Who is authorised under MiCA and where: the CASP register by member state

The MiCA CASP register is ESMA’s Interim MiCA Register: five CSV files on ESMA’s MiCA page, the crypto-asset service providers file being the list of who is authorised. At its 30 September 2026 update, read on 6 October 2026, that file held 364 records, 362 live, which is 359 distinct entities by legal entity identifier. Germany is home to 96, France 36, the Netherlands 28, Cyprus 24 and Malta 23. The large exchange brands are there through named EU companies (OKX Europe Limited, Coinbase Luxembourg S.A., the two Payward entities behind Kraken); no entity carrying the Binance name appears as at that date. Only 22 of the 359 may operate a trading platform, MiCA’s term for an exchange.

Every figure is read from ESMA’s files by the method stated below, as published on 30 September 2026. Getting a non-EU company onto the register, and which member state to file in, is MiCA authorisation for non-EU crypto companies; timelines and capital by class are on the CASP readiness checklist; EU or Dubai first is MiCA vs VARA.

Where the register is, and what it is

MiCA is Regulation (EU) 2023/1114 of 31 May 2023, Official Journal L 150 of 9 June 2023. Article 59(1) bars crypto-asset services in the Union without Article 63 authorisation, save for banks and other regulated firms acting under Article 60. Article 109(1) requires ESMA to keep a public register of white papers, token issuers and authorised crypto-asset service providers, updated from what national competent authorities report; ESMA authorises nobody itself. Article 110 adds a separate, non-exhaustive register of entities in breach of Article 59 or 61.

As at 6 October 2026 both are published as the Interim MiCA Register: five CSV files under the line “Last update: 30 September 2026”. Planned to run until mid-2026, the CSV files remain the live register. ESMA republishes weekly and warns that an authorisation already granted nationally may not yet appear. Each record is keyed on the legal entity identifier that Article 62(2)(a) requires in every application.

The register by home member state

Counting method: one entity per LEI, legal name where the LEI is blank, active means no end date; 364 records become 359 distinct active entities. The last column counts entities authorised for service (b), operation of a trading platform.

Hungary, Poland and Romania are EU member states with no home-authorised CASP in the file.

The top five home states hold 57.7 percent. Germany’s 96 is not 96 exchanges: credit institutions provide crypto-asset services on an Article 60(1) notification to their home regulator, and the file lists them beside Article 63 applicants without flagging which is which; across the file, Deutsche Bank in Germany, BBVA in Spain, and Clearstream Banking S.A. and Standard Chartered Luxembourg S.A. in Luxembourg are there on that footing. The file also has traps: four German records dated in October 2026, after publication (three on 12 October, one on 6 October); one French record dated 11 September 2028; KBC Bank NV with no date; three Greek records with no LEI; EUWAX AG, DekaBank and Deutsche WertpapierService Bank each listed twice. Hence 359 entities, not 364 records.

Which exchanges hold a MiCA CASP authorisation

Article 59(2) requires an authorised CASP to have its registered office in a member state where it provides part of its services, its effective management in the Union and an EU-resident director, so a Dubai or Noida seat alone does not qualify. ESMA’s 17 April 2026 statement adds that MiCA’s protections apply to that specific EU entity, not to other group companies or non-EU entities. Schedule B therefore names the entity, regulator and date; the selection is the brands founders ask about, not a ranking.

Malta’s MFSA decided six of these seventeen and Austria’s FMA four; Kraken holds two Irish authorisations dated the same day, and Coinbase Luxembourg S.A. is passported to 30 host states.

No record in the 30 September 2026 file contains “Binance” or “Nest Services” in its legal name, commercial name, website or platform fields; nor Bitget, MEXC, HTX, Huobi, Upbit or Bitfinex. That describes the file on that date, not any firm’s status, given ESMA’s lag warning. What Article 61 still permits a non-EU exchange to do is on MiCA reverse solicitation for non-EU exchanges; whether a group’s Dubai, Seychelles or Indian entity needs its own licence is mapped in crypto licence requirements by country.

Article 3(1)(16) lists ten crypto-asset services, coded a to j. Read across the 359 entities, this is a custody and transfer register first and an exchange register last.

One authorisation covers the Union under Article 59(7), by establishment or by providing services with no host-state presence; in the file, 215 of 362 active records list two or more host states and Bitpanda GmbH lists 30.

How the register has grown, quarter by quarter

Two of the 359 fall outside the series: KBC Bank NV has no date and REGULAR FINANCE SAS is dated 2028. Of the 362 active records, 292 are dated before 1 July 2026 and 69 on or after.

The shape is the transitional period. Article 143(3) let a CASP lawfully operating under national law before 30 December 2024 continue until 1 July 2026 or until authorised or refused, whichever came first, and let member states shorten that period; Article 143(6) allowed a simplified procedure for legacy licensees. The 81 authorisations of Q4 2025 and the 105 of Q2 2026 cluster ahead of that deadline; the file does not say which entities held a national licence before.

The national periods differed. ESMA’s list of Article 143(3) grandfathering periods records 18 months in most states; 12 in Germany, Ireland, Lithuania, Austria, Slovakia and Norway; 9 in Sweden; 6 in Latvia, Hungary, the Netherlands, Poland, Slovenia and Finland; and application cut-offs in Denmark (30 December 2024), Czechia (31 July 2025), Bulgaria (8 October 2025) and Italy (30 December 2025). It records months, not days, so any shortened end date must be verified against the national statute.

ESMA said on 17 April 2026 (ESMA75-113276571-1679) that the period would end across the EU on 1 July 2026, and it did. How it closed and what an unauthorised firm must now do are on MiCA vs VARA; what Article 61 still allows is on MiCA reverse solicitation for non-EU exchanges.

The other list: entities reported as non-compliant

The Article 110 file, NCASP.csv, held 173 entries at the 30 September 2026 update: Italy’s Consob reported 164, Belgium’s FSMA 6, and the Czech National Bank, the Dutch AFM and the National Bank of Slovakia one each. Decision dates run from 10 February 2025 to 15 September 2026; every entry shows “No” for infringements found by ESMA on its own initiative. It is non-exhaustive by design: presence shows which regulator is acting; absence shows nothing.

What the register does not tell you

Four things. Whether a record is an Article 63 authorisation or an Article 60 bank notification. Exact service scope, since the codes are inconsistently entered and Schedule C is a floor. Decisions taken in the last week. And national transitional end dates, which sit in a separate list by month. What it does keep is withdrawals: Stratos Europe Ltd (Tradu) in Cyprus, authorised 14 October 2025, ended 24 April 2026; Decubate B.V. in the Netherlands, authorised 31 July 2025, ended 26 March 2026 at its own request.

If the EU entity is funded from India

An Indian founder standing up an EU subsidiary usually funds it from India or through a Dubai holding company, and two Indian rules bite first. Under Schedule I of the FEMA Overseas Investment Rules 2022, an Indian company may invest in a foreign financial-services entity only if it posted net profits in each of the preceding three financial years; an Indian financial-services company must also be registered with or regulated by an Indian financial regulator. Under Schedule III, a resident individual may invest only in an operating foreign entity not engaged in financial services, within the USD 250,000 Liberalised Remittance Scheme ceiling. Whether an EU CASP is a financial-services entity under RBI’s Overseas Investment Directions is a classification the AD bank must confirm before any remittance, since India has no crypto licensing regime; if it is, a founder in Noida cannot make ODI in it personally and any Indian company investing must meet the Schedule I profit test. The filing sequence is on LRS vs ODI for Indian founders; the two-layer rule is on its own page; fixing an ODI made the wrong way is a service. In reverse, an EU CASP serving users in India must register with FIU-IND as a reporting entity under the Prevention of Money-laundering Act, an AML status, not a licence; the FIU-IND registration insight owns that question.

On the EU leg Infinilex quarterbacks, EU local counsel files. Infinilex counsel qualified in India, the UAE and the US sign opinions for those jurisdictions; for the EU and any other jurisdiction Infinilex scopes and coordinates the local counsel who sign. The member-state choice is on the MiCA authorisation page; start with the MiCA readiness self-assessment if the question is still whether MiCA reaches you; our consultation response covers the review.

Frequently asked questions

Further reading

MiCA authorisation for non-EU crypto companies · The MiCA CASP authorisation readiness checklist · FIU-IND registered VDA service providers: the full list

General information, not legal advice on any entity’s status. Sources, read 6 October 2026: CASPS.csv and NCASP.csv (ESMA, last update 30 September 2026); Regulation (EU) 2023/1114; ESMA75-113276571-1679 (17 April 2026); ESMA’s Article 143(3) list; BaFin; FEMA Overseas Investment Rules 2022. ESMA republishes weekly; check the live file against its date. Presence is an authorisation of the named EU entity only; absence is not a finding about any firm.