MiCA license by country: authorized CASPs, transitional periods and supervisors

A MiCA license is the authorization as a crypto-asset service provider (CASP) that a Member State's supervisor grants under Article 63 of Regulation (EU) 2023/1114, and it lets the firm serve the rest of the EU after notifying that supervisor (Article 65). As of October 7, 2026, ESMA's register lists 365 entities: Germany (100), France (36), the Netherlands (28), Cyprus (24) and Malta (23) lead, and Spain has 15. The transitional periods under Article 143(3) are over across the EU: none could run beyond July 1, 2026.

What CASP authorization is and how the passport works

Under Article 59(1) of the MiCA Regulation, only two kinds of entity may provide crypto-asset services in the EU: those authorized as a CASP under Article 63, and certain already-regulated financial firms (banks, central securities depositories, investment firms, market operators, e-money institutions and fund managers) that notify their supervisor in advance (Article 60; banks at least 40 working days before starting). Tokenized securities are outside its scope: MiCA does not apply to crypto-assets that qualify as financial instruments (Article 2(4)), as we explain in MiCA vs MiFID II.

Ten services require authorization (Article 3(1)(16)): custody and administration on behalf of clients, operating a trading platform, exchanging crypto-assets for funds, exchanging them for other crypto-assets, executing orders, placing, receiving and transmitting orders, advice, portfolio management and transfer services on behalf of clients.

The application goes to the competent authority of the home Member State (Article 62(1)). Among other things, it must include the program of operations, proof of prudential safeguards, governance arrangements, the fitness of directors and qualifying shareholders, internal control and anti-money laundering procedures, technical documentation of the ICT systems and the procedure for segregating client assets (Article 62(2)). Minimum capital is the same across the EU: €50,000, €125,000 or €150,000 depending on the class of services (Annex IV), or one quarter of the previous year's fixed overheads if that is higher (Article 67(1)).

The passport works like this: the CASP tells its supervisor which Member States it intends to serve, which services and from what date; the supervisor forwards this to the host states, ESMA and the EBA within 10 working days, and the CASP may start once it receives confirmation or, at the latest, on the 15th calendar day after its notification (Article 65). It needs no physical presence in the host state (Article 59(7)).

CASPs by country, transitional period and supervisor

We counted the entities on ESMA's interim MiCA register (CASP file updated on October 7, 2026, and downloaded on October 13, 2026). It has 370 rows: we removed 2 withdrawn authorizations and 3 German entities listed twice, which leaves 365 registered entities. The register covers both CASPs authorized under Article 63 and financial firms providing services after an Article 60 notification. The supervisor is the one named on the register; for Belgium, Italy and Portugal we add the split of powers shown on ESMA's list of competent authorities (Article 93), and for countries with no entities we use that list. The transitional period is the one each state reported to ESMA.

Three things stand out. First, no transitional period remains open in the EU. Article 143(3) allowed firms to keep operating under national law until July 1, 2026, at the latest, and several states cut that to 12, 9 or 6 months. Some also required firms to apply for authorization by a set date: Denmark (30 Dec 2024), Czechia (31 Jul 2025), Bulgaria (8 Oct 2025, for firms on its former register) and Italy (30 Dec 2025). ESMA notes that some periods were reported by supervisors and might not yet have been written into national law. Second, concentration is high: five states account for 211 of the 365 entities (as of October 7, 2026). Third, Hungary, Poland and Romania have none; on ESMA's list of competent authorities (updated February 17, 2026), Romania still had no designated authority and Poland's KNF was listed as not yet formally designated. Iceland, Liechtenstein and Norway are not EU members but appear on ESMA's lists as EEA states.

Who already holds a MiCA license: list by country

The official list of firms authorized (Article 63) or notified (Article 60) to provide crypto-asset services under MiCA is ESMA’s interim register, which can be downloaded as a CSV file from its MiCA page. The data in this section come from the crypto-asset service provider file updated on October 7, 2026, the latest version published as of October 13, 2026; ESMA says it publishes a new version every week. The register reflects what national supervisors report to ESMA, so a recent authorization may take time to appear. It includes both CASPs authorized under Article 63 and financial firms that provide services after an Article 60 notification, with no field that tells them apart. ESMA does not publish national tax IDs, but it does publish each firm’s LEI code.

Spain: the 15 entities on the register

* Two LEIs on ESMA’s register are not valid. The one for Prosegur Custodia de Activos Digitales has 19 characters, while an LEI has 20: the one listed for that entity in the GLEIF database is 959800G0P3PV13KLX615. The one for Fintech Payments PSC fails the ISO 17442 check-digit test and does not exist in GLEIF; at the same address, GLEIF lists FINTECH PAYMENTS SL with LEI 89450070D4N398B1XL35.

The five countries with the most entities

Germany, France, the Netherlands, Cyprus and Malta account for 211 of the 365 registered entities. The table gives the number of entities in each country and the first ones by authorization or notification date.

For Germany, the file has 103 rows because three entities appear twice (DekaBank Deutsche Girozentrale, Deutsche WertpapierService Bank AG and EUWAX AG); each is counted once. Two entities in the file have had their authorization withdrawn and are not counted: Stratos Europe Ltd (Cyprus, withdrawn on Apr 24, 2026) and Decubate B.V. (Netherlands, Mar 26, 2026, at the firm’s own request). To check a specific firm, search for it by name in the current file and in its national supervisor’s register, which may be more up to date: if the withdrawal date column in ESMA’s file is filled in, the firm is no longer authorized.

How to choose a jurisdiction

The substantive rules are the same everywhere: MiCA is a regulation, minimum capital does not change and the authorization opens the same market. What changes is the supervisor. These are the criteria that can be checked against official sources.

Timelines

The legal clock is common to all (Article 63): 25 working days to check that the application is complete, 40 working days to decide once it is, and a single pause of up to 20 working days if the supervisor asks for more information. What slows the process down is an incomplete file. The CNMV and BaFin both refer to these deadlines rather than publishing an average processing time. BaFin gives applicants four weeks to supply missing documents, following ESMA's recommendation, and rejects the application if it is still incomplete.

Language and procedure

Each supervisor sets its own procedure. The CNMV publishes its authorization manual in Spanish, requires filing through its electronic office and complements it with a Q&A document (December 15, 2025). Before choosing, check on each supervisor's website which language it accepts for the application and supporting documents.

Supervisory fees

Fees are not harmonized. These are the ones we found published in each state's rules:

• Malta (MFSA): an application fee of €10,000, €20,000 or €25,000 depending on the class of services, and an annual fee of €10,000, €25,000 or €50,000, plus €2,000 per service and 0.05% of transaction volume, capped at €250,000 for that component (regulation 6 of L.N. 295 of 2024).
• Cyprus (CySEC): an application fee per service, from €5,000 (exchange or transfer services) to €30,000 (trading platform), and an annual fee made up of a fixed amount per service plus a surcharge on crypto turnover above €500,000, with an overall cap of €500,000 (Directive DI 73-2009-04 of 2024; the Greek text is the binding one).
• Germany (BaFin): the fee is charged according to the time spent (item 32.1.2 of the annex to the FinDAGebV) and is payable even if the application is withdrawn or refused.
• Spain (CNMV): the manual names the applicant as liable for the fee under Law 16/2014 and requires non-residents to appoint a representative in Spain to pay it (Article 6 of that law). The consolidated text of Law 16/2014 published in the BOE does not yet set a specific amount for CASP authorization.

Local substance

MiCA requires substance in the EU: an authorized CASP must have its registered office in a Member State where it carries out at least part of its services, its place of effective management in the Union and at least one director resident in the EU (Article 59(2)). The CNMV accepts co-working offices if the space suits the headcount, is separate from other companies and does not hinder supervision (question 1.6 of its Q&A). Serving EU clients from outside the EU is only possible at the client's own exclusive initiative: a firm that solicits clients in the EU, by any means, no longer qualifies (Article 61).

Target market

Because the passport opens the whole EU, the licensing country need not be the main market. On ESMA's register, as of October 7, 2026, 188 of the 350 entities based outside Spain list Spain among the states where they intend to provide services. What stays in the home state is the relationship with the supervisor: that is where extensions of services (Article 59(8)) and changes to the management body (Article 69) are handled.

Spain in detail

In Spain, the competent authority for CASPs is the CNMV; the Bank of Spain is responsible for issuers of asset-referenced and e-money tokens, according to ESMA's list of authorities. The Spanish transitional period lasted 18 months and ended on July 1, 2026, according to the CNMV: since then, registration with the Bank of Spain as a virtual currency exchange or wallet custody provider is no longer enough to operate. We cover this in the end of the CASP transitional regime in Spain. More on this in how tokenization is regulated in Spain.

As of October 7, 2026, ESMA's register lists 15 entities with Spain as home state: BBVA, Openbank, Cecabank, Bit2Me (Bitcoinforme), Renta 4 Banco, Kutxabank, CaixaBank, DUE Network, Crossmint Europe, Criptan, Minos Global, Prosegur Crypto, Iqana Technologies, Fazil Crypto (Basque Pay) and Cryptopocket (Fintech Payments PSC). Six are banks, which can use the Article 60 notification, and ten of the fifteen entries are dated 2026.

Three practical points from the CNMV. Its authorization manual is mandatory and applications are filed through its electronic office. Once authorization is granted, the firm must complete its corporate formalities before the CNMV reports it to ESMA and it can start operating (question 1.4). And, in the CNMV's view, only authorized firms may market crypto-asset services and attract clients, with no agents (question 2.4). The application requirements are in our guide to the CASP license in Spain, and our CASP license test helps you check whether your activity needs one.

How we work on CASP projects

Unknown Gravity is not a law firm and does not handle license applications. We are the technical team that builds the infrastructure the application describes (custody, segregation of client assets, order records and KYC and anti-money laundering integration), working alongside the client's local legal counsel in whichever country it chooses.

Official sources

• Regulation (EU) 2023/1114 (MiCA) on EUR-Lex
• ESMA: MiCA and the interim CASP register
• ESMA: transitional periods by Member State (Art. 143(3))
• ESMA: designated competent authorities (Art. 93)
• CNMV: MiCA, new crypto-asset regulation (in Spanish)
• CNMV: MiCA questions and answers, December 15, 2025 (in Spanish)

Framework verified as of October 13, 2026. A CASP project in Europe? Talk to us.