Since the end of the MiCA transitional period on 1 July 2026, every company that offers crypto services to people in the European Union needs an authorisation under the Markets in Crypto-Assets Regulation (MiCA). That is good news for users, but only if you actually check. Many platforms, and many scammers, put words like “regulated”, “licensed” or “EU compliant” on their website. This guide shows you how to verify such claims yourself in about ten minutes.

Why checking matters

A MiCA authorisation means a national regulator has reviewed the company and supervises it on an ongoing basis. Authorised crypto-asset service providers (CASPs) must, among other things, keep client assets separate from their own, have a complaints procedure, meet capital requirements and follow fair marketing rules.

If you use an unauthorised provider, you do not get these protections. The European Securities and Markets Authority (ESMA) has warned that clients of unauthorised providers do not benefit from MiCA safeguards, including protections for client assets.

Keep in mind: even a fully licensed provider cannot protect you from falling prices. A licence is a minimum requirement, not a quality label for any crypto-asset.

Step 1: Find the exact legal entity

Brand names are not what regulators register. Regulators register legal entities. A single brand can operate through several companies in different countries, and only one of them might be authorised in the EU.

Look for the legal name in:

• the website footer or “Legal” / “Imprint” page;
• the terms of service or user agreement you would accept when opening an account;
• the regulatory statement that authorised CASPs usually show, for example a sentence like “X B.V. is authorised as a crypto-asset service provider under Regulation (EU) 2023/1114 (MiCA) by [regulator]”.

Write down the full legal name, the country and, if shown, the registration or company number. If you cannot find a legal entity at all, that is already a serious warning sign.

Step 2: Check the ESMA register

ESMA publishes a central EU register of authorised CASPs, based on information sent by national regulators. You can find it on ESMA’s website under the Markets in Crypto-Assets Regulation (MiCA) page and in its registers section. At the time of writing, the interim register is published as downloadable files (CSV) that are updated regularly; ESMA has said it will be integrated into its regular IT systems.

In the register, check:

• Name: does the legal name match exactly?
• Home member state and competent authority: which regulator authorised it?
• Services: which crypto-asset services is it authorised for? Custody, exchange of crypto for funds, execution of orders, transfer services and so on are listed separately. A company authorised only for custody is not automatically authorised to run a trading platform.
• Passporting: in which other member states may it offer services? Look for the Netherlands (or your country) in the list.
• Website: is the website you are using the one listed?

The ESMA register is updated at intervals, so a very recent authorisation may appear first in the national register. If in doubt, check both.

Step 3: Check the national regulator

Every EU country has a national competent authority for MiCA. Some examples:

• Netherlands: Autoriteit Financiële Markten (AFM), which keeps a public register of crypto-asset service providers on afm.nl.
• Luxembourg: Commission de Surveillance du Secteur Financier (CSSF).
• Ireland: Central Bank of Ireland.
• Germany: BaFin.
• France: Autorité des marchés financiers (AMF).
• Malta: Malta Financial Services Authority (MFSA).

If a platform says it is licensed in one of these countries, search that regulator’s own register for the legal entity. Regulators’ websites usually end in an official national domain; always type the address yourself instead of clicking links in emails or ads.

Step 4: Check the warning lists

Regulators also publish lists of companies they warn against:

• AFM warnings: the AFM publishes warnings about parties that offer financial or crypto services without the required licence, including clone firms that pretend to be a licensed company.
• ESMA list of non-compliant entities: the interim MiCA register includes a file of non-compliant entities providing crypto-asset services.
• IOSCO I-SCAN: the International Organization of Securities Commissions runs an international portal that collects investor alerts from regulators worldwide.

An entry on a warning list is a clear reason to stay away.

Step 5: Watch out for clone firms

A common trick is to copy the name, address or licence number of a real authorised firm. The fake website looks professional and the register entry you find is real, but it belongs to someone else. To catch this:

• compare the website address and contact details in the register with the site you are on;
• be careful with lookalike domains (an extra letter, a different extension, or a hyphen);
• contact the authorised company through the details in the official register, not through the website or chat that approached you.

Step 6: Read the small print

Once you have confirmed the authorisation, take a few more minutes:

• Which entity will hold your account? Your contract should be with the authorised EU entity, not with an offshore affiliate.
• What services are excluded? Some products offered by a group (for example derivatives or certain “earn” products) may fall outside the MiCA authorisation or be subject to other rules or restrictions.
• Fees and risks: MiCA requires clear information about costs and risks. If you cannot find it, ask.
• Complaints procedure: note how to file a complaint.

Red flags that a licence claim is fake

• The website says “regulated in the EU” but names no regulator or legal entity.
• The licence number cannot be found in any official register.
• The firm refers to a “registration” from years ago rather than a MiCA authorisation.
• You are pushed to decide quickly, promised fixed or “guaranteed” returns, or asked to pay extra fees to withdraw money.
• Communication runs only through WhatsApp, Telegram or social media messages.
• The firm refuses to say which company you will have a contract with.

A note on big brands

Some well-known international brands have no MiCA authorisation, have restricted their EU services, or serve EU customers through only one specific entity. Their popularity elsewhere tells you nothing about their status in the EU. Always check the register; do not rely on advertising, social media posts or what a friend uses.

Quick checklist

• Legal entity name found? Yes or no.
• Listed in the ESMA register and/or national register? Yes or no.
• Authorised for the service you want to use? Yes or no.
• Allowed to serve your country? Yes or no.
• Website and contact details match the register? Yes or no.
• Not on any warning list? Yes or no.

Only if every answer is “yes” do you have a provider that is at least authorised. Whether you should use crypto at all is a separate question, and the risks remain high.

Sources: Regulation (EU) 2023/1114 (MiCA), ESMA Interim MiCA Register and statements on the end of the transitional period, AFM public registers and warnings, IOSCO I-SCAN. Information as of October 2026.