cryptolicit

What MiCA is, and how to read the register

The Markets in Crypto-Assets Regulation — Regulation (EU) 2023/1114, "MiCA" — is the single rulebook for crypto-asset businesses in the European Union and the wider European Economic Area. This is the short version of what it does, who it touches, and what the register on this site actually tells you.

Why it exists

Before MiCA, every EU country had its own rules for crypto companies, or none. Most had a light "registration" for anti-money-laundering purposes, which many providers advertised as if it were a licence. MiCA replaced that patchwork with one authorisation, one set of conduct rules and one register — and made it illegal to offer crypto-asset services in the EEA without appearing in it.

The timeline

Who needs an authorisation

Anyone who offers one of the ten crypto-asset services to clients in the EEA as a business: exchanges, brokers, wallet custodians, payment-style transfer services, crypto advisers and portfolio managers. There are two routes into the register:

Pure decentralised protocols with no intermediary, and companies serving only non-EEA clients, are outside the scope.

Passporting

An authorisation from one Member State is valid across the EEA. To serve clients in another country, the provider notifies its home regulator, which informs the host regulator; after 15 days it can operate there. The register records, per service, which countries a provider has notified — that is the country list you see on each provider page. A provider serving a country it has not notified is in breach.

What the register is

Articles 109 and 110 require ESMA to publish a register of white papers, of authorised issuers and CASPs, and of entities found to be operating without authorisation. The regulators feed it; ESMA publishes it as a set of CSV files, the "interim MiCA register". As of our last sync it holds 328 authorised CASPs, 23 stablecoin issuers, 905 white papers and 162 non-compliant entities.

How to verify a provider yourself

  1. Find the legal name of the company in its terms of service — not the brand. "Binance", for instance, is a group of dozens of entities; only specific ones are authorised.
  2. Look it up in the register — here, or in ESMA's CSV. Match the legal name or the LEI, and the country.
  3. Check the declared website against the one you are using. A licence covers the domains the company declared; a look-alike domain is a classic fraud pattern.
  4. Check the services. A licence for custody and exchange does not cover managed portfolios or advice.
  5. Check the countries. If your country is not among those notified, the provider is not supposed to be serving you.

What the register does not tell you

That a provider is solvent, that its fees are fair, that its custody is secure, or that its tokens are good investments. Authorisation means the company met organisational, capital and conduct requirements and is supervised; it is a floor, not a recommendation. Crypto-assets remain unprotected by deposit guarantee schemes, and MiCA says so in the mandatory risk warnings.

Where the official texts are

Updated 26 August 2026. This guide is general information, not legal advice.