How to Check If Your Exchange Is MiCA Licensed (ESMA Guide)

An exchange can claim compliance in its marketing copy without holding a single official authorization. The only way to know for certain is to look up the legal entity in the official ESMA CASP register, the EU-wide public list of MiCA-authorized crypto-asset service providers (CASPs). This guide shows exactly how to do that, what the results mean, and what to watch for when a platform is missing or only partially listed.

The Official ESMA CASP Register

The ESMA CASP register is published under MiCA Article 109 as part of ESMA's Interim MiCA Register. ESMA exposes it as a downloadable CSV file named CASPS.csv, accessible through the "markets in crypto-assets / MiCA register" section of the ESMA website. Its purpose is specific: to centralize all CASP authorizations across the EEA, including those that have been refused or withdrawn. That last part matters. The register is not a promotional directory. It records refusals and withdrawals alongside active licenses, so a firm appearing in it does not automatically mean it is currently authorized. You need to read the status field.

 

The register shows each firm's home Member State, passporting status, and the specific crypto-asset services it is permitted to provide. The permitted services are coded by category, as shown in the table below.
 

Step-by-Step: Searching the ESMA Register

The CASP register is a CSV file, so the workflow is simpler than a database search but requires a few careful checks.

1. Step 1: Download the file. Go to the ESMA website, navigate to the MiCA register section, and download the current CASPS.csv.
    
2. Step 2: Search by legal entity name. Open the file in a spreadsheet application and search for the exchange's registered legal name, not its brand name. A trading brand like "ExchangeX" may be operated by a legal entity with a completely different name. If you only know the brand, look up the company's legal registration details first.
    
3. Step 3: Verify the home Member State. Confirm that the country shown matches the one where the firm claims to be regulated. An EEA firm authorized in Lithuania can passport services into other EU countries, but the home-state entry should match the firm's stated regulatory domicile.
    
4. Step 4: Check the authorization status. The status field distinguishes active authorizations from refusals and withdrawals. An entry with a withdrawn or refused status means the firm is no longer (or never was) permitted to operate under MiCA.
    
5. Step 5: Note the service categories. Each row lists the specific service codes the firm is authorized to provide. A firm may hold a CASP license for custody but not for operating a trading platform. Confirm the services you actually use are covered.

Using casptracker.eu

The CSV format works, but it is not beginner-friendly. casptracker.eu is an ESMA-register-based tracker that covers MiCA-authorized CASPs, weekly register changes, EU passporting, and stablecoins under MiCA, with data synced from the ESMA register and live market APIs.
 

You can search it by entity name and browse by home country, trade name, or selected entities. The tracker displays official reference numbers, authorization dates, and service coverage in a readable interface rather than a raw spreadsheet.
 

One important caveat: treat casptracker.eu as a navigation aid. For any authorization question with real financial consequences, verify it with the same CASP in the official ESMA MiCA register, and treat the ESMA entry as the authoritative source. The tracker syncs from ESMA's data, but ESMA's own file is always the primary record.
 

What the License Categories Mean

Not every CASP is an exchange. MiCA defines ten crypto-asset service categories, and each authorized firm holds a license for a specific combination of them. A firm can be authorized for custody without being permitted to run a trading platform.

The difference between category (b) and the others is significant. Operating a trading platform is a single higher-risk service code that triggers Class 3 capital requirements (a minimum of €150,000) and applies only where a venue brings together multiple client orders in an order-book style.

 

Bilateral trading with clients falls under different codes. That means a firm with a CASP license but without code (b) authorization cannot legally run an order-book exchange. Its surface appearance does not change that. When you check an exchange, confirm it supports both code (b) and any additional codes that match the services you use, such as code (c) for exchanges for funds or code (j) for transfers.

Red Flags: Signs Your Exchange May Not Be Licensed

An exchange without proper licensing can expose a user to a higher risk of hacks, insolvency, or regulatory action. Here are the specific warning signs to watch for.

• No ESMA entry at all. If a search of the CASPS.csv file returns no results for the firm's legal entity name, it is not listed as authorized. That is the clearest signal.
   
• "We are applying" claims. The transitional period for firms that were already serving clients lawfully before 30 December 2024 ends on 1 July 2026. A pending application does not extend the right to operate beyond that date. After the deadline, unlicensed platforms must cease providing crypto-asset services to EU clients.
   
• Missing service categories. A firm may appear in the register but lack authorization for the specific services you use. Check codes, not just presence.
   
• Geo-blocking or restricted features for EU users. Platforms that cannot serve EU clients under MiCA sometimes restrict account features or block EU IP addresses rather than disclosing their unlicensed status directly.

Regulated exchanges are also expected to conduct identity verification and anti-money laundering checks. A platform that skips KYC entirely may be operating outside the regulatory perimeter, not offering a convenience feature.

Consider Self-Custody

A MiCA license is not permanent. Authorizations can be refused or withdrawn, and the register records both outcomes. Even a currently active license does not eliminate the risks that come with leaving assets on an exchange.

Custodial exchange storage leaves key control with the service, exposing users to hacks, bankruptcy, regulatory freezes, or exit fraud. Those risks exist regardless of licensing status.

Self-custody means the user, rather than an exchange or intermediary, controls the private keys. In a self-custodial setup, transactions are signed with the user's private key and broadcast to the network without a third party controlling access. Self-custody removes exchange counterparty risk entirely.

The trade-off is real. Self-custody removes exchange counterparty risk, but the user assumes full responsibility.

For users who want a straightforward path to self-custody, a hardware wallet like Tangem stores private keys offline on NFC-enabled physical cards, with no seed phrase required in the default setup. The keys never leave the secure element on the card. That is a meaningful structural difference from leaving assets on any exchange, licensed or not.