MiCA authorisation: 98 providers at BaFin, what matters in the ESMA register

A MiCA authorisation is the permission to offer crypto services in the European Union, and two public directories let you check whether your provider holds one: the company database of the German supervisor BaFin and the MiCA register of the European Securities and Markets Authority, ESMA. The catch is that the two do not show the same thing. Anyone who looks only at BaFin will not find the big international exchanges there at all, and it is easy to draw the wrong conclusion from that.

A count of our own from October 28, 2026 shows how large the difference is. The BaFin company database lists exactly 98 entries in the category "crypto-asset service providers", with data as of October 27. Coinbase, Kraken, Binance and Crypto.com appear in none of them. This piece sets out how the two registers work together, what sits in which, and how to spot an entry that describes no authorisation at all.

What a MiCA authorisation under Regulation 2023/1114 covers

MiCA stands for "Markets in Crypto-Assets" and is Regulation (EU) 2023/1114. It applies directly in every member state and requires official authorisation for crypto services. A firm that receives one is a crypto-asset service provider, or CASP.

A crypto-asset service is an umbrella term for ten clearly delimited activities. They include the custody of crypto-assets for clients, the operation of a trading platform, the exchange of crypto-assets for euros or for other crypto-assets, the execution of orders, placement, the reception and transmission of orders, advice, portfolio management and transfer services. An authorisation always names which of these activities it covers.

That is the first point where a quick check goes wrong: an authorisation is never blanket. A provider authorised for custody is not thereby allowed to run a trading platform. So when you look in the register, read not only whether a name appears but also which services are recorded against it.

In Germany the transitional regime ended on December 31, 2025

Firms that already worked with crypto-assets under German law before MiCA had a grace period. The regulation allowed member states up to eighteen months for this. Germany did not use the full span: under section 50(2)(3) of the Crypto Markets Supervision Act, the permission deemed to continue lapsed "at the latest at the end of December 31, 2025".

For investors that means no legacy licence has been in circulation in Germany since the start of 2026 that a provider could invoke. Anyone providing crypto services there today needs a MiCA authorisation, either from Germany or from another member state. A provider advertising a "BaFin registration" from 2021 or a "crypto custody licence under the Banking Act" is describing a legal position that has expired.

The same law also explains why so many banks sit among the German authorisations. Section 50(3) opens a simplified procedure to institutions holding a permission under section 32 of the Banking Act for authorisation to offer crypto-asset services. A savings bank or cooperative bank already under banking supervision did not have to start from scratch.

The BaFin database lists 98 crypto-asset service providers, 64 of them banks

BaFin states itself where it makes a granted authorisation public: in the Federal Gazette, in its own company database and in ESMA's interim MiCAR register. The database is freely accessible to anyone and has a dedicated option for crypto in the "category" field.

The count of October 28, 2026 across that category yields 98 companies. What else they are is the revealing part, because the database names every role attached to each entry:

• 64 are also credit institutions, among them Commerzbank, Deutsche Bank, DekaBank, DZ Bank, Baader Bank, flatexDEGIRO, N26 Bank, Trade Republic Bank, Scalable Capital Bank and a long line of cooperative banks.
• 24 are investment firms, such as EUWAX AG, Lang & Schwarz TradeCenter AG or several asset managers.
• 10 are additionally crypto custodians, among them Boerse Stuttgart Digital Custody, BitGo Europe, Bullish Europe and Crypto Finance (Germany).
• Exactly 2 carry only the crypto-asset service provider role and nothing else: the Baden-Württemberg stock exchange and Bitpanda Asset Management GmbH.

For comparison: the older "crypto custodian" category under German banking law counts 15 entries, the "crypto securities register keeper" category eight. Those are different permissions with a different purpose, and they are not a MiCA authorisation.

Why Coinbase, Kraken and Binance are missing from the BaFin database

A name search in the same database on October 28, 2026 returns zero hits for Coinbase, Kraken, Binance and Crypto.com. That does not mean these exchanges operate there without permission. It means their authorisation does not come from Germany.

The regulation has its own mechanism for this. Article 65 MiCA governs the cross-border provision of services: a firm authorised in one member state may operate in all the others after prior notification. The industry calls that notification passporting, and BaFin lists such companies in a different category, namely under "cross-border service providers" with the tag "Art. 65 MiCA-R". Bitvavo B.V., Bitpanda GmbH and Bybit EU GmbH are among those listed there on October 28.

So if your provider is missing from the "crypto-asset service providers" category, the check simply moves on. The search continues in the European register.

The ESMA register under Article 109 MiCA lists every authorisation in the EU

The European Securities and Markets Authority keeps a public register under Article 109 MiCA. One point matters for understanding it: ESMA authorises nobody. Authorisation always comes from the national supervisor of the home state, so BaFin in Germany, the AFM in the Netherlands, the central bank in Ireland. ESMA collects those notifications and publishes them in one place.

As long as ESMA has not yet moved the register into its own systems, it appears as an interim register of five tables, republished weekly. The five cover different things: published white papers, issuers of asset-referenced tokens, issuers of e-money tokens, the authorised crypto-asset service providers, and a list of non-compliant companies. For the question "is my exchange authorised?", the fourth table is the right one, reachable via the ESMA MiCA page.

The number of service providers listed there grows week by week. Various readings of the register arrived at 364 to 384 authorised providers at the end of October 2026, depending on the cut-off date each table carried. There is no round figure, then, and that is not a flaw in the source but a consequence of the weekly rhythm. Germany regularly leads on the number of authorisations, followed by France and the Netherlands.

How to check a provider's authorisation yourself in two minutes

The shortest path runs through both registers, in this order:

1. Get the exact company name. It is in the provider's imprint or terms of use, never in the app's brand name. Behind "Bitvavo" sits Bitvavo B.V., behind "Bitpanda" one of several companies depending on the service. Without the legal name you will find nothing in any register.
2. Look in the BaFin database. Enter the company name there and leave the category on "all companies". If the name appears, the result line shows the roles: "crypto-asset service provider" means a German MiCA authorisation, "cross-border service providers (Art. 65 MiCA-R)" means an authorisation from another member state.
3. Cross-check in the ESMA register. Search for the same name in the table of crypto-asset service providers. The row names the home state, the competent authority, the date of authorisation and the list of permitted services. That list is exactly what decides whether the service you want to use is covered.

If you find the name in neither directory, there are three sober explanations, and you usually get further without asking anyone. The name is misspelled or is only a brand. Or the authorisation is recent and not yet recorded, since days can pass between an authority's decision and the entry in the weekly register. Or there is no authorisation.

Stablecoins sit in different tables from exchanges

A different logic applies to stablecoins, and it leads to mix-ups time and again. MiCA knows two kinds of such token: e-money tokens, which reference a single official currency, and asset-referenced tokens, which lean on something else, such as a basket of currencies or a precious metal. Both need an authorised issuer and a published white paper, and both have their own table in the interim register.

The consequence is that a token can be tradable on an authorised exchange without having an authorised issuer itself. That is precisely the case now hitting the tokenised gold PAXG: as we reported on October 28, 2026, the token lacks MiCA authorisation, which is why Coinbase is stopping trading for clients in the European Economic Area as of October 30. If you want to know which issuers have cleared the bar, our analysis of the MiCA register of stablecoin issuers has the state of play.

With a stablecoin, therefore, check two things separately: the issuer of the token and the venue you buy it on. For choosing among the euro and dollar tokens, an overview of the stablecoins helps.

ESMA's warning list names firms operating without authorisation

The fifth table of the interim register is the one least written about, and for investors the most practical. It holds companies that a national supervisor has reported as offering crypto services in the EU without being authorised to do so. Various readings counted between 173 and 178 entries there at the end of October 2026, again depending on the cut-off date of each table.

An entry there is not a court ruling. It is a notice from a supervisory authority, and it is considerably more solid than any rating on a comparison site. If a provider where you hold money turns up in that table, that is the moment to think about a withdrawal, and to do so before payment service providers or banks stop transfers to that recipient.

The warning list also explains why some platforms are no longer reachable from Germany or operate only with restrictions. One example from our own coverage is the situation at Hyperliquid without MiCA authorisation, where the missing permission feeds straight through to access.

Four entries that look like an authorisation and are not

Reading the registers, you meet terms that sound regulatory and mean something else. The four most common:

• Representative office. A representative office may advertise and maintain contacts but conclude no business. The BaFin database on October 28, 2026 lists eToro Germany GmbH as the representative office of eToro (Europe) Limited, and that is a role, not a permission.
• Crypto custodian under German banking law. This permission existed before MiCA and covers custody, not trading. It is recorded in a category of its own with 15 entries, and the entry does not replace a MiCA authorisation.
• Crypto securities register keeper. This eighth category concerns electronic securities under German law and has nothing to do with bitcoin or ether.
• A published white paper. A white paper in the register shows that an issuer has met its disclosure duty. It is no examination of the business model, and certainly no authorisation of the issuing firm.

For anyone who wants to go deeper into the structure of the register: our analysis of the MiCA register showed how small the share of genuine trading platforms is among all authorisations. The duties that sit behind a licence are summarised in our overview of the MiCA licence obligations for crypto companies.

What the authorisation delivers and where its protection ends

A MiCA authorisation obliges the provider to hold own funds, to separate client money from its own assets, to run a complaints desk and to report to the supervisor. That is a real difference from a provider without permission, and in a dispute it gives you a competent authority.

What the authorisation does not deliver matters just as much. No price and no return is assured. Nor does the permission substitute for deposit insurance, since crypto-assets do not fall under the protection for bank balances. And it does not prevent insolvency: if an authorised provider fails, the quality of the asset separation decides what comes back from your holdings. Self-custody therefore remains the alternative for larger holdings, the one that avoids counterparty risk altogether.

One last point on timing: an authorisation can be withdrawn, and providers also give up services voluntarily. An entry you saw in the spring proves nothing for today. Before a larger deposit, another look at the register is worth it; it costs two minutes.

MiCA authorisation: BaFin lists 98 providers, ESMA all the rest

Together the two registers answer the question reliably; on their own each misleads. This is how you get to a solid answer:

1. Take the company name from the imprint and search the BaFin database. The role line tells you at once whether the authorisation comes from Germany, whether the provider reaches in from another member state via Article 65 MiCA, or whether nothing is recorded at all. A selection sorted by authorisation is in the comparison of regulated crypto exchanges.
2. Match the permitted services in the ESMA register. Custody, trading platform and exchange are three different permissions. Only what stands there is covered. Which exchanges offer which services is shown by the overview of crypto exchanges.
3. With stablecoins, check the issuer separately and glance at the warning list. A token without an authorised issuer disappears from European trading sooner or later, as the PAXG case at the end of October 2026 shows. For larger holdings, self-custody remains the route that makes you independent of a provider: see the comparison of hardware wallets.

(As of October 28, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)