MiCA license (CASP authorisation): what it is, who has it, and how to check

A MiCA license is the authorisation a firm must hold before it provides crypto-asset services in the European Union. The statute calls that firm a crypto-asset service provider, or CASP. In UK spelling the same authorisation is often called a MiCA licence. Either word points at Regulation (EU) 2023/1114, not at a separate British permission and not at a badge a marketing site can award. The text is on EUR-Lex. ESMA publishes the firms notified under that regime in a public file, CASPS.csv, which is the file this site reads.

The authorisation belongs to a legal entity. It names the services that entity may provide and the member state whose authority granted it. A well-known brand can sit on top of several companies. Only the company on the register is authorised. A group can also hold other licences — a payment institution, an investment firm, an e-money issuer — that say nothing about whether the crypto-asset service itself is covered. Read the legal name and the LEI, then the service codes. The commercial name is a label, useful for search and easy to share across entities.

What the authorisation is

MiCA is the European regulation on markets in crypto-assets. It separates three jobs that people often bundle into the phrase “MiCA license”. One is offering a crypto-asset to the public, or admitting it to trading, which comes with a white paper and liability rules. Another is issuing an asset-referenced token or an e-money token, which has its own titles, reserve rules and issuer duties. The third, and the one this page is about, is providing a crypto-asset service to clients: custody, a trading platform, exchange, execution, advice, portfolio management, transfers and the rest of the CASP list. An issuer authorisation is not a CASP authorisation. A CASP authorisation is not permission to issue a stablecoin.

Titles on asset-referenced tokens and e-money tokens apply from 30 June 2024. The CASP authorisation regime applies from 30 December 2024. Both dates are in the regulation’s application provision (Article 149 on the EUR-Lex text linked above). From that December date, providing a crypto-asset service in the Union requires an authorisation under Title V, unless a transitional rule still covers that firm in that member state. The transitional rule is described later, and it is not a permanent exemption.

The home national competent authority grants or refuses the authorisation. ESMA does not hand the licence out from Paris. ESMA’s role here is to collect what the national authorities notify and to publish the register. That is why a row in the CSV is evidence of a notification, and why the decision itself still sits with the authority named on the row. ESMA’s MiCA page describes the register; the file linked above is the copy this project syncs.

Which services it covers

MiCA lists ten crypto-asset services. The ESMA file encodes them as service codes. On this site those codes are the letters a to j. A firm is authorised for the codes on its rows, not for “crypto” in general. Two exchanges with the same brand story can hold different sets.

• Custody and administration on behalf of clients. The firm holds clients’ crypto-assets, or the means of access to them. That is separate from running a trading platform.
• Operation of a trading platform. The firm runs a system that brings buying and selling interests together. Only forwarding orders is a different service.
• Exchange of crypto-assets for funds. The firm trades crypto-assets against fiat money, using its own capital.
• Exchange of crypto-assets for other crypto-assets. The same dealing activity, between crypto-assets. A firm can hold one of these and not the other.
• Execution of orders on behalf of clients. The firm buys or sells for the client. Execution is not advice and not portfolio management.
• Placing of crypto-assets. The firm markets crypto-assets to buyers for an offeror or an issuer.
• Reception and transmission of orders. The firm receives a client order and passes it on, without necessarily executing it.
• Advice on crypto-assets. Personal recommendations. A public blog post is not, by itself, this service.
• Portfolio management. Discretionary management under a client mandate, which is not automatically a copy-trading feature.
• Transfer services on behalf of clients. Moving crypto-assets between addresses or accounts for a client. Withdrawals usually meet the travel-rule duties here.

One legal entity often has several rows, one per service, and the passport countries can differ. This site groups them by LEI. A missing code means that service is not on the notified authorisation.

The home authority, country by country

Every authorised CASP has one home member state. That is the country of the authority that granted the authorisation. The CSV column is ae_homeMemberState, a two-letter code. The column next to the decision, ae_competentAuthority, is the office that should be named when you ask “who licensed this firm?”. Do not infer the office from the country code if the cell says something else. The cell wins.

The names below are authorities that commonly appear on filings, not a closed directory. A member state can split the work. If you need the official allocation, use that country’s supervisor and the ESMA file together.

• Spain (ES). Filings with Spain as home member state generally name the CNMV, the Comisión Nacional del Mercado de Valores. Confirm on cnmv.es as well as in the CSV.
• Germany (DE). BaFin is the authority you should expect to see on a German home-state filing.
• France (FR). The AMF, the Autorité des marchés financiers.
• Ireland (IE). The Central Bank of Ireland.
• Netherlands (NL). The AFM, the Autoriteit Financiële Markten.
• Austria (AT). The FMA, the Finanzmarktaufsicht.
• Italy (IT). Read the cell. Market-facing CASP services are often notified under CONSOB; do not assume that from the country code alone.
• Lithuania (LT). The Bank of Lithuania.
• Luxembourg (LU). The CSSF.
• Malta (MT). The MFSA.

The Spain page is the slice of the file whose home member state is ES, plus a separate block of firms that passport into Spain. Use it when the question is “who is actually authorised from Spain?”, and use the passport block when the question is “who can serve clients in Spain with an authorisation granted somewhere else?”. The split by state, with each country’s page, is in MiCA license by country.

Passporting

Once a CASP is authorised at home, it may provide the services it has notified in other EEA states. That is passporting. The firm tells its home authority which services it intends to provide, and in which host states. The home authorisation does not move. A firm with home member state Ireland that passports into Spain is still an Irish authorisation. On this site it stays on the Ireland country page as a home provider, and it shows up on the Spain page only in the passport block.

The CSV records host countries on ac_serviceCode_cou, per service row. A firm can passport custody into twelve countries and advice into two. “Passported to Europe” is not a service. The profile on this site lists host countries that have their own page and says, in one line, that passporting does not change the home member state. That sentence is the whole distinction: the passport is a right to provide notified services across the EEA, attached to a single authorisation.

A branch or a local company does not, by itself, create a second MiCA authorisation. If a brand says it is “licensed in Spain”, find the legal entity and see whether Spain is the home member state or only a host country on someone else’s row.

The transitional period, without a Spanish end date

Article 143(3) of Regulation (EU) 2023/1114, on the EUR-Lex text linked above, deals with firms that were already providing crypto-asset services under national law before 30 December 2024. Those firms may continue until 1 July 2026, or until their authorisation is granted or refused, whichever is sooner. The same paragraph allows a member state not to apply that regime, or to shorten it, where the state considers its earlier national framework less strict than MiCA.

The 1 July 2026 date is the outer bound written into the regulation. It is not a date this page assigns to Spain, France, Germany or any other country. Several member states have used the option to set a shorter national period. Those national choices live in national law and in supervisor notices. This guide does not restate them, because a wrong end date is worse than none.

For Spain in particular: check the CNMV and ESMA. This page does not state a Spanish cut-off, and it does not treat a pre-MiCA registration — the older national VASP or AML-style registration — as if it were a CASP authorisation. A firm can have been on a national list, be inside a transitional window, or hold a full authorisation. Only the third of those is a MiCA licence. The CSV shows the third. It does not show the policy debate about the first two. The CNMV texts that do write a date are cited in the MiCA transitional period guide.

How to check a firm

Use three sources that can disagree, and treat disagreement as the result. The ESMA file, the LEI record, and the home authority’s own register should describe the same legal entity. If they do not, you do not yet know who is authorised.

1. Open CASPS.csv. The columns this project relies on are the competent authority (ae_competentAuthority), home member state (ae_homeMemberState), legal name (ae_lei_name), LEI (ae_lei), commercial name (ae_commercial_name), authorisation notification date (ac_authorisationNotificationDate), authorisation end date (ac_authorisationEndDate), service code (ac_serviceCode), passport countries for that service (ac_serviceCode_cou) and last update (ac_lastupdate).
2. Search the commercial name and the legal name separately. Brands collide. A row that matches the app’s name and a different legal entity is not a match.
3. Copy the LEI. It is a 20-character identifier under ISO 17442. Look it up at GLEIF. The legal name on the LEI record should be the legal name on the CSV. If GLEIF does not resolve the code, or the names diverge, stop and check the authority named on the row before you rely on it.
4. Read the home member state and the competent authority. That pair is who granted the authorisation. Then read the service codes, not a slogan on the firm’s homepage.
5. Read the end-date column. An empty end date is not a promise that the authorisation lasts forever. A filled end date means the file records an end. Either way, check ac_lastupdate and open the file again if the decision matters.
6. For Spain, repeat the legal name and the LEI on the CNMV site. The national register is the supervisor’s own list. The CSV is the European publication of what supervisors notify. Use both.
7. Use the register on this site to open the profile: LEI, authority, services, and the link to the home-country page. The profile is a grouped reading of the same file. It is not a second official register, and it can lag a publication until the next sync.

A brand that says it “operates in Spain under MiCA” still has to name a legal entity. If that entity’s only row has home member state IE, Spain is at most a host country. If there is no row, it is not in the file this site mirrors. The Binance note is that second case: an app that opens in Spain is not the same fact as a CASP row.

Who has a MiCA license

Whoever the current ESMA file lists, for the services on their rows, until the file says otherwise. There is no stable hall of fame that this page should freeze. Firms are added, services are added, and an end date can appear. The searchable copy is the home register. Filter by name or open a country page. The count on the home page is the count of rows in the extract this site has loaded, published as an ItemList so the list itself stays the list. This guide does not repeat those names one by one.

The MiCA alternatives page groups a few firms that do have a profile, with the legal name, the LEI and the home state from the same file. It is an editorial selection, not an ESMA ranking. A commercial link on a card is labelled as such and is not the licence.

Authorisation and tax reporting are different duties. DAC8 is the directive under which an authorised firm can be required to report client transactions to tax authorities. It does not decide who holds a CASP authorisation. The MiCA and DAC8 note covers what may be reported. Use this page for the licence, and that note for the reporting.

What a row does not prove

A CASP authorisation is not a solvency opinion, a promise that client assets are safe, or a rating. It means a home authority has authorised that legal entity for those services and that the firm is under the ongoing duties MiCA attaches to them: governance, own funds, complaints, custody safeguards, conflicts, and the rest of Title V. Supervisors can later restrict or withdraw an authorisation. The end-date column and the authority’s own notice are how that shows up, not a badge that stays green forever.

It is not permission for every product on the website. Derivatives, securities, payment accounts and e-money can fall under other regimes even when the firm is a CASP. A MiCA authorisation covers the Union passport described above. It does not authorise the same brand in the United Kingdom or the United States. UK spelling of “licence” does not move the firm into the FCA handbook.

If the homepage, the CSV and the national register disagree, believe the disagreement. Check the legal entity again, then the authority named on the row. The register, the Spain slice and the alternatives page are three views of one file. The file, the LEI and the home authority are the check.

Common questions