If you've used a crypto app in Europe this year, you've probably seen the letters CASP appear somewhere in an email, a terms update, or a notice that a service was changing. So what is a CASP, and why does it suddenly matter to you as a customer rather than to a compliance department? A CASP is the legal category that decides whether a company is allowed to offer you crypto services in the EU at all, and the good news is that you can check your own provider's status yourself in about two minutes. That's what this guide is for, and we've kept it to the steps you'd actually follow rather than a summary of the legislation.
CASP, defined
CASP stands for Crypto-Asset Service Provider. It's the term used in the EU's Markets in Crypto-Assets Regulation (MiCA) for any company that provides crypto-asset services to customers in the EU, such as holding crypto on your behalf, exchanging crypto for euros, or running a trading platform.
MiCA's rules for CASPs became fully applicable on 30 December 2024. A transitional period of up to 18 months let existing providers keep operating while they applied, running until at most 1 July 2026, with the exact end date varying by country. From 1 July 2026, a company serving EU clients needs to be an authorized CASP. Providers that didn't get there are winding down their EU services or have stopped onboarding EU customers.
The scale of that shift is worth knowing. Of the 1,200-plus crypto firms previously registered across EU member states, only somewhere around 17-20% obtained full authorization by the deadline. That's a filter rather than a scandal, and it's exactly why checking your own provider is now a reasonable thing to do.
What "MiCA-authorized" actually means
Three things sit behind the word "authorized", and they're worth separating.
First, a national regulator grants it. Authorization comes from a national competent authority (NCA) in an EU member state, the same kind of body that supervises banks and investment firms in that country. It's a full application process, and an authorized firm takes on ongoing obligations around client-asset segregation, disclosures, and fair marketing.
Second, it passports. Once a firm holds that authorization, the licence works across the whole EU/EEA. A firm authorized in Ireland or Lithuania can legally serve customers in Spain or Germany without a separate licence for each market.
Third, it's ongoing. Authorization isn't a certificate that gets framed and forgotten. An authorized CASP stays under continuous supervision, with reporting duties and the possibility of enforcement if it stops meeting the conditions.
What that authorization gets you in practice: client-asset segregation, mandatory disclosures, fair-marketing and liability rules, prohibitions on market abuse, real complaint channels, and a regulator that can act. What it doesn't get you is protection from price movements, and there's no investor compensation scheme behind crypto the way there is for bank deposits. We've written about that boundary in more detail in Is Your Crypto Safe Under MiCA?, because it's the single most commonly misunderstood part of the regime.
How to check the ESMA register, step by step
The ESMA CASP register is a public list of authorized Crypto-Asset Service Providers maintained by ESMA, the European Securities and Markets Authority. It's public and anyone can search it. ESMA currently publishes it as an interim register, updated and republished at regular intervals while it's being folded into ESMA's main systems, so treat it as a snapshot with a date on it rather than a live feed. Checking a provider takes six steps, and none of them takes long.
1. Open the register. Go to the public ESMA register of databases and registers and find the entry for crypto-asset service providers under MiCA. Depending on how ESMA is publishing the interim register on the day you look, you may be reading it on the page or downloading it, and either way the content is the same list of authorized firms.
2. Get the legal entity name, not the brand name. This is the step most people skip. Apps are marketed under brand names; registers list legal entities. Check the provider's website footer, its terms of service, or its "imprint" or "legal" page, which is normally where the company name and registration number live.
3. Search for that legal name. Use the search or find function in whatever format the register is published in. Searching a distinctive fragment of the name rather than the full string, including its legal suffix, gives you a better chance of a match.
4. Read the entry, don't just count it. An entry tells you which national authority granted the authorization and which crypto-asset services the firm is authorized to provide. Take a second on that last part.
5. Match the service to what you're about to do. Authorization covers specified services: custody and administration, exchange of crypto for funds, operating a trading platform, and others. A firm authorized for one isn't automatically authorized for all of them, so check that the service you're about to use is on its list.
6. Note the date of the snapshot. The register is republished periodically and the number of authorized firms keeps moving. As of July 2026 it's somewhere north of 280 firms, which is why we'd rather point you at the register than quote a number that ages badly.
If you want the background on how the regime fits together while you're there, ESMA's own MiCA page is the primary source.
The part we'd flag: a firm is either in the register or it isn't. There's no half-status a consumer should accept as good enough. "Application submitted", "pending review", and "operating under transitional arrangements" are not authorization. After the transitional period ended on 1 July 2026, a provider is either authorized or it isn't.
What if your platform isn't listed?
A blank result usually has a dull explanation, so check the obvious things first. You may have searched the brand name instead of the legal entity, the register snapshot may predate a recent authorization, or the group may hold the licence under a differently named subsidiary. Email support and ask directly which legal entity holds the CASP authorization and in which country.
If the answer confirms there's no authorization covering EU customers, that's a practical problem rather than an emergency. It usually means the provider is exiting the EU market or restricting services for EU residents, and you'll want to move your balances somewhere authorized in an orderly way rather than at the last minute. We've put the whole process together in Your Crypto Exchange Left the EU?, including how to time withdrawals and what to keep for your records.
A note on wallets that work with a licensed partner
The app on your phone isn't always the authorized CASP itself. It's the structural point that trips up a lot of otherwise careful checking.
Plenty of wallet and neobank-style apps provide the interface, the account, and the customer relationship, while the regulated crypto-asset services underneath run through a licensed CASP partner. It's the same structure that's been normal in banking for years, where a neobank app sits on a partner bank's licence. The regulated activity is licensed, it's just licensed at the partner entity.
The useful consequence for you is that the name to search in the register is the partner's legal entity, not the brand on the app icon. So ask your provider directly: which legal entity holds the authorization for the crypto services in this app? A provider that answers that plainly is showing you something good. One that talks around it is telling you something too.
Applying that to ourselves, plainly: on Quppy, crypto-asset services are delivered through a licensed European CASP partner regulated under MiCA. Quppy itself doesn't hold a crypto licence. We'd rather write that in one clear sentence than bury it, because the alternative is letting you assume something that isn't accurate. If you want to see how the euro side and the crypto side sit together in one app, that's covered in Crypto and Euros in One App.
Once you've confirmed where you stand, the practical next step is knowing how buying works under the current rules, which we walk through in How to Buy Crypto Legally in Europe After MiCA.
FAQ
What does CASP stand for?
CASP stands for Crypto-Asset Service Provider: a company authorized under the EU's MiCA regulation to provide crypto-asset services such as custody, exchange, or operating a trading platform to customers in the EU.
How do I check if my crypto exchange is MiCA licensed?
Find the provider's legal entity name in its terms of service or legal page, then search for that name in ESMA's public register of authorized CASPs. Check that the authorization covers the specific service you plan to use.
Is my crypto exchange licensed in the EU if it has a licence from another country?
Not automatically. Serving EU clients requires MiCA authorization from a national competent authority in an EU member state, which then passports across the EU/EEA. A licence from outside that perimeter doesn't substitute for it.
Is a pending MiCA application the same as being authorized?
No. Since the transitional period ended on 1 July 2026, a provider is either authorized or it isn't. A pending application isn't a status you should treat as equivalent.
Does MiCA authorization mean my crypto is guaranteed safe?
No. MiCA brings asset segregation, disclosure duties, marketing and liability rules, market-abuse prohibitions and ongoing supervision. It doesn't remove price risk and there's no compensation scheme for crypto losses.
Why isn't my wallet app in the ESMA register?
Some apps provide the interface while a licensed CASP partner provides the regulated crypto services, so the authorization sits with the partner entity. Ask your provider which legal entity holds it, then search that name.