MiCA register: only 21 of 329 authorisations are trading platforms

Since 1 July 2026, any platform serving customers in the EU needs a granted MiCA authorisation. An application in progress no longer counts. The European Securities and Markets Authority publishes the register of authorised providers as an open file, no login required. An analysis of that register, dated 4 August 2026 and pulled on 6 August, reveals a striking gap between the industry's self-description and the official record. Of 329 authorisations, exactly 21 permit the operation of a trading platform.

The register holds 329 authorisations spread across 322 legal entities with their own LEI code and 26 states of the European Economic Area. The gap between the two figures comes down to companies appearing more than once, typically where an authorisation was later extended.

Germany leads with 72 authorisations, more than twice as many as second-placed France with 35. The Netherlands follow with 29, Cyprus with 27 and Malta with 22. Together those five countries account for 185 of the 329 authorisations, or 56 per cent. The German lead has a cause that has little to do with crypto: a large share of the domestic authorisations sits with banks, savings-bank networks and investment firms that offer crypto trading as an add-on to an existing business. Of the 72 German authorisations only two permit the operation of a trading platform, and 56 apply to the German market alone. Germany does not lead because an unusual number of trading venues sprang up there. It leads because the established financial sector filed as a bloc.

MiCA defines ten separate services, each authorised individually. An authorisation is not a blanket seal but a list of permitted activities. Custody of crypto-assets is the most common at 221 mentions, followed by transfer services at 206 and exchange for euros or other currencies at 184. At the bottom sits the service most people have in mind when they say "crypto exchange": operating a trading platform appears 21 times. That is 6.4 per cent of all authorisations.

A trading platform under the regulation brings together the orders of different clients in an order book. You trade against other users; the operator only provides the venue. The far more common service, "exchange of crypto-assets for funds", works differently: there the provider is your counterparty. It quotes you a price and you take it or leave it. Both are legal, both are regulated, and for many retail investors the broker model is in fact more convenient. The pricing simply works differently. In the register 170 providers may exchange against funds without running a trading platform. With them the margin sits in the spread, the gap between the buying and the selling quote, and that is rarely disclosed as clearly as a percentage fee. Confusing the two models means comparing costs that are not comparable.

MiCA's central promise is the European passport: an authorisation from one member state is valid across the single market. A provider authorised in Ireland may operate in Spain, Poland and Finland without a further procedure. In practice this is used far less often than expected. The distribution splits into two camps with almost nothing in between. 125 authorisations cover exactly one country. 150 cover 25 countries or more, most of them 29 or 30. The middle is missing: only 49 providers sit somewhere between two and 24 countries. Two very different business models sit behind that. One group are regional institutions, often banks, serving an existing client base with no interest in going abroad. The other are platforms that think in European terms from the outset and treat the passport as the actual reason for applying. For consumers this matters, because a provider holding a single national authorisation may not serve you if you live elsewhere.

Plot the authorisations by month and a pattern emerges that supervisors know from other regulatory projects. For a year and a half monthly authorisations moved in the low double digits. December 2025 brought a first spike to 44. Then, in June 2026, the last month before the deadline, 76 authorisations were granted, more than in the preceding five months combined. July brought 31, August three up to the register date. The effect has an uncomfortable side. Firms that made it through in June often filed late. Supervisors had little time, and the review period of up to four months that MiCA allows for a complete file is likely to have been used to the limit in many cases.

For others the deadline became the exit. In July 2026 AscendEX, BitMEX and BitMart announced they would give up their EU business or close entirely. At BitMart trading ends on 26 August 2026 and the platform shuts on 31 January 2027. AscendEX ceased operations on 1 July, with withdrawals available only on a limited basis. Anyone still holding balances there should arrange to move them rather than wait for an extension.

The most useful point in the register is also the easiest to miss. MiCA protection does not attach to a brand. It attaches to the specific legal person that received the authorisation, and that entity is almost never named after the app on your phone. Kraken appears in the register as Payward Global Solutions Limited and Payward Europe Solutions Limited, both in Ireland. Crypto.com is listed as Foris DAX MT Limited in Malta. Behind Coinbase sits Coinbase Luxembourg S.A., behind the European Bybit entity Bybit EU GmbH in Austria. Bitpanda holds three authorisations: in Austria, in Germany and through BP23 CA Limited in Malta. Look in the terms and conditions or the legal notice to see which company you are actually contracting with. That is the name to search for in the register, not the brand. If the contracting party is based outside the EEA, MiCA protection does not apply, even where a sister company holds an EU authorisation.

A word on data quality, because it explains why figures circulating about this register diverge. The field listing the authorised services is not filled in consistently. Most supervisors prefix the service letter, as in "b. operation of a trading platform". In 20 of the 329 entries that letter is missing altogether, mostly in Cypriot and Estonian authorisations. Search for the letter alone and those entries drop out of the count, among them one trading platform. At one German institution the letters are shifted by a position, so the text and the label no longer agree. One provider is entered twice with an identical record, and two French companies share the same LEI code. The analysis therefore identified the services from the descriptive text and cross-checked the result against the letter-based method. None of this is a charge against ESMA, which consolidates what national authorities report. It is a reminder that any number drawn from this register should travel with the method that produced it.

A register answers the question of who may operate legally. It does not answer where it makes sense to trade. A Latvian payment provider with a single national authorisation and a pan-European trading venue are worlds apart, yet both sit in the same register and both may legitimately advertise as "MiCA licensed". That is why a curated selection earns its place. AlphaScala's comparison of MiCA-regulated crypto exchanges states for each provider the legal entity and the date of authorisation, each checked against the register. For a broader view there is the general exchange comparison; and anyone holding for the long run is independent of any platform's licence with a hardware wallet anyway.

Disclosure: some of the providers named in our comparison work with us through partner programmes. This has no bearing on the analysis of the ESMA register – every figure in this article comes from the official file and can be reproduced from it. Whether a provider is a partner changes nothing about its licence status. This article is not investment advice and not a recommendation to buy or sell crypto-assets. Crypto-assets are highly volatile and a total loss is possible. Analysis as of 6 August 2026; ESMA register as of 4 August 2026.