Updated on 22 October 2026: fresh pull of the ESMA register. BingX has been authorised since 13 October 2026, Webot, the former Pionex US, holds an authorisation in Ireland, and Blockchain.com's legal entity now has a new name.
MiCA Licensed Crypto Exchanges: Which Ones Hold a Licence?
As of 21 October 2026, the official register of the European Securities and Markets Authority (ESMA) lists these exchanges and brokers, among others, as authorised crypto-asset service providers: Coinbase, Bitpanda, OKX, Kraken, crypto.com and Bybit EU from our matrix, plus Bitvavo, Bitstamp, eToro, Trade Republic, Scalable Capital, Gemini, Gate, KuCoin, One Trading, BSDEX, Bison and, newly, BingX EU. In total, 374 authorisations for crypto-asset service providers are currently valid, 106 of them for providers based in Germany. Binance, MEXC, Bitunix, BloFin, Bitfinex, HTX, Phemex, Pionex's international platform and several other platforms marketed in Europe hold no MiCA licence. Bitget and Nexo say they have applied, but the register does not show an authorisation yet.
In short, a MiCA licensed exchange is one with an entry in the ESMA register, not one with a compliance badge on its homepage. Since the transitional period ended on 1 July 2026, providers without authorisation may in principle no longer offer crypto services to customers in the EU. If you still hold funds on such a platform, do not leave them there longer than necessary: two platforms on that list have already announced their closure.
What Has Changed Since Our Last Register Check
We pulled ESMA's register file again on 21 October 2026 (data as of 19 October 2026) and checked every provider on this page against its authorised legal entity. Compared with our check on 30 September 2026, this is what changed:
- BingX is now authorised. Since 13 October 2026, the register has listed BingX EU with the legal entity MEGE zweite GmbH, authorised by Austria's Financial Market Authority (FMA). The authorisation covers custody, exchanging crypto-assets for euros and for other crypto-assets, and transfers. It applies to the EU offering at bingx.eu, not to other BingX companies, and according to the register it is passported to every EEA country except Spain and Malta.
- Pionex: authorised under a different name. There is still no entry for the Pionex brand. Webot, which describes itself as the former Pionex US, is authorised through Pionew Ireland Limited (Central Bank of Ireland, since 18 December 2025), passported only to Germany, France and Lithuania according to the register. Our previous version did not mention this.
- More authorisations, mainly banks. The register file now has 379 entries, up from 364 in early October. Of these, 374 authorisations are valid today: two have ended and three only take effect at a later date. Most of the new entries are German cooperative banks. Deutsche Bank has been allowed to hold and transfer crypto-assets for clients since 12 October 2026, and Openbank Deutschland may additionally execute client orders for crypto-assets from 23 October 2026.
- Blockchain.com is now listed as Blockchain.com Operations (Malta) Limited, previously Blue Cube (Malta) Ltd. Its authorisation of 22 October 2025 is unchanged; our previous version still showed the old name.
- Still without authorisation: Binance, Bitget, MEXC, Bitunix, BloFin, Bitfinex, HTX and Nexo. There is no entry for any Binance company, including an EU subsidiary.
The register only lists granted authorisations. You can check every entry yourself in ESMA's interim MiCA register.
Is Binance MiCA regulated?
No. As of 21 October 2026, no Binance company is listed in the ESMA register as an authorised provider, not even an EU subsidiary. If you want the protection of a supervised exchange, the matrix above lists six licensed alternatives.
Is Bitunix MiCA regulated?
No. Bitunix has no entry in the ESMA register and therefore cannot offer crypto services under MiCA to customers in the EU.
Is BingX MiCA regulated?
Yes, since 13 October 2026. The authorised entity is BingX EU, legally MEGE zweite GmbH in Austria, supervised by the FMA. MiCA protection only applies to accounts held with this EU company. According to the register, the authorisation does not extend to Spain and Malta.
Does MEXC have a MiCA licence?
No. The Dutch regulator AFM issued a public warning about MEXC on 16 September 2025 for offering services without a MiCAR licence, and ESMA lists MEXC among non-compliant providers.
Does BloFin have a MiCA licence?
No. BloFin has no entry in the ESMA register.
Does Bitfinex have a MiCA licence?
No. Bitfinex is not listed among the authorised providers either.
Does Pionex have a MiCA licence?
Not under that name. Pionex's international platform has no entry in the ESMA register. Webot, which describes itself as the former Pionex US, is authorised, though: Pionew Ireland Limited has held an authorisation from the Central Bank of Ireland since 18 December 2025, and its EU offering runs at webot.com/eu. According to the register, that authorisation is passported only to Germany, France and Lithuania.
Does Bybit have a MiCA licence?
Yes, through its European subsidiary Bybit EU GmbH, based in Austria and authorised by the FMA since 28 May 2025. That applies to the EU platform, not to Bybit's international site.
Does Bitget have a MiCA licence?
Not yet. Bitget says it has applied in Austria. As of 21 October 2026, the register shows no authorisation.
Is Coinbase MiCA regulated?
Yes. The authorised entity is Coinbase Luxembourg S.A., supervised by Luxembourg's CSSF since 20 June 2025.
Is Bitpanda MiCA regulated?
Yes, three times over: Bitpanda GmbH in Austria (FMA, since 9 April 2025), Bitpanda Asset Management GmbH in Germany (BaFin, since 24 January 2025) and BP23 CA Limited in Malta (MFSA, since 27 January 2025).
How can I check a MiCA licence myself?
ESMA publishes its interim MiCA register as downloadable files on its website. Open the list of crypto-asset service providers and search for the legal entity rather than the brand: Bybit appears as Bybit EU GmbH, OKX as OKX Europe Ltd. If the entity is not there, the platform is not authorised under MiCA, whatever its marketing says.
What the MiCA Regulation Covers, and What It Does Not
MiCA, formally Regulation (EU) 2023/1114 on markets in crypto-assets, sorts crypto-assets into three groups, each with its own part of the regulation: other crypto-assets in Title II, asset-referenced tokens in Title III and e-money tokens in Title IV. E-money tokens are pegged to a single official currency, such as a euro stablecoin. Asset-referenced tokens derive their value from a basket of currencies, commodities or other crypto-assets. Everything else, including Bitcoin and Ether, counts as other crypto-assets. Issuers of tokens face rules on reserves and on the crypto-asset white paper they must publish, strictest for the two stablecoin types. Bitcoin has no issuer and is not affected by that part.
For you as a customer, the second part matters more: the rules for crypto-asset service providers, or CASPs, in Title V. They cover not only exchanges but also crypto brokers, custodians and wallet providers that hold your keys, and services that exchange crypto for euros. A licensed provider must keep client assets separate from its own, disclose conflicts of interest, monitor for market abuse and tell you its costs and fees in advance. Each provider is authorised by the competent authority of one member state, such as BaFin in Germany or the AMF in France, and can then serve customers across the EU through the passport. ESMA works on supervisory convergence so that national regulators apply the rules the same way, and authorities can impose administrative penalties on non-compliant entities. Alongside MiCA, the EU version of the FATF travel rule requires providers to send sender and recipient details with every crypto transfer.
What MiCA does not do is just as important. There is no deposit insurance as with a bank account, and no licence protects you against price losses. MiCA targets centralised cryptocurrency exchanges and brokers. Fully decentralised exchanges without an operator fall outside the regulation, and crypto derivatives such as futures remain under MiFID II. A MiCA compliant exchange lowers the risk that a provider disappears with your money. The market risk of crypto trading stays with you. And once you move coins to your own digital wallet, MiCA no longer protects them, but no exchange can freeze them either.
Crypto Exchange Regulation Explained: MiCA, Global Frameworks & Why It Matters
When you hand your money to a crypto exchange, you're trusting it with two things: your funds and your data. Regulation is what turns that trust from a leap of faith into a legal guarantee. As of mid-2026, with the EU's MiCA framework now fully in force, the gap between a regulated exchange and an unregulated one has never mattered more. This guide explains what crypto exchange regulation actually is, why it exists, how exchanges become licensed, and how the major frameworks compare across the EU, US, UK, Asia, and the Middle East.
What Is Crypto Exchange Regulation?
Crypto exchange regulation is the set of laws, licensing requirements, and ongoing obligations that govern how a cryptocurrency platform can legally operate, hold customer funds, and offer services within a given jurisdiction. In regulatory language, these platforms are usually called Crypto-Asset Service Providers (CASPs) or Virtual Asset Service Providers (VASPs).
At its core, regulation answers a simple question: who is allowed to run a crypto exchange, and under what rules? A regulated exchange has been vetted by a financial authority, holds a formal license, and is subject to continuous supervision. An unregulated one operates without that oversight, and without the protections that come with it.
Regulation typically covers areas such as:
- Authorization and licensing: a platform must apply for and be granted permission to operate.
- Capital requirements: minimum financial reserves to ensure the exchange can withstand stress.
- Custody rules: how client assets must be stored, segregated, and protected.
- Anti-Money Laundering (AML) and Counter-Terrorist Financing (CFT): including identity verification (KYC) and transaction monitoring.
- Consumer protection: clear risk disclosures, fair conduct, and complaint handling.
- Market integrity: rules against market manipulation and insider trading.
Why Should Crypto Exchanges Be Regulated?
Regulation isn't just bureaucratic box-ticking. It exists to solve real problems that have cost investors billions over crypto's history. Here's why it matters.
Protecting Your Funds and Data
A regulated exchange is required to safeguard client assets, typically by segregating customer funds from the company's own money and meeting strict custody standards. If the exchange fails, regulated frameworks give clients a far stronger legal claim to their assets. Unregulated platforms offer no such guarantee: when they collapse, funds often simply vanish.
Reducing Fraud and Financial Crime
There's strong evidence that regulation works. TRM Labs analysis found that virtual asset service providers, which are the most widely regulated segment of the crypto ecosystem, have significantly lower rates of illicit activity than the overall ecosystem, with regulators increasingly viewing compliant intermediaries as essential partners in combating financial crime.
Building Institutional Trust
Clear regulation is the bridge between crypto and mainstream finance. In 2025, about 80% of reviewed jurisdictions saw financial institutions announce digital asset initiatives, with markets that have clear, innovation-friendly regulation, such as the US, EU, and parts of Asia, becoming catalysts for global institutional participation. Banks and asset managers won't touch platforms that can't demonstrate regulatory standing.
Giving Consumers Confidence
When you can verify that an exchange is licensed and supervised, you can make informed decisions about where to put your money, rather than gambling on a platform's reputation alone.
How Does a Crypto Exchange Become Regulated? The Steps Involved
Becoming a licensed exchange is a demanding, multi-stage process. While the specifics vary by jurisdiction, the typical path looks like this:
- Choose a jurisdiction and regulator. The exchange selects where to apply, based on the regulatory regime, market access, and licensing requirements. In the EU, for example, an exchange picks one member state's national competent authority (NCA).
- Establish a legal entity. The platform must set up a properly incorporated company in the jurisdiction, with local substance (offices, staff, directors).
- Build a compliance framework. This includes implementing AML/CFT processes, KYC onboarding, transaction monitoring, and the Travel Rule (sharing sender/recipient data on transfers).
- Meet capital and governance requirements. The firm must hold minimum capital reserves and demonstrate sound governance, risk management, and IT security controls.
- Submit a detailed application. This is often the longest stage. Under MiCA, the review period for CASP authorization can take up to four months once a complete file is submitted, but in practice, original applications are rarely complete, and clarifications or substantial changes are often required, causing additional delays.
- Undergo review and approval. The regulator scrutinizes the application, the business model, the management team, and the firm's financial and operational resilience.
- Maintain ongoing compliance. A license isn't a one-time achievement. Exchanges face continuous supervision, reporting obligations, audits, and must keep meeting conduct, prudential, and AML standards.
What Is MiCA? The EU's Markets in Crypto-Assets Regulation
MiCA (Markets in Crypto-Assets Regulation) is the European Union's comprehensive regulatory framework for crypto-assets, widely regarded as the most far-reaching crypto regulation in the world. It creates a single, harmonized rulebook across all 27 EU member states, replacing the previous patchwork of national regimes.
Check here for the official source for MiCA is the European Securities and Markets Authority (ESMA).
What MiCA Covers
MiCA's rules are built around three main pillars: rules on the public offering and admission to trading of crypto tokens, the provision of crypto-asset services by service providers, and the prevention of market abuse. MiCA requires crypto exchanges operating in the EU to obtain CASP authorization, meet capital and governance requirements, and follow conduct-of-business and consumer protection rules, and once authorized, exchanges can passport their services across the EU.
The "Passport": MiCA's Central Promise
The single most important feature of MiCA is passporting. A CASP licence from any single EU member state passports across all 27 countries and the broader EEA: you do not need a separate licence for each country. Authorize once, operate everywhere. This is what makes a single MiCA license so valuable.
The July 1, 2026 Deadline: Why Timing Matters Right Now
This is the critical context for anyone choosing an exchange today. The MiCA transitional period officially expired across the EU on 1 July 2026; after this date, any entity providing crypto-asset services to EU clients without a MiCA licence is in breach of EU law and must cease offering such services.
The consequences for non-compliance are severe. Unlicensed platforms now face fines of up to 15 million euros or 12.5% of annual revenue under MiCA Article 111, and ESMA confirmed on April 17 that no further transitional-period extensions would be granted.
The market has consolidated sharply as a result. Authorization is highly concentrated, with the five largest jurisdictions accounting for close to 60% of the total; Germany leads by a wide margin, while the crypto center of gravity sits in Malta, the Netherlands, Cyprus, France and Ireland. Major global exchanges including Kraken, Coinbase, Binance, OKX, Crypto.com, Bitstamp, and Bitpanda have secured CASP licenses, each authorized through a specific member state.
How to Verify a MiCA License
The only authoritative way to confirm an exchange is genuinely licensed is the official ESMA Interim MiCA Register. ESMA urges consumers to check that the company they are using is listed as authorised in the ESMA Interim MiCA Register before they invest or transfer funds. Crucially, MiCA protections only apply to the specific legal entity authorised in the EU, not to affiliated entities or those authorised outside the European Union, so check carefully which entity you have contracted with.
Requirements of MiCA: What Licensed Exchanges Must Do
To achieve and maintain full MiCA compliance, a CASP must have in place:
- Fully implemented AML/CFT processes, including customer due diligence (CDD) and the Travel Rule.
- Capital and prudential requirements appropriate to the services offered.
- Custody and segregation of client crypto-assets.
- Clear disclosures, including crypto white papers for token offerings.
- Conduct-of-business rules and robust complaint handling.
- Market abuse prevention and order-book record-keeping.
One important practical note for users: stablecoin trading is currently restricted on most major CASPs for assets whose issuers have not obtained the required e-money token (EMT) authorization, which has affected USDT trading availability on several licensed exchanges, since Tether has not yet obtained EMT authorization as of mid-2026.
Crypto Regulations Similar to MiCA Around the World
MiCA is the most comprehensive framework, but it's far from alone. Most major economies now regulate rather than ban crypto, each with its own approach. Here's how the key regions compare.
United States
The US regulatory landscape shifted dramatically in 2025. The GENIUS Act, signed into law on July 18, 2025, established the first comprehensive federal cryptocurrency framework in US history. Beyond stablecoins, market-structure legislation is advancing. The CLARITY Act, a landmark market structure bill, is advancing through Congress, seeking to clearly define the jurisdictional boundaries between the Securities and Exchange Commission (SEC) and the Commodity Futures Trading Commission (CFTC). The main regulators are the SEC and the CFTC.
United Kingdom
The UK has taken a more measured, phased approach. The UK is opening FCA licensing for crypto firms, with its regulatory regime targeted for implementation in 2026–2027. The framework emphasizes consumer protection. The UK's approach, overseen by the Financial Conduct Authority (FCA), comprehensively enforces AML and KYC protocols, establishes a formal licensing system for exchanges and custodians, and mandates clear risk disclosures and advertising standards. The regulator is the FCA.
Singapore
Exchanges and digital-asset service providers in Singapore must be licensed under the Payment Services Act, meet AML and Travel-Rule obligations, and satisfy operational-resilience and cybersecurity standards, with strict requirements for custody segregation. The regulator is the Monetary Authority of Singapore, MAS.
Japan
Japan is one of the most mature crypto markets, regulated under its Payment Services Act. Under Japan's updated Payment Services Act, only banks, trust companies, and licensed funds-transfer service providers may issue yen-backed stablecoins, subject to strict reserve, custody, and redemption obligations. The regulator is the Financial Services Agency, FSA, supported by the self-regulatory JVCEA.
United Arab Emirates
The UAE has built itself into a global crypto hub with a multi-regulator structure. The UAE's federal financial regulator, the Securities and Commodities Authority (SCA), regulates crypto-assets other than stablecoins, while two financial free zones, the Abu Dhabi Global Market (ADGM) and the Dubai International Financial Centre (DIFC), operate their own regimes. Dubai also has a dedicated crypto regulator. The Virtual Assets Regulatory Authority (VARA) in Dubai requires licensed firms to comply with Travel Rule and AML obligations. VARA's site is here.
Other Notable Frameworks
- Hong Kong: operates a Virtual Asset Trading Platform (VATP) licensing regime under the SFC, permitting retail access only to vetted large-cap tokens.
- Canada: regulates crypto firms as money services businesses, with FINTRAC enforcing AML and Travel Rule obligations.
- South Korea: the Financial Services Commission (FSC) and KoFIU enforce strict registration and Travel Rule requirements under the Virtual Asset User Protection Act.
Global Coordination
Beyond individual countries, international bodies are pushing for harmonized standards. Global bodies including the FATF, IOSCO, the FSB, and the OECD are pushing for coordinated implementation to reduce cross-border regulatory gaps, with the OECD-led Crypto-Asset Reporting Framework (CARF), endorsed by the G20, set to begin information exchange between tax authorities, with the first CARF exchanges expected in 2027.
The Bottom Line: Why Regulated Exchanges Win in 2026
With MiCA now fully in force and frameworks tightening worldwide, the era of the unregulated exchange serving major markets is ending. A regulated exchange means your funds are safeguarded under law, your data is protected, the platform is supervised by a real authority, and you retain consumer protections if something goes wrong.
The single most important habit for any crypto user today is verification: before trusting any platform, confirm its license directly with the relevant regulator; for EU users, that means checking the official ESMA register. In a market that's consolidating fast around licensed players, choosing a properly regulated exchange isn't just the safer option: increasingly, it's the only one that's legal.
Our analysis of the ESMA register
How many providers are actually authorised, where they are based and how few of them may run a trading platform at all is something we counted from the official register file on 6 August 2026. The full result, with all charts, is in our analysis of the ESMA MiCA register: 329 authorisations, 322 legal entities and only 21 trading platforms. In the pull of 21 October 2026, 374 authorisations are valid, and 22 of them allow the operation of a trading platform.
