How to Check Whether a Crypto Platform Is MiCA-Authorised

A crypto platform is authorised under the Markets in Crypto-Assets Regulation (MiCA) only when one specific legal entity appears in an official register, together with its permitted services and an authorisation date. So work out which company actually serves you, identify its supervisor, and look that entity up in ESMA's register or on the regulator's own list. A name in an app store or a licence number in a website footer proves nothing by itself.

Key takeaways

• Since the EU-wide transitional period ended on 1 July 2026, a firm needs MiCA authorisation (or, for certain already-regulated entities, a notification) to offer crypto-asset services to EU clients.
• Authorisation belongs to a legal entity, not to a brand that may span several companies.
• ESMA's interim MiCA register and national lists show legal name, LEI, home country, authorisation date and permitted services.
• Compare the services listed with what you want to do. Authorisation for custody is not authorisation for everything.
• Authorisation is a supervisory status. It does not remove price risk, fraud aimed at users or operational failure.

What does "MiCA-authorised" actually mean?

A crypto-asset service provider (CASP) is MiCA-authorised when the competent authority of an EU Member State has granted it authorisation under Regulation (EU) 2023/1114 to provide named crypto-asset services. The status belongs to that legal entity, covers only the services in its entry, and reaches other Member States through notification.

MiCA defines ten crypto-asset services, among them custody, exchange of crypto-assets for funds, execution of orders and transfer services (listed in Step 4). A firm that offers them needs authorisation under Article 59, and an authorised provider must have its registered office in a Member State. Banks, investment firms, e-money institutions and a few other already-supervised entities can instead notify their regulator at least 40 working days before starting equivalent services (Article 60), so a legitimate entity may not be a "CASP" in the narrow sense.

MiCA authorisation versus a national VASP registration

Before MiCA, each country ran its own regime, commonly a registration as a virtual asset service provider (VASP), and ESMA noted that the mix produced uneven consumer protection. Firms operating lawfully under national rules on 30 December 2024 could continue until 1 July 2026, or until their MiCA application was granted or refused, whichever came first (Article 143(3)). That window has closed.

A pre-MiCA national registration documents history, not current status. Under ESMA's statement of 17 April 2026, any entity serving EU clients with crypto-asset services after 1 July 2026 without a MiCA authorisation is in breach of EU law and must stop.

Step 1 — Find the legal entity behind the app

Brand names, apps and websites are marketing layers. The party that owes you duties is a company named in the documents you accepted at sign-up. Look in the opening paragraphs of the Terms of Use ("services are provided by…"), the privacy policy (which names the data controller), the legal notice or imprint, the footer small print and your onboarding emails.

Write down the exact legal name with its suffix (GmbH, SAS, OÜ, Ltd), the registered address, the company number and the regulator named. If several companies appear, find out which one provides the service you use: custody, exchange and transfers can sit in different entities, as in a crypto-friendly IBAN setup. ESMA's consumer guidance stresses the same point, because MiCA protections apply only to the specific authorised EU entity, not to other companies in the group. If the paperwork is unclear, ask support in writing; a vague answer is information too.

Step 2 — Identify the regulator

Authorisation comes from the competent authority of the entity's home Member State, for example the AMF in France, BaFin in Germany, the CNMV in Spain, CONSOB in Italy, the Central Bank of Ireland or the MFSA in Malta. The register names the authority for each entry, and ESMA publishes the list of designated authorities. Treat the regulator named in marketing as a claim to test: an authority outside the EU cannot grant MiCA authorisation.

Step 3 — Check the official register

ESMA publishes the interim MiCA register as downloadable files on its MiCA page: five CSV files covering white papers, issuers of asset-referenced tokens, issuers of e-money tokens, crypto-asset service providers and non-compliant entities. For a platform, use the crypto-asset service providers file.

1. Open ESMA's MiCA page and find the "Interim MiCA Register" section.
2. Download the crypto-asset service providers file and open it in a spreadsheet.
3. Search for the legal name, the Legal Entity Identifier (LEI) or the website domain, not only the brand. The commercial name sits in a separate column.
4. Read the whole row: competent authority, home Member State, legal name, LEI, address, website, authorisation date, withdrawal date, services, and the Member States where the firm intends to operate.
5. Confirm that an authorisation date is present and the withdrawal date is empty.
6. Repeat the search on the national regulator's own list, which may be more current.

ESMA refreshes the register weekly from what national authorities report, so a very recent authorisation may not appear at once, and a withdrawn authorisation stays in the file with its end date. Reach the files through ESMA's page, since it calls them interim. A white paper listed in the register is not an approval of the token.

If a row has no authorisation date, read the comments field and the regulator's page: the entity may be a bank or other supervised firm on the Article 60 notification route. If you find no row at all, ask the provider for its legal entity, LEI and regulator reference, check the regulator's list, and hold off depositing until something matches.

Step 4 — Check the services covered

The register records each service as a letter, mirroring the ten services in MiCA's definition.

An entry listing only advice gives no basis for holding your assets. Check that your country appears among the Member States listed.

Step 5 — Match the domain and the legal entity

A genuine entry can still be borrowed by a look-alike site. Compare the website in the register with the address you use, character by character, and confirm that the legal name in the Terms, the address and the LEI agree with the register and that the app-store developer is the same company. The public GLEIF search shows the registered name and address behind an LEI.

Check the entity type too. A company outside the EU cannot offer MiCA services to EU clients, apart from the narrow case in which a client approaches it entirely on their own initiative (reverse solicitation), and ESMA treats promotion aimed at EU clients as solicitation.

Step 6 — Check warnings and restrictions

Look at the non-compliant entities file, which names entities that authorities have identified as providing crypto-asset services in breach of the authorisation rules, then read the warnings section of the home regulator and of your own national regulator. A clean result only means no flag has been raised yet.

Red flags: claims that need checking

A worked example (fictional)

Imagine an app called Tidewell. Its site says "MiCA licensed" and shows a licence number but no company name. The Terms say EU services come from Tidewell Digital Services SIA, a Latvian company. Step 3 finds no entry for it, only Tidewell Capital Ltd, a different company authorised for advice alone. The brand is shared but the entities are not, so the company that serves you shows no authorisation. The next move is to ask in writing for the regulator reference and LEI of the entity holding client assets, and not to deposit until the answer matches an entry. (Tidewell is invented for illustration.)

Can a platform operate while its MiCA application is pending?

No. ESMA's position is that after 1 July 2026 anyone offering crypto-asset services to EU clients without a MiCA authorisation must cease, and it expected unauthorised providers to have completed an orderly wind-down by then. An application that is "in process" is not an authorisation. A bank using the Article 60 notification route is a different case, and a non-EU firm can serve only a client who approached it unprompted. Ask to see the register entry, and until one exists treat the provider as unauthorised for new deposits.

Is MiCA authorisation a guarantee that funds cannot be lost?

No. Authorisation shows that a named entity is subject to MiCA's organisational, custody and conduct requirements and to supervision. It does not insure against price falls, scams that exploit your own credentials, outages or the failure of a business. ESMA's warning is framed the other way round: clients of unauthorised providers lack MiCA safeguards, including protection for client assets. Treat authorisation as a minimum filter, then judge the platform on fees, custody arrangements and complaint handling. For a fuller breakdown, see what MiCA protects and does not protect.

Verification checklist

Copy this list and fill it in before you deposit funds.

• Exact legal name of the company serving me: ______
• Registered address and company number: ______
• Regulator named in the contract: ______
• LEI, confirmed in a public LEI search: ______
• Entry found in ESMA's crypto-asset service providers file or on the regulator's list
• Authorisation date present, withdrawal date empty, my services and country listed
• Website in the register matches the address I use
• No match in the non-compliant entities file or regulator warnings

Applying the checklist to Quppy

Quppy's website says the app is operated by QUPPY EUROPE OÜ and that European crypto-asset services are provided by Payhound Limited, a Malta-based CASP authorised by the MFSA. That is the split between brand and regulated entity that Step 1 asks you to find, and the AMF's public list of authorised CASPs also carries an entry for Payhound Limited. Run Steps 3 to 5 on that name yourself, using Quppy's MiCA and providers page as the document to compare against. For what an authorised provider then reports to tax authorities, see DAC8 reporting rules.