MiCA licensed crypto exchanges and firms by country

Key takeaways:

• The ESMA file updated on November 5, 2026 lists 397 crypto firm entries from 27 home countries.
• Germany leads with 125 entries, yet 117 are Article 60 notifications, 70 of them from German cooperatives, and just 8 are new authorizations.
• Kraken, Crypto.com and CoinGate appear under legal entities with other names (Payward Europe Solutions Limited, Foris DAX MT Limited and UAB Decentralized), while a search of the file for Binance, Bitget, Nexo, Uphold or PayPal returns no rows.

The European Securities and Markets Authority’s file of crypto-asset service providers, updated on November 5, 2026, lists 397 entries from 27 home countries, and 125 of them are German. MiCA licensed crypto exchanges such as Bitvavo and OKX sit in it beside German cooperatives that only execute customer orders, according to the interim MiCA register.

The date matters because the grace period is over. Article 143 of MiCA let firms that served clients under national law before December 30, 2024 carry on until a decision on their Article 63 application or until July 1, 2026, “whichever is sooner.” It also allowed member states to shorten that window.

Since July 1, 2026, Article 59 of the regulation’s text has applied without that cushion. A person may provide crypto-asset services in the EU only if it holds an Article 63 authorization, or if it is a bank or another financial entity that Article 60 allows to offer them. Both groups are in the file.

Article 61 adds one narrow exception, for a non-EU firm serving a client who approached it on the client’s “own exclusive initiative.”

What the ESMA register counts

Each row in the file is a crypto-asset service provider, but the rows reach the list by two different routes. An authorization under Article 63 is what most people mean by a MiCA license or a CASP license. A national regulator assesses the firm’s application and must decide within 40 working days of receiving a complete one, Article 63(9) says.

Notification under Article 60 is the shortcut for firms that already hold another EU license. Banks, central securities depositories, investment firms, market operators, e-money institutions, UCITS management companies and alternative investment fund managers may tell their home regulator at least 40 working days before starting, and several are limited to services that match the license they already have.

The limits can be tight. An e-money institution may offer only custody and transfers, and only for the e-money tokens it issues, under Article 60(4), while a central securities depository may offer custody alone.

In the ESMA register, 129 rows are labeled Article 63 authorizations and 150 Article 60 notifications, and 3 French rows cite both. Another 115 rows leave the legal-basis field blank, including all 25 from Cyprus and all 13 from Luxembourg. ESMA’s description of the fields marks that column “NEW – as of Oct 2026,” so a blank says only that the basis was not filled in.

Rows and firms are not quite the same count either. The 397 rows cover 394 legal entity identifiers, because three German firms (EUWAX AG, Deutsche WertpapierService Bank AG and DekaBank Deutsche Girozentrale) appear twice.

Withdrawals stay visible. Three rows carry something in the withdrawal-date field. Stratos Europe Ltd of Cyprus shows April 24, 2026, and Decubate B.V. of the Netherlands shows March 26, 2026, with a comment that the firm itself asked for the revocation. Malta’s Payhound Limited has its own name in that field instead of a date.

ESMA’s page says a withdrawn record “will remain in the publication” with the date the withdrawal took effect.

The format is still a stopgap. ESMA describes an interim register published “as a collection of csv files” and says it publishes a new version “on weekly intervals,” which is why national registers can be ahead of it.

Where the firms are based

Germany’s lead comes mostly from Article 60 notifications. The table ranks the 12 home countries with the most entries in the November 5, 2026 file, with the regulator each row names and the legal basis the file gives.

The 12 countries in the table hold 328 of the 397 entries. Germany’s 117 notifications include 70 from entities whose names end in “eG,” the suffix that German cooperative law requires for a registered cooperative, and 69 of those 70 list a single service, execution of orders on behalf of clients. Of all 117 notifications, 103 name Germany as their only country.

The other 15 home countries share 69 entries. Italy has 10 of them, and three countries have one each.

The 27 home countries are 24 EU member states plus Iceland, Liechtenstein and Norway. A search of the file’s home-state column for Hungary, Poland and Romania returns no rows, although all three appear in other firms’ lists of countries where they plan to offer services.

Which big crypto brands are on it

Searching the file for MiCA licensed crypto exchanges by brand often finds the wrong thing, because the register lists legal entities. Exchange Kraken appears as two Irish companies named Payward, and Crypto.com appears as Foris DAX MT Limited of Malta. The table gives the entity and regulator behind 15 well-known brands, with each row’s date, the number of MiCA services it lists and the countries it names.

Kraken’s pair shows how one brand can split its permissions. Payward Global Solutions Limited lists only the operation of a trading platform, for Cyprus and Ireland, while Payward Europe Solutions Limited lists eight services across all 30 countries. Bitpanda has three rows, adding Bitpanda Asset Management GmbH under Germany’s BaFin and BP23 CA Limited under Malta’s MFSA, whose six services cover Malta only.

Payment firms are in the MiCA register too. The file shows payments firm BitPay’s BitPay B.V. with an Article 63 authorization from the Dutch AFM dated July 16, 2026, for exchange of crypto-assets for funds and transfer services, and CoinGate trades through UAB Decentralized, listed under the Bank of Lithuania with a date of December 16, 2025.

Both sell checkout services, so a shop that wants to accept stablecoin payments can look up the company behind its provider the same way.

A search of the ESMA file updated on November 5, 2026, run on November 8, 2026 across every field, returns no rows for Binance, Bitget, Nexo, Uphold or PayPal. That result covers the names searched and nothing more. Brands often operate through legal entities with other names, as UAB Decentralized and Foris DAX MT Limited show, so the entity named in an app’s terms is the one to look up.

What the licenses cover

Custody is the most common permission in the file, listed by 234 of the 397 entries. MiCA defines ten crypto-asset services in Article 3(1)(16), lettered (a) to (j), and each row of the ESMA file lists the ones its holder may provide. The table counts the entries naming each service.

National regulators write the service lists in several formats, some lettered and some as plain sentences, so the counts match each service by its wording in every row.

Only 22 entries operate a trading platform, the service closest to an exchange in everyday speech. Bitstamp Europe and Bitvavo are among them, as are OKX Europe and Kraken’s Payward Global Solutions. The entries for Coinbase Luxembourg and Foris DAX MT do not list that service, and neither do those for Bybit EU or Gemini’s EU company, though all four list exchange of crypto-assets for funds and for other crypto-assets.

The median entry lists 3 services, and 119 entries list just one, most often execution of orders (78 of them). No entry lists all ten. OKX Europe Limited, Alaric Securities OOD of Bulgaria and NOEMON TECH LTD of Cyprus each list nine.

The service list also sets disclosure duties. Under Article 66(3), platform operators and firms that exchange crypto-assets must give clients hyperlinks to any crypto-asset white paper for the coins involved, and the same duty covers advice and portfolio management.

One license, 30 countries

Passporting is what lets a company with a CASP license from Malta or Austria serve a customer in Lisbon. Under Article 65, a provider that wants to work in more than one member state sends its home regulator a list of countries, the services it plans there and a start date.

The regulator passes that on within 10 working days, and the firm may begin once told, or at the latest on the 15th calendar day after filing. No office is needed in the host country, Article 59(7) adds, since a provider serving clients across borders “shall not be required to have a physical presence” there.

In the ESMA file, 170 entries list 27 or more countries and 107 list all 30 countries of the EU and the wider European Economic Area. At the other end, 162 entries list a single country, 105 of them German, and 4 leave the country field blank. The median entry lists 7.

A missing home country is normal. MiCA’s Article 109 describes the column as “the list of host Member States,” and Malta’s OKX Europe, Foris DAX MT, Gemini Intergalactic EU and Blockchain.com Operations each list the other 29 countries and leave Malta out. Gaps elsewhere are worth reading, since Revolut Digital Assets (Europe) Ltd also lists 29 countries and the one it leaves out is Hungary.

Counting needs care. Twelve rows name Greece twice, as both GR and EL, which pushes their raw count to 31, so the figures here count Greece once.

The rush before July 1, 2026

Four Dutch entries are dated December 30, 2024, the day MiCA began to apply in full under Article 149, and payments company MoonPay’s MoonPay Europe B.V. is one of them.

The early months were slow. The file dates 148 entries to the whole of 2025, and 44 of those fall in December 2025, 16 of them German.

June 2026 was the busiest month by far. In the ESMA file, 76 entries are dated that month, the last before the transition ended, and 25 of them carry June 29 or June 30. France led June with 12 entries and Cyprus followed with 9.

The list kept growing after the deadline. In all, 101 entries are dated on or after July 1, 2026. Six German bank notifications are dated between November 5 and November 25, 2026, after the latest row update in the file, November 3.

Future dates have a reason in the law. Article 60 lets a bank start 40 working days after notifying, and Article 109 has the register show a starting date or “the intended starting date,” so a date in the file is not always a past decision. One entry, Belgium’s KBC Bank NV, has no date at all.

How to check a crypto firm before you open an account

The register answers one narrow question, whether a named company may offer named services in your country. These steps work the same for MiCA licensed crypto exchanges and for brokers, and they use only the ESMA files and the app’s own documents.

1. Find the legal entity name in the app’s terms of service or website footer, since the company your contract is with is often named differently from the brand.
2. Search the ESMA CASP file for that name or for the firm’s 20-character legal entity identifier (LEI), because a brand string can mislead, and “crypto.com” matches four rows, three of them other firms whose web addresses contain those letters.
3. Read the services column and check that it covers what you plan to do, such as custody (a) if the app will hold your coins or transfer services (j) if you want to send coins elsewhere.
4. Check that your country is in the entry’s country list, keeping in mind that the home state can be missing, and that the withdrawal-date field is empty.
5. Check the home regulator’s own register, because ESMA warns that information “listed in a national register will not be immediately displayed” in its weekly file.
6. Search ESMA’s non-compliant entities file, which held 189 entries in the November 5, 2026 update, 180 of them reported by Italy’s CONSOB.

Article 110 calls that last file a “non-exhaustive” register, so a firm missing from it has not been cleared of anything. Passing all six checks shows a firm may offer the listed services where you live, and it says nothing about fees or solvency.

Treat every figure here as dated. Each count belongs to the November 5, 2026 update, and ESMA republishes the file every week, so before relying on an entry, read the “Last update” date on ESMA’s MiCA page and the row’s own last-update column.

The page still says the CSV collection runs “until mid-2026 when it will be formally integrated into ESMA’s IT systems,” yet on November 8, 2026 it was still serving the CSV files.

Frequently asked questions

How many crypto firms have a MiCA license?

The ESMA file updated on November 5, 2026 lists 397 entries covering 394 legal entity identifiers. Those rows mix 129 Article 63 authorizations, 150 Article 60 notifications, 3 that cite both and 115 with no legal basis given. Three rows carry an entry in the withdrawal-date field.

Is Binance MiCA licensed?

A search of the ESMA file updated on November 5, 2026 for “Binance” returns no rows in any field, and a search of ESMA’s non-compliant entities file for the same name also returns no rows. Firms often trade through entities with other names, so the company in the app’s terms of service is the name worth searching.

Which country has issued the most MiCA licenses?

Germany has the most entries, 125, but 117 are Article 60 notifications and 8 are Article 63 authorizations. Counting authorizations alone, France leads among rows that state a legal basis, with 27 plus 3 citing both articles, ahead of the Netherlands with 22 and Malta with 20. Cyprus’s 25 entries give no legal basis.

Does a MiCA license from Malta work in Germany?

Yes, when Germany is on the firm’s list. Article 65 lets a provider authorized in Malta serve other member states once it files a country list with the Malta Financial Services Authority, and it may start there by the 15th calendar day after filing at the latest, with no office required. OKX Europe Limited, for example, lists 29 countries, Germany among them.

What is the difference between a MiCA authorization and a notification?

An authorization under Article 63 is granted by a national regulator after it assesses a full application. A notification under Article 60 is for firms that already hold an EU license, such as banks and investment firms, which must give their supervisor 40 working days’ notice or more before they start. Of the 397 rows in the ESMA file, 129 are authorizations and 150 are notifications.