How to verify if an exchange has a real MiCA license (step by step)

With the transitional regime already closed throughout the European Union, the question is no longer theoretical: does my exchange really have a MiCA license, or does it just say so on their website? No small doubt. Any platform can write "MiCA regulated" on its landing page, but that is not equivalent to being in the official authorization register. The difference between believing your exchange is compliant and checking yourself can literally be the difference between getting your funds back smoothly or getting caught in the messy shutdown of an unlicensed platform.

The good news is that verifying it does not require much legal knowledge or time. There is a public register, managed by the European Securities Authority, which anyone can consult free of charge. This guide walks you through the process step by step, and also explains which warning signs to watch for when something doesn’t add up.

1. First understand which record is the one that commands

The data you are importing is in one place: ESMA’s official register of crypto asset service providers (CASPs) (the European Securities and Markets Authority) published at esma.europa.eu. This register includes, without exception, all entities authorised under MiCA in any of the member states, together with the national authority that granted the licence.

It should be distinguished from other lists that also exist and that sometimes create confusion:

• The old national registers, such as those maintained by the Banco de España for virtual asset service providers before MiCA, no longer prove anything on their own. That regime is over.
• The records of each national supervisor, like the one published by the CNMV in Spain, are useful and reliable, but mainly collect entities that have reported their activity in that particular country. A platform may be licensed in Malta and have not yet formally "transferred" its services to Spain, and that does not mean that it is without authorization.
• The private directories that aggregate this data (such as those already circulating under names like "CASP tracker") may be a convenient shortcut for first lookups, but they do not replace the official register, which is the only source that makes faith.

2. Locate the exact legal name of your exchange, not the trademark

This is probably where most people get it wrong. Searching for "Binance" or "Bybit" in a record doesn’t always work, because authorizations are granted to the legal entity’s name and not to the brand you communicate with every day. For example, Bybit operates in Europe through Bybit EU GmbH, an Austrian entity distinct from the global group parent, and so does KuCoin EU, Gate.io EU, or Bitget EU.

Before searching the registry, take two minutes to locate on the exchange’s website (usually in the footer, terms and conditions, or "Legal" or "Licenses") the full legal name of the entity that serves you in your country. It is common to find phrases such as "services provided by [Name] S.A., authorized by [regulator]". That’s the data you need for the next step.

3. Enter in the official register and search by legal name

With the legal name in hand, access the ESMA register and search for that exact company name. The record will show you, if the entity is authorized, the following data:

• The authorized company with its full legal name.
• The country of origin where the license was granted.
• The responsible supervisory authority (CNMV, BaFin, AMF, MFSA, FMA, among others).
• The date of authorization.
• The specific services for which you have permission (custody, exchange, order execution, trading platform management, among others).
• The countries in which you have reported your activity using a European passport.

If the name does not appear at all, prove variants: without legal form (remove the "GmbH", "S.A." or "B.V."), only with the first word of the name, or by searching for the entity’s web domain if the search engine allows. Some private aggregators, which do index by domain or trademark, can help you find the exact legal name when direct search does not work, although it is always good to confirm the finding in the official record before giving it as correct.

4. Read the small print: what services does the license actually cover

Here comes the nuance that usually goes unnoticed. Finding your exchange in the record does not automatically mean that it is authorized for everything it does with you. MiCA distinguishes between different services, and the same entity may have permission for some and not for others:

• A company may be authorized to receive and transmit orders, but not to directly hold your crypto assets.
• Another can provide custody services, but not manage a trading platform per se.
• Some apps combine several different providers under the hood: one entity receives your orders, another executes them, and a third custodian your cryptocurrencies. The app you use daily is just the visible layer.

That’s why the phrase "we have a MiCA license," which is repeated by many platforms in their marketing, doesn’t say, on its own, if that license covers exactly the service you’re using. Checking the list of authorized services in the registry is the only way to know for sure.

5. Also check the European passport if you operate from a country other than the license

Thanks to the European passport, an authorization granted in one member state is valid in all 27 countries of the Union, but only once the entity has formally communicated its activity to the supervisor of the country where it wants to operate. If an exchange is licensed in Malta but you operate from Spain, check the record to see that Spain appears among the notified countries. If your country is not listed, it’s best to ask the platform support directly before assuming you are covered.

In Spain, in addition to ESMA’s European register, the CNMV maintains its own list of entities entitled to operate in the Spanish market, either with its own national authorization or through a passport from another EU country. Consulting both the European and national registers gives a more complete picture than looking at just one.

6. Signs that something is wrong

In addition to direct verification in the register, there are patterns that should be monitored, because they often anticipate problems before they are officially confirmed:

• The platform mentions a license without specifying the exact legal entity or authorization number. A truly authorized firm has no reason to be vague on this point.
• The name on the record doesn’t match with the entity that bills your transactions or appears on your statements.
• Sudden withdrawal restrictions, ambiguous messages about prolonged "maintenance," or support’s silence on specific questions about the license.
• Statements that speak of an "in process" or "under review" as if it were equivalent to having the authorization. A pending application is not a granted license, however advanced.
• Urgent emails or messages asking to "migrate now" via a link to supposedly regularize your account. This is a common phishing pattern precisely in times of regulatory uncertainty: always check any such communication directly from the exchange’s official website, without clicking on links received by mail or message.

7. What to do if you confirm that your exchange is not licensed

If after checking it turns out that your exchange does not appear in the register, or that the entity that serves you is not among the authorized ones, it is advisable to act calmly but without delay:

1. Do not make new deposits. Each additional euro is capital exposed to a possible block if the platform has to cease business in a disorderly fashion.
2. Request the migration plan directly from exchange support: which authorized provider will receive your assets, under what conditions, and what deadlines are handled.
3. Withdraw or transfer your funds calmly but without waiting for the last moment. Decommissioning platforms typically give 30-60 days to move assets, but this time can be shortened or complicated if the regulatory situation worsens.
4. Check any destination address carefully. Copy and paste the address of the wallet, and if the amount is high, make a small trial transfer first.

Note: Regulatory information evolves frequently. Before making decisions about where to deposit funds, it is advisable to check the authorization status of any platform directly in ESMA’s official CASP register.