How to Check if a Crypto Firm Is Authorized Under MiCA: A Step-by-Step Guide

In the EU and EEA, you check a crypto firm in the MiCA register by downloading the CASPS.csv file from ESMA (the EU's markets authority), searching for the company's exact legal name, and reading which services it offers and in which countries. Then you search the NCASP.csv file of non-compliant entities. A brand name in the file does not by itself cover the company you would sign a contract with, so match the legal entity in your terms. The steps follow ESMA's page (opens in a new tab) and files as read on 18 October 2026. If you live outside the EU and EEA, use the register for your own country in the registration check.

What the interim MiCA register is and which files to open

As of October 2026, the ESMA MiCA register is the interim MiCA register that ESMA's MiCA page (opens in a new tab) offers as downloadable CSV files. The page showed "Last update: 16 October 2026" when we read it on 18 October. Interim means the register is a set of files you open in a spreadsheet, not a search tool. National authorities and the European Banking Authority send ESMA the information in it.

Two of the five files matter to a buyer:

• CASPS.csv lists authorized crypto-asset service providers (CASPs): companies that offer services such as holding, exchanging or sending crypto for clients.
• NCASP.csv lists non-compliant entities that provide crypto-asset services.

ESMA also links a separate field-description file that explains the columns. The other three of the five files cover white papers and token issuers, so you can skip them.

ESMA publishes the files weekly, so something a national authority has reported or listed in its own register may not show yet. ESMA also tells investors to check that the company they use is listed as authorized in the ESMA Interim MiCA Register (opens in a new tab) before they invest or transfer funds. The transition period ended on 1 July 2026. Since then, a company offering crypto services to EU clients without a MiCA license is in breach of EU law and must stop.

If you live in Norway, Iceland or Liechtenstein, the files include firms authorized by those countries' authorities. Check your national regulator as well, using ESMA's list of competent authorities (opens in a new tab) to find its name.

What you need before you start

• The company's full legal name for your country, from its terms or footer. How to check that a crypto exchange serves your country shows where to find it.
• Its LEI (legal entity identifier), if the terms show one.
• The country you live in, and what you plan to do: buy, hold or send crypto out.
• A spreadsheet app, or any tool that can search a CSV file.

How to check a crypto firm in the MiCA register, step by step

As of October 2026, the column names below are the ones in ESMA's field-description file.

1. Download the files from ESMA

   Type esma.europa.eu into your browser yourself, rather than following an ad or a link someone sent you. Open ESMA's MiCA page (opens in a new tab) and download CASPS.csv, NCASP.csv and the field-description file. Open them in a spreadsheet app.

   Dates in the files are written day/month/year. Some cells have stray spaces, so searching part of a name works better than the whole name.

2. Search the legal name, then the LEI

   In CASPS.csv, search the "Name of the CASP" column for the legal name from your terms. Then search the "LEI of the CASP" column, which holds a 20-digit alphanumeric code. The brand name often sits in a separate "Commercial name" column, so a brand match alone does not confirm your contract. Compare the full name letter by letter.

   Brand and company can differ. In ESMA's file of 16 October 2026 (opens in a new tab), two companies carry Kraken names. Payward Europe Solutions Limited was authorized by the Central Bank of Ireland on 25/06/2025 for a long list of services, including custody, exchange for funds and transfers, and lists all EU countries plus Iceland, Liechtenstein and Norway as states where it intends to provide them. In the same file, Payward Global Solutions Limited, also authorized in Ireland, is listed only for operating a trading platform, in Cyprus and Ireland. The Kraken review covers availability by country.

3. Read the authority, the dates and the withdrawal column

   In the row, read "Competent Authority" (the authority that granted the authorization) and "Home Member State" (a two-letter country code). Then read "Date of the authorisation of the CASP" and "Date of the withdrawal of the CASP", which ESMA's field description (opens in a new tab) says is blank where it does not apply.

   A withdrawn authorization stays in the file with the date the withdrawal took effect, so a row can still be there after the authorization has ended.

4. Check the services and your country

   Read "List of crypto-asset services provided by the CASP". The cell spells out each service, with several in one cell separated by "|". Read the words, not only the letters: most rows use MiCA's letters, but a few rows use letters that differ from MiCA's list. The services table explains the ones you are likely to meet.

   Then read the column of member states where the firm intends to provide the services. This is passporting: a provider that wants to serve other member states tells its home authority which states and which services, and may then serve them (opens in a new tab). Your country's two-letter code must be in the list unless it is the home state. Greece appears as GR in some rows and EL in others, so search for both.

5. Search NCASP.csv

   Search NCASP.csv for the legal name, the brand and the website address. MiCA's Article 110 (opens in a new tab) says the register must contain at least the commercial name or the website of a non-compliant entity and the authority that reported it. The file also has columns for the reason and the date of the authority's decision.

   The register is non-exhaustive, meaning it is not a complete list. Most entries come from a few national authorities, so a firm missing from NCASP.csv is not cleared.

6. Decide before you deposit

   Put the three checks together: the exact company, the service you need and your country.

   If the firm is missing but you believe it is authorized, follow the steps for a missing firm.

Example with a made-up register entry

The names and entries below are invented. They are not real firms.

• You find the brand "Northwind Coin" in CASPS.csv. Its Commercial name column matches.
• The company in that row is "Northwind Digital Services B.V.", home state NL, with a blank withdrawal column.
• Your terms name a different company: "Northwind Services Limited". Searching that name and its LEI finds nothing.
• Even if the Dutch company were yours, its member-states column reads "NL | DE | FR". If you live in a country coded ES, your code is missing.

The brand matched and the company did not, and only the company in your contract counts. The check works the same for any firm name.

Which MiCA services to look for in an entry

The register lists companies and the services each one provides, not "MiCA registered crypto exchanges" by brand, so a search ends in a company name and a service list. Six of MiCA's ten services cover buying, holding and sending crypto, in MiCA's words (opens in a new tab):

Pick the rows that match what you plan to do. If the entry lists none of them, or you cannot tell which row covers your plan, ask support which listed service applies to you before you deposit.

If the firm is not in the file

As of October 2026, there are three causes to rule out before you give up:

• The file is weekly, so a very new authorization may be in a national register first.
• The company in your terms may be another company of the same group. Search the legal name from your contract again.
• A typo or a trading name. Search part of the name, and the LEI.

Then check your country's competent authority. Open ESMA's list of competent authorities (opens in a new tab), find your country and its entry for crypto-asset service providers (Title V), and search that authority's own website from an address you type. The list gives names only, with no links to registers. For some countries it marks the authority as not yet formally designated, so it can be out of date.

Do not rely on a list of firms on another website: confirm in ESMA's own file. If the firm shows up in NCASP.csv and already has your money, read what to do if you sent crypto to a scammer.

What authorization does and does not tell you

As of October 2026, ESMA says (opens in a new tab) MiCA protections only apply to the specific authorized legal entity in the EU, not to other companies of the same group and not to non-EU entities. A listing is not a safety rating, and it does not mean the firm's other companies are covered.

In an October 2025 warning (opens in a new tab), the European Supervisory Authorities said consumer protection, if any, might be limited depending on the types of crypto-assets and services you use. MiCA also does not provide investor compensation scheme protections (opens in a new tab) for clients of crypto-asset service providers. The EU line in how to store crypto safely covers what that means for coins you leave on a platform.

Risks to understand

• An authorization can be withdrawn after you check, in whole or for one service. Search again before a larger new deposit.
• Scam firms can look like real ones. See the checks before you send money.
• Crypto prices can fall, and you could lose all the money you put in.

Before your first deposit, read how to check crypto exchange country restrictions and how to buy crypto with a bank transfer.