced tokens with their white papers) and OTHER.csv (white papers for other crypto-assets). The files are fed by the national competent authorities; ESMA does not verify their content. We download them from ESMA's MiCA page.

Refresh

A scheduled job fetches the files once a day. Each row is compared with what we already hold; differences are written to the change log, dated the day we saw them. ESMA's own "last update" date for each record is shown on the entity's page. Last run: 15 October 2026, 06:20 (unchanged).

Cleaning

• One page per entity. The CASP file has one row per (provider, batch of services). We merge rows by LEI into one provider, taking the union of services and countries and the earliest authorisation date.
• Services. Most rows label services "a." to "j."; some carry only the text, in varying capitalisation. We map every variant to the ten codes of Article 3(1)(16). Rows we cannot map are kept without a service and flagged in our admin view.
• Countries. Passporting lists are split on the pipe character and reduced to valid EEA codes.
• LEIs are normalised to 20 alphanumeric characters (the file contains trailing dots and 21-character values).
• Websites are split into domains for the check tool. We match the exact host, its parent domain and its subdomains — nothing fuzzier, because "resembles" is exactly the fraud pattern the register exists to defeat.
• Non-compliant entities that appear several times (successive warnings, new domains) are merged into one page, listing every domain named.
• Removed rows are not deleted. An entity that vanishes from the file keeps its page with the status "no longer listed" and the date we last saw it, so that a link keeps meaning something.

Download the data

The cleaned register is free to reuse under CC BY 4.0 — link to cryptolicit.com as the source and ESMA as the origin. Files are regenerated from the database on request and reflect the last sync.

• Authorised providers: CSV · JSON — one row per provider, with service codes and passport countries
• Non-compliant entities: CSV · JSON
• Stablecoin issuers: CSV · JSON — with token identifiers and white-paper links

Token checks: a different source, a different standard

The pages under token checks are not part of the official register and we keep them visibly separate. They are automated analysis of two public sources: contract properties from GoPlus Security and market data from DEXScreener. Where the register states what a regulator decided, a token page states what a contract allows — a weaker kind of fact, and we label it as ours.

Findings are sorted into four kinds and the verdict follows mechanically:

• Traps — the token is already broken for a buyer: selling blocked, buying blocked, tax above 20%, or a pool number with no trading behind it. Any one sets the verdict to blocking risk.
• Powers — somebody could break it later: pause transfers, blacklist wallets, change balances, change the tax, freeze accounts, mint supply. Blocking on an anonymous token; reported as disclosed issuer powers on an established one.
• Warnings — thin liquidity, no trading, a pair days old, supply in one wallet, an unlocked pool, an unverified contract. Three together make high risk; one or two make some risk.
• Passes — ownership renounced, no mint authority, pool burned, verified source, real volume, an exchange listing.

Two adjustments exist because the naive version is wrong, and we checked that on real tokens. Renounced ownership neutralises owner-only powers: if ownership was truly given up — no hidden owner, no way to take it back — a pause switch is code nobody can call. Established tokens are read differently from anonymous ones: the largest stablecoins can freeze balances and mint supply, which is disclosed policy; the same properties on a token launched this morning are the setup for a trap.

A token gets an indexed page only with a real market behind it — liquidity, volume or holders above a threshold, and at least a day of history. Where the liquidity figure itself looks fabricated, it does not count towards that threshold. Every token page carries the time of the last check, because the honest answer to "is this true now" is a timestamp.

What we do not do

• We do not add information from other sources — no company descriptions, reviews, fee comparisons or news.
• We do not rate providers. "Authorised" is the register's word, not ours.
• We never call a token, a project or a person a scam. Token pages describe contract properties and market facts, with the number that triggered each finding.
• A token with no findings is not a recommendation — it means the automated checks found nothing blocking, which is a floor and not a verdict.
• We do not link to the websites of non-compliant entities; they are shown as text.
• We do not record who searched for what. Search queries are stored without any personal data, to see which names people look for and do not find.

Known limits

• Regulators report with a delay of days to weeks; a freshly authorised provider may not be in the file yet.
• The file has inconsistencies that no cleaning removes with certainty: one country's regulator may list the trading name where another lists the legal entity.
• Withdrawal dates are only present when a regulator entered them. A provider that quietly stops operating stays "authorised" until the entry is changed.
• The register is "interim": ESMA has announced a fuller database. When it arrives, the format will change and so may this site.

Spotted a mistake? Tell us, ideally with the ESMA row in question.