EU crypto warning register: 165 of 167 entries come from Italy

Anyone who wants to check whether a crypto platform is authorised at all in the European Union sooner or later comes across an official register built for exactly that purpose. The European securities regulator ESMA has maintained a register of non-compliant firms since February 2025. It is meant to collect, across Europe, those providers that supply crypto-asset services without the required permission.

We downloaded the register file on August 16, 2026, counted it line by line and called up every web address stored in it individually. The result sits awkwardly beside the European ambition of this register. Of 167 entries, 165 come from a single member state. Germany's BaFin has contributed not one, even though it has been issuing warnings about crypto platforms throughout the current year. And of 242 stored web addresses, 153 no longer answered at all on the day of the survey.

This analysis was carried out by cryptoticker.io itself on August 16, 2026.

The legal basis is set out in Regulation (EU) 2023/1114, better known as MiCA. Article 110 is headed "Register of non-compliant entities providing crypto-asset services" and opens with a sentence worth memorising: "ESMA shall establish a non-exhaustive register of entities providing crypto-asset services in breach of Article 59 or 61."

Article 59 is the central authorisation rule. Anyone offering crypto-asset services commercially in the EU needs authorisation as a crypto-asset service provider, or has to belong to one of the few groups that already hold a banking or investment licence. Article 61 governs the special case of a provider from a third country approaching customers in the EU on its own initiative.

Paragraph 2 sets out how thin an entry may be: it must contain at least the trading name or the website of the firm, plus the name of the authority that supplied the information. The regulation demands no more. Paragraph 3 requires that the register be publicly accessible in machine-readable format and updated regularly.

That is precisely where the division of labour shaping this register comes from. ESMA operates the directory, but it does not fill it. The supply comes from the competent authorities of the member states. Whether a country contributes anything is for that country to decide.

The file this analysis rests on is called NCASP.csv and sits on ESMA's server. The server timestamp gives August 12, 2026, 8:47 UTC as the last change. The register is republished weekly, so the version we analysed was four days old when we retrieved it.

The file contains 167 entries. Merging spelling variants, 162 distinct trading names sit behind them; some names appear more than once because an authority has taken several decisions on the same offering. Not a single entry carries an identifier that would pin down the legal person behind it: the field for the Legal Entity Identifier is empty in all 167 rows.

The file records 247 mentions of web addresses, spread over 242 distinct addresses. 131 entries make do with a single address; the most extensive lists 15. Among the endings, the Italian country code dominates with 106 addresses, followed by 64 addresses under .com. After that come 17 addresses under .top, twelve under .co, and nine each under .net and .pro.

The decisions the entries rest on run from February 10, 2025 to July 22, 2026. 102 decisions fall in 2025, another 65 in the first seven months of 2026. Two months stand out in this series because not a single decision is dated in them: August 2025 and February 2026. The most recently processed entry carries July 31, 2026 as its update date.

The field naming the competent authority is the most revealing part of the file. 165 of the 167 entries come from the Italian securities regulator CONSOB. One entry was contributed by the Dutch supervisor AFM, one more by the National Bank of Slovakia. That makes exactly three supervisory authorities that have ever filled the shared European register.

For comparison: MiCA applies in all 27 EU member states and, through the EEA agreement, additionally in Iceland, Liechtenstein and Norway. Each of those countries has at least one competent authority. So 27 of 30 jurisdictions are represented in the register with zero entries.

A technical detail on the side that gets in the way of any analysis of this file: the name of the Italian authority is recorded in two spellings that differ only by an extra space. Anyone grouping by authority name therefore arrives at four authorities instead of three. We merged the two spellings.

The imbalance allows two readings, and both remain conjecture as long as no authority explains its practice. It is possible that fewer unauthorised offerings are simply identified elsewhere. It is equally possible that the findings are made but not reported to ESMA, because Article 110 sets no deadline and no procedure for transmission. Which of the two explanations applies cannot be read out of the file.

For you as an investor in Germany, the second number is the more important one: zero. Not one entry in the European register comes from the Federal Financial Supervisory Authority.

That expressly does not mean BaFin is inactive. It publishes consumer notices on providers supplying financial and crypto-asset services without permission, and it is doing so at a high frequency in 2026. Our analysis of the BaFin warnings on crypto platform series showed how extensive this national body of material is. It is simply that none of it reaches the European register.

In practice that means: if you look up a doubtful provider in the ESMA register and fail to find it there, you have learned nothing about the German market. A search in the European register does not replace a look at BaFin's own records. At best it adds cases from Italy.

Those two words from Article 110, paragraph 1 are the legal core of the whole matter. The legislator deliberately set the register up as "non-exhaustive". It therefore makes no claim to capture every unauthorised provider.

That wording is neither an oversight nor a weakness of implementation, but a conscious decision in the text of the regulation. For practice it has an uncomfortable consequence: an entry in the register is a solid warning signal, while its absence is no signal whatsoever. From "it is not in there" it follows neither that a provider is authorised nor that any authority has examined it.

Anyone seeking a statement about a provider's authorisation therefore has to go the other way and look in a positive list. Which providers actually hold a permission in the EU is recorded in a different register, and the question of what else you should look at in a regulated platform we cover in our overview of the best regulated crypto exchanges.