Key takeaways
- "MiCA-licensed" means authorised as a crypto-asset service provider (CASP) by a national authority under Regulation (EU) 2023/1114.
- An authorisation covers only the services it names. Just 22 of the 370 rows in ESMA's register file list service b, the operation of a trading platform.
- One authorisation can be used in other EEA states, and the register lists the countries for each provider.
- Anyone can check a provider in ESMA's register file, last modified on 7 October 2026, and in national databases such as those of the FMA and BaFin.
- Authorisation sets conduct and safekeeping duties. It does not protect you against falling prices and it is not a deposit guarantee.
What "MiCA-licensed" means
A MiCA-licensed crypto exchange or broker is a company that a national authority in the EU or EEA has authorised as a crypto-asset service provider (CASP) under Regulation (EU) 2023/1114, the Markets in Crypto-Assets Regulation. Article 59(1) lets only two groups provide crypto-asset services in the Union: companies authorised under Article 63, and financial firms that already hold another licence, such as banks, investment firms and e-money institutions, which notify their authority under Article 60.
"Licence" is everyday usage; the regulation says "authorised". Every authorisation has to specify the services it covers (Article 59(6)), and the authority decides within 40 working days of a complete application (Article 63(9)). More guides on EU rules are listed under all guides in Bitpanda Academy.
Terms used in this guide
- CASP
- Crypto-asset service provider: a company allowed to provide one or more of the ten services (Article 3(1)(15)).
- Competent authority
- The national supervisor that grants the authorisation, such as the FMA in Austria or BaFin in Germany.
- Home Member State
- The country of the provider's registered office (Article 3(1)(33)).
- Host Member State
- Any other country where it provides services (Article 3(1)(34)).
- Passporting
- The everyday name for using one authorisation in other countries under Article 65.
- LEI
- Legal entity identifier: a 20-character code printed next to each legal name in the register.
The ten crypto-asset services
MiCA defines ten crypto-asset services in Article 3(1)(16), lettered a to j, and an authorisation covers only the letters it names. The table gives the regulation's wording and what each service means for a customer.
| Letter | Service in the regulation | What this means for you |
|---|---|---|
| a | Providing custody and administration of crypto-assets on behalf of clients | The provider holds your crypto-assets, or the keys to them. |
| b | Operation of a trading platform for crypto-assets | The provider runs a marketplace where many buyers and sellers trade with each other: an exchange in the strict sense. |
| c | Exchange of crypto-assets for funds | The provider itself sells you crypto for euros, or buys it from you, with its own capital: the broker model. |
| d | Exchange of crypto-assets for other crypto-assets | As c, but you swap one crypto-asset for another. |
| e | Execution of orders for crypto-assets on behalf of clients | The provider concludes the purchase or sale for you. |
| f | Placing of crypto-assets | The provider markets crypto-assets on behalf of the party that offers them. |
| g | Reception and transmission of orders for crypto-assets on behalf of clients | The provider passes your order to a third party that executes it. |
| h | Providing advice on crypto-assets | The provider gives you personalised recommendations. |
| i | Providing portfolio management on crypto-assets | The provider manages a portfolio for you under a mandate. |
| j | Providing transfer services for crypto-assets on behalf of clients | The provider moves crypto-assets for you between addresses or accounts. |
The difference between b, c, d and e explains why two companies that both call themselves an exchange can hold different permissions. A trading platform (b) is a multilateral system that brings together many third-party buyers and sellers (Article 3(1)(18)). Under c and d the provider is your counterparty and trades "by using proprietary capital" (Article 3(1)(19) and (20)). Under e it concludes the trade on your behalf.
Service b is the rare one: only 22 of the 370 register rows list it. A separate guide explains why a broker and an exchange hold different permissions and what that means for prices and custody.
What an authorised provider must do
An authorised provider has to follow the conduct rules of Title V of MiCA, and three of them can be tested from the outside before you open an account.
Honest, clear information and risk warnings
Everything a provider tells you has to be accurate, and advertising has to be labelled as advertising. Article 66(2) requires information that is:
"fair, clear and not misleading, including in marketing communications, which shall be identified as such"
Regulation (EU) 2023/1114, Article 66(2), read on 11 October 2026
Article 66(3) adds a duty to warn clients of the risks of crypto-asset transactions. Platforms, brokers, advisers and portfolio managers must also link to the white papers of the crypto-assets they deal in. A product page without a risk warning fails this test at first sight.
Published prices and fees
A provider has to publish what it charges. Under Article 66(4) its policies on pricing, costs and fees must be public "in a prominent place on their website", so a price list that only appears after sign-up does not meet the rule. For comparison, the Bitpanda published fee schedule sets out trade fees and limits on one page.
Safekeeping of client assets
A provider that holds your crypto-assets must keep them apart from its own and must not use them for itself. Article 70(1) demands "adequate arrangements" to safeguard clients' ownership rights, especially in an insolvency, and to prevent the use of clients' crypto-assets for the provider's own account. Client money must be placed with a bank or a central bank by the end of the next business day (Article 70(3)).
Custody also needs a written agreement that covers at least the custody policy, the security systems, the fees and the applicable law (Article 75(1)). The provider sends a statement of your positions at least every three months and must hold client assets so that its own creditors have no recourse to them (Article 75(5) and (7)). The security page shows how Bitpanda meets the safekeeping duty.
What a MiCA licence does not cover
A MiCA authorisation regulates how a provider behaves. It does not make crypto-assets less volatile and it does not insure your holdings. Four limits matter most.
- Price losses. No rule in MiCA compensates you when the market falls.
- Deposit protection. Crypto-assets are not bank deposits, and the regulation sets up no deposit guarantee or compensation scheme for them.
- Derivatives. MiCA does not apply to crypto-assets that qualify as financial instruments (Article 2(4)(a)). Derivative contracts on crypto-assets fall under MiFID II, Directive 2014/65/EU, and need a separate licence.
- Products outside the list. A provider can offer products that are none of the ten services. Crypto-assets that are unique and not fungible are outside the regulation as well (Article 2(3)).
Bitpanda's own disclosures show the last point first-hand. On the live staking page, read on 6 October 2026, Bitpanda GmbH describes its stablecoin lending product, Earn on Stablecoins, as an unregulated product that is "not classified as a regulated crypto-asset service" under MiCAR, and states that no deposit protection applies. The product page sets out the staking and stablecoin lending disclosures side by side.
Crypto-assets are highly volatile. You could sustain a loss of some or all of your investment, so it is important to invest only what you can afford to lose.
This section describes the regulation in general terms. It is not legal advice.
One authorisation, thirty countries: passporting
An authorised provider can serve clients in other Member States without a second licence and without an office there (Article 59(7)). The home Member State is the country of its registered office; a host Member State is any other country where it provides services. Under Article 65 the provider tells its home authority which countries and services it plans to cover, the authority informs the host states, ESMA and the EBA within 10 working days, and the provider may start no later than the 15th calendar day after its notice.
The register shows the result. In the file counted for this guide, 101 rows list all 30 EEA country codes (the 27 EU Member States plus Iceland, Liechtenstein and Norway) and 144 rows list exactly one. The Bitpanda GmbH row lists all 30.
How to check a provider in the ESMA register
ESMA, the European Securities and Markets Authority, keeps the central register of crypto-asset service providers, which Article 109 requires to be "publicly available on its website". For now it is an interim register: five CSV files on ESMA's MiCA page, republished every week. The check takes three steps.
Find the legal entity
- Open ESMA's page on the Markets in Crypto-Assets Regulation, go to "Interim MiCA Register" and note the "Last update" date.
- Download the file "Crypto-asset service providers". It opens in any spreadsheet program.
- Search for the legal name of the company, not the brand. The legal name is in the legal notice, imprint or terms of the website.
- If there is no row, open the file "Non-compliant entities" and ask the company which legal entity serves you and under which authorisation.
Read the row
Each row is one authorisation or notification, and nine of its fields answer almost every question. The figure shows them for a real row.
- Fields 1 and 2 name the supervisor. Read both: "FMA" is the abbreviation of the Austrian authority and of the Finanzmarktaufsicht in Liechtenstein, and only the home-state column tells them apart.
- Fields 3 to 5 identify the company. The legal name must match the legal notice of the website you use, and the website field should show the domain you are on.
- Field 6 is the authorisation or notification date. A filled end-date column beside it means the authorisation has ended; two rows in the file carry one.
- Field 7 lists the services by letter. A missing letter is a missing permission.
- Fields 8 and 9 list the countries and the date the row was last changed.
The national authorities type the entries, so expect small inconsistencies. In the file counted here Greece appears both as GR and as EL, and one row carries a date in 2028.
The same file can be counted. By home Member State it looks like this.
| Home Member State | Competent authority as named in the file | Rows |
|---|---|---|
| Germany | Federal Financial Supervisory Authority (BaFin) | 103 |
| France | Autorité des Marchés Financiers (AMF) | 36 |
| Netherlands | Netherlands Authority for the Financial Markets (AFM) | 29 |
| Cyprus | Cyprus Securities and Exchange Commission (CySEC) | 25 |
| Malta | Malta Financial Services Authority (MFSA) | 23 |
| Spain | Comision Nacional del Mercado de Valores (CNMV) | 15 |
| Luxembourg | Commission de Surveillance du Secteur Financier (CSSF) | 13 |
| Czechia | Czech National Bank (CNB) | 12 |
| Ireland | Central Bank of Ireland (CBI) | 12 |
| Latvia | Latvijas Banka | 12 |
| Liechtenstein | Finanzmarktaufsicht (FMA) | 12 |
| Austria | Austrian Financial Market Authority (FMA) | 11 |
| Italy | Commissione Nazionale per le Societa e la Borsa (CONSOB) | 9 |
| 14 other states | From Denmark (7 rows) to Iceland, Portugal and Sweden (1 row each) | 58 |
| All 27 home states | 370 | |
| Method: the file CASPS.csv was downloaded from ESMA and counted by script. A row is one authorisation or notification entry, not one brand. | ||
A row count is not a quality score. It shows where providers chose to apply, and one group can appear several times: three rows carry the name Bitpanda.
Compare it with the website
The last step is to hold the row against what the website says. Is the company named in the footer the company in the row? Does the service you want appear in field 7? Is your country in field 8?
Illustration with invented figures
Suppose a platform advertises "licensed in 27 countries". You find one row: one home state, services a, c and d, and 12 country codes. The accurate summary is one authorisation, three services and 12 countries. If you want to trade on an order book (service b) from a 13th country, this row does not cover you. The numbers in this example are invented and describe no real company.
How to check the national registers: FMA and BaFin
The database of the home authority is the second source, and the authority maintains it itself. ESMA republishes its file weekly and notes that a change reported by an authority is not shown immediately, so the national entry can be newer.
Austria: FMA company database
In Austria you search the FMA company database by company name. Crypto-asset service providers appear in two categories: "CASP - Crypto-Asset Service Provider (AT)" for companies with an Austrian authorisation, and "CASP - Notifizierte EWR-CASP" for providers from other EEA states that have notified their services to Austria.
On 11 October 2026 the entry for Bitpanda GmbH showed the category, the address, the website and commercial register number 569240v, and no separate licence number. It showed neither an authorisation date nor the host countries; those are in the ESMA row. The database has no fixed address for a single entry, so keep the search you ran.
Germany: BaFin company database
In Germany the BaFin company database takes a company name or a BaFin-ID, and it has an English version. Its category list includes "crypto-asset service provider" and "MiCAR issuers", and the search page prints the date of its data: 11.10.2026 when this guide was checked. A BaFin-ID is the fastest key. Bitpanda Asset Management GmbH, for example, publishes BaFin-ID 10159692 in its legal notice.
Other countries work the same way. The register file names the Autorité des Marchés Financiers (AMF) for France, CONSOB for Italy and the CNMV for Spain, and the ESMA file is the common check across all of them.
Worked example: reading the Bitpanda entries
Three rows in the register file carry the name Bitpanda, and reading them side by side shows what the fields are for.
| Legal entity and LEI | Competent authority | Date | Services | Countries |
|---|---|---|---|---|
| Bitpanda GmbH 5493007WZ7IFULIL8G21 | Austrian Financial Market Authority (FMA) | 09/04/2025 | a, c, d, e, f, g, j | 30 |
| Bitpanda Asset Management GmbH 9845005X9B7N610K0093 | Federal Financial Supervisory Authority (BaFin) | 24/01/2025 | a, c, d, j | 30 |
| BP23 CA Limited, commercial name Bitpanda 984500DEID7B03J77118 | Malta Financial Services Authority (MFSA) | 27/01/2025 | a, c, d, e, g, j | 1 |
- Bitpanda GmbH serves the EU and EEA clients of the Bitpanda broker and app. It is authorised as a crypto-asset service provider under MiCAR by the Austrian Financial Market Authority (FMA), under commercial register number 569240v. Its row is dated 9 April 2025, the earliest date among the 11 rows with Austria as home state.
- Its services are a, c, d, e, f, g and j. Bitpanda may hold assets, buy and sell crypto as a broker, execute and transmit orders and make transfers. Service b is missing, so it does not operate a trading platform; none of the 11 Austrian rows lists service b.
- Bitpanda Asset Management GmbH is a separate company in Berlin with a shorter list: a, c, d and j. The FMA database shows it among the notified EEA providers, which is passporting seen from the host side.
- BP23 CA Limited is listed for Malta only. Its role in the group is not described here.
Now compare the rows with the website. The legal notice says that Bitpanda Asset Management GmbH is "Authorised as Crypto Asset Service Provider under MiCAR with BaFin (BaFin-ID: 10159692)", which matches the row. The live home page, read on 6 October 2026, shortens this to "Licensed by the FMA (Austria) and BaFin (Germany)". Both authorities are correct, but the short form hides that two different companies are involved and uses a verb the regulation does not use. The About page lists the Bitpanda group companies with their roles.
Check the entries yourself
Every company, regulator, identifier and register link is on one page: Bitpanda licences and register entries.
Key dates
MiCA has applied in full since 30 December 2024, and the last transitional arrangements ended on 1 July 2026.
| Date | What happened | Source |
|---|---|---|
| 9 June 2023 | Publication in the Official Journal of the European Union (L 150). | Official Journal |
| 30 June 2024 | Titles III and IV, the rules for asset-referenced tokens and e-money tokens, start to apply. | Article 149(3) |
| 30 December 2024 | The regulation applies in full, including the authorisation duty for service providers. | Article 149(2) |
| 1 July 2026 | Latest end of the transitional period for providers that worked under national law before 30 December 2024. | Article 143(3) |
Member States could shorten the transitional period or not apply it at all (Article 143(3)), so it ended earlier in some countries. A provider that still points to an older national registration alone should be asked for its row in the register.
Red flags when a platform says it is regulated
A regulated provider can prove its status with three things: a legal entity, an authority and a register entry. Take a closer look when one of these five signs appears.
- A regulator without an entity or identifier. "Regulated in the EU" with no company name, authority or register link cannot be checked.
- "Registered" presented as "licensed". An entry in an anti-money-laundering register is not a MiCA authorisation.
- A licence from outside the EU used to serve EU residents. Ask for the row in the ESMA register.
- A different domain. The website field of the row does not show the site you are on.
- A licence count without a list. "Licensed in 20 countries" says little until each entity and authority is named. Under MiCA, one authorisation with a list of host countries is the normal case.
None of these signs proves wrongdoing. Each one is a reason to open the register before you send money. When the provider checks out, the next guide explains how to buy Bitcoin in Europe once you have checked the provider, and the product page shows how to buy Bitcoin from an authorised provider.
Frequently asked questions
Is there an official list of MiCA-licensed crypto exchanges?
Yes. ESMA publishes the interim MiCA register of crypto-asset service providers as a file on its MiCA page and republishes it every week. The file last modified on 7 October 2026 has 370 rows from 27 home states. It is a register, not a ranking: a row confirms the authority, the services and the countries, and says nothing about fees or service quality.
Is Bitpanda MiCA-licensed?
Yes. Bitpanda GmbH is authorised as a crypto-asset service provider under MiCAR by the Austrian Financial Market Authority (FMA), under commercial register number 569240v. The ESMA register dates the authorisation 9 April 2025 and lists services a, c, d, e, f, g and j for all 30 EEA states. Service b is not listed, so Bitpanda acts as a broker and does not operate a trading platform.
Does a MiCA licence make an exchange safe?
No licence removes risk. Authorisation means a provider must give fair information, warn you of the risks, publish its fees and keep client assets apart from its own. It does not protect you against falling prices, and it does not remove counterparty or operational risk. Crypto-assets held with a provider are not bank deposits.
What is the difference between registered and authorised?
Authorised means that an authority has assessed an application and granted permission for named services, which is what Articles 59 and 63 of MiCA require. Registered only means that a firm appears in a register, and some registers cover anti-money-laundering supervision alone. Under MiCA the register entry follows the authorisation, so check which of the two words a platform uses.
Can a non-EU exchange serve EU customers?
As a rule, no. Article 59 of MiCA allows only authorised providers and notified financial firms to provide crypto-asset services in the Union. Article 61 has a narrow exception for a client who approaches a non-EU firm entirely on their own initiative, and a firm that advertises to clients in the Union cannot rely on it. This is general information, not legal advice.
Sources
- Regulation (EU) 2023/1114 on markets in crypto-assets, Official Journal L 150, 9 June 2023. Text read in the Publications Office copy: https://publications.europa.eu/resource/cellar/01d55833-0660-11ee-b12e-01aa75ed71a1.0006.03/DOC_1. EUR-Lex record: https://eur-lex.europa.eu/eli/reg/2023/1114/oj. Accessed 11 October 2026.
- ESMA, Markets in Crypto-Assets Regulation (MiCA), with the interim MiCA register and its update notes: https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/markets-crypto-assets-regulation-mica. Accessed 11 October 2026.
- ESMA, interim MiCA register, file of crypto-asset service providers (CSV, last modified 7 October 2026): https://www.esma.europa.eu/sites/default/files/2024-12/CASPS.csv. Accessed 11 October 2026.
- Austrian Financial Market Authority (FMA), company database, search for "Bitpanda": https://www.fma.gv.at/en/search-company-database/?cname=Bitpanda&place=&bic=&category=&per_page=10&submitted=1. Accessed 11 October 2026.
- Federal Financial Supervisory Authority (BaFin), company database: https://portal.mvp.bafin.de/database/InstInfo/. Accessed 11 October 2026.
- Bitpanda, legal notice of the live website, www.bitpanda.com/en/legal/legal-notice. Read on 6 October 2026.
- Bitpanda, live home page and staking page, www.bitpanda.com/en and www.bitpanda.com/en/staking. Read on 6 October 2026.
For information only. Not investment advice.