Where are MiCA providers registered, and where are they managed from?

01A highly concentrated distribution

For each country, the barometer counts the providers entered in the MiCA register by the competent national authority, each provider being counted once and identified by its LEI code. The country used is that of the competent authority, meaning the supervisory authority, not the country where the group is managed or where its clients are.

A very concentrated distribution. One country accounts for 28,9 % of registered providers (Germany) and another for 9,5 % (France), while the five countries with the most providers together account for 58,4 %.

Countries with few registered providers. At the other end, 5 countries have only one to three providers. The offer available in those countries therefore relies largely on providers registered elsewhere, which serve them through the passport (section 05).

The authorities of these countries have no provider entered in the register at this date. These are Hungary, Poland, and Romania.

A figure that reflects how access is organised. Two large euro-area economies can show very different numbers, depending on how each country opened access to the regime (authorisation of a new player or notification by an already regulated institution, section 02) and on which players chose to register there.

What the map does not say. Counting providers is not measuring a market. The number of registrations says nothing about the number of clients, trading volumes or the quality of supervision, because it reflects how providers chose, or were able, to register. The following sections explain why the gap between countries is so wide.

02Germany and the role of banks

109 of the 377 registered providers fall under the German authority (BaFin), i.e. 28,9 % of the total and 3,0 times the number under the French authority (AMF).

This weight does not, on its own, signal a German crypto market several times larger. The MiCA Regulation provides two routes to registration. The first is the specific crypto-asset service provider authorisation (Article 63), sought by players entering regulation. The second is notification (Article 60), through which an already regulated institution, in particular a credit institution or an investment firm, may provide crypto-asset services by informing its authority, without a new full authorisation. ESMA publishes this distinction for only some countries (see the method).

A majority of notifications, many banks

Of the 101 German providers registered by notification, 74 have a banking term in their company name (Bank, Sparkasse, Volksbank, Raiffeisenbank...), of which 60 a term specific to cooperative banks (eG, Volksbank, Raiffeisenbank, Sparda, PSD).

The service profile points the same way, since 78 of the 101 notifications cover a single service and 64 relate only to the execution of orders on behalf of clients. This pattern is consistent with existing institutions extending a crypto-asset buy and sell offer to their customers. The register publishes neither business models nor technical providers, and Uncrypt does not infer them.

This situation matches already regulated institutions, a majority of which carry a banking term, adding the purchase and sale of crypto-assets to the offer they already provide to their customers, rather than a large number of new specialist players arriving. When reading the map, this means a German registration is often an extension of an existing institution's activity, and rarely the launch of a new player.

What this changes in reading the map

Each legally distinct institution counts once, even when several institutions of the same banking network are registered and the register does not say whether they rely on a shared infrastructure. The German weight therefore first measures the number of regulated institutions that have notified, in a banking system made up of very many distinct institutions, and not the number of new crypto providers.

If only the specific Article 63 authorisations are counted, Germany has 8, against 21 in the Netherlands, 12 in Austria, 11 in Czechia and 10 in Spain, countries that also publish this information.

This reading describes register entries. It says nothing about the quality of the offer of the providers concerned and is neither a ranking nor a judgement on the authorities.

03The country where registered providers are managed

The authority's country says who supervises the provider, not in which country the group it belongs to is managed. For 359 of the 377 registered providers, Uncrypt has established the operating country, meaning the country where the parent company or group is actually managed, based on a dated source (legal notice, annual report, register, official press release). The figures count registered entities, identified by their LEI code, so a group holding several authorisations across several companies is counted several times.

29 registered providers are managed from the United Kingdom, 27 from the United States and 12 from Switzerland. These three countries account for 68 of the 84 providers managed outside the EEA. Providers managed from the United States are registered with several authorities (Ireland, Netherlands, Luxembourg, and Malta).

Germany weighs heavily in this total, with 109 providers of which 101 are managed from the country itself (section 02). Excluding Germany, 32 % of the 250 providers whose operating country is known are managed outside the EEA.

Countries outside the EEA of a weight comparable to the large European countries. The United Kingdom and the United States each have at least as many providers managed from their soil as the first EEA country after Germany (France). These providers therefore form a set comparable to that of the largest European countries.

One origin, several entry points. A provider managed from outside Europe is not required to register in a particular country, since the passport lets it choose the authority with which to file its application, then serve the whole EEA. The table shows that these choices are spread across several authorities, with some pairs more frequent than others.

No single authority concentrates the providers of one origin. Providers managed from the same country are spread across several authorities, with some associations more frequent than others but no general rule. This finding is a reminder not to infer a provider's country of management from the authority that registered it, or the reverse.

Entry points. In 6 countries, fewer than half of the providers are managed from the country of their authority, namely Ireland, Luxembourg, Malta, Latvia, Cyprus, and Austria. Among authorities with at least five providers, the share of providers managed from outside the EEA is highest with two of them, namely Ireland and Luxembourg.

Access to the European market for groups managed elsewhere. In these countries, a significant part of the registrations concerns providers whose group has its decision-making centres abroad. The passport makes this arrangement possible and compliant with the Regulation, but it shifts how supervision should be read, since the authority that holds the registration is not always that of the country where the group's decisions are taken.

For 72 % of the providers whose operating country is known, the group is managed from the country of the authority that registered it. For the remaining 28 %, the two countries differ, with 84 providers managed from a country outside the EEA and 18 from another EEA country.

The next chart takes up this reading authority by authority. It distinguishes providers whose group is managed from the same country, from another EEA country or from outside, and shows which authorities mainly register providers managed from their own country and which mainly register providers managed from abroad.

Two profiles of authorities. Some register almost only providers whose group is managed from their own country, others mostly providers whose group is managed from another country. This is neither a merit nor a flaw. It follows from the group's choice of the authority it registers with, a choice that does not always match the country where it is based.

What this changes for the reading. The same number of registrations can cover very different realities, with on one side domestic providers that obtained a registration from the authority of their own country and, on the other, providers belonging to international groups that chose an authority to gain access to the whole EEA.

A gap is neither an irregularity nor a ranking. The European passport allows a group managed from a third country or from another Member State to register with a single authority and serve the whole EEA. This reading describes where groups are managed, not the quality of their supervision.

Of these 102 gaps, 84 rely on an official source, a register or the declared parent company, and 18 on a declarative or press source. In addition, the operating country could not be established for 18 providers, for lack of an official document.

04Malta and Cyprus: what is known, what is not

The authorities of Malta (MFSA) and Cyprus (CySEC) have registered 47 providers, or 12 % of the total. For 12 of them, Uncrypt could not establish the country where the group is managed from an official document, and 18 of the other 35 rest on a declarative or press source.

These two authorities mostly register providers that declare serving the whole EEA, since 38 of the 47 notify 25 countries or more. When the group is managed elsewhere and the source is incomplete, the link between the supervising authority and the place where decisions are taken is harder to read.

Rarer information, not an anomaly. When no public document names where a group is managed, Uncrypt leaves the country blank rather than infer it. Several reasons can combine, whether young groups, groups organised in several entities across several countries, or groups whose public documents mention only a locally registered company.

A local entity, a group elsewhere. A provider registered in Malta or Cyprus may be the local entity of a group managed on another continent. This is lawful and provided for by the passport, but the entity's name is not enough to tell, and one has to look at the parent company, which is what this section does.

This finding describes the public information available and Uncrypt's collection, not the compliance of the providers or the action of the authorities. An operating country that is not established is neither an irregularity nor proof that there is no actual management on site.

05The passport: one authorising country, the whole EEA

Thanks to the European passport, a MiCA registration by a national authority is valid across the whole EEA. The provider simply has to notify the countries in which it intends to serve clients, and the ESMA register lists these countries for each entry.

Across all providers, 41 % notify only the country of their authority, while 46 % notify 25 or more. The passport is therefore used in very different ways.

Profiles vary widely by country of the authority. In Germany, 85 % of providers notify only Germany, which is consistent with an offer aimed at the domestic customer base. Conversely, 83 % of providers registered by the Cypriot authority, 78 % by the Maltese authority and 100 % by the Luxembourg authority notify 25 countries or more. These authorities therefore mostly supervise providers that declare they serve clients across the whole EEA.

Two models, few in-between cases. On one side, providers that mainly serve their domestic clientele (a single country declared), on the other, providers that declare almost the whole EEA. Only 14 % of providers sit between the two, the choice generally being between a domestic market and a pan-European offer.

Providers managed from outside the EEA use the passport on a large scale. They notify a median of 29 countries, and 82 % of them notify 25 or more. For providers managed from the country of their authority, the median is 1 and 32 % notify 25 or more.

One registration, different uses. For a group based outside the EEA, a single registration opens access to some thirty countries, whereas for a group based in the country of its authority it often serves the home market first. The passport is the same, but the strategy of those who use it differs.

06The registration calendar

The MiCA Regulation has applied to crypto-asset service providers since 30 December 2024. Providers already active could continue under their national regime during a transitional period, at the latest until 1 July 2026. The chart shows, month by month, the authorisation or notification date of the providers currently registered.

76 providers (20 % of the total) carry a June 2026 date, the last month before the end of the transitional period. 87 providers carry a date after 30 June 2026.

A deadline effect. This clustering around 1 July 2026 is consistent with the end of the transitional period, since from that date a provider that is not registered can no longer serve clients in the EEA. The chart also shows registrations dated after the deadline.

A register built month by month. MiCA has applied since 30 December 2024 and the register is recent, each month adding entries, amendments and sometimes the end of a registration.

These are the register's dates, namely the authorisation date for a CASP authorisation and the notification date for a notification. They do not say since when the provider has been operating, which may predate its entry under an earlier national regime.

07Definitions and limits of interpretation

The terms below have the same meaning throughout the document. The Uncrypt glossary gives more general definitions.

Registered provider (CASP)

Crypto-asset service provider listed in ESMA's MiCA register with an authorisation or notification in force. It is the unit counted in this document.

Authorisation (Article 63)

Specific authorisation granted by a national authority to a crypto-asset service provider, after examining its application.

Notification (Article 60)

Procedure by which an already regulated institution, for example a credit institution or an investment firm, informs its authority that it provides crypto-asset services, without a new full authorisation.

LEI code

Legal Entity Identifier, a 20-character code that identifies a legal person. A provider is counted once, whatever the number of its interfaces or brands. A single group can hold several registered entities, hence several LEI codes, so the figures count entities and not groups.

Competent authority

National authority that supervises the provider and keeps its entry. The country used on the map is that of this authority.

European passport

Right of a provider registered in one EEA state to serve clients in the other states after notification, without a new authorisation.

Transitional period

Period during which providers already active could continue under their national regime, at the latest until 1 July 2026.

Operating country

Country where the group to which the provider belongs is actually managed, distinct from the authority's country and from an offshore incorporation. It is recorded from a dated source; when no official source names it, it is left unstated.

Official source

A document that names the management seat or the parent company, such as a legal notice, an annual report, a regulatory filing, an official press release of the group or the parent company declared at the GLEIF.

Declarative or press source

A source that does not name the management seat, such as the company's own profile (LinkedIn page, job postings, interview of an executive), a press article or a registered address alone.

Open the glossary

Limits of interpretation

• A registered provider is not necessarily an active provider, because the entry says nothing about the volume of activity or the number of clients.
• Authorisations (Article 63) and notifications (Article 60) are counted together; their distinction is published for only 8 countries.
• The data follow the ESMA register and the Uncrypt database at the date shown, so a recent entry or the end of an entry may not yet appear.
• The operating country is collected by hand and reviewed at each update, so a change of management seat only appears at the next review.
• The figures count registered entities (one LEI code each) and not groups, so a group holding several authorisations across several companies appears several times.

08Detail by country

09Method and sources

• Source: the ESMA register provides the list of registered providers, their authority, legal basis, dates and notified countries. Uncrypt matches each provider, by LEI code, with the register of its national authority, then establishes the country where its group is managed from a dated source. Data as of 28/10/2026.
• Counting: each provider counts once, identified by its LEI code, the one used in the ESMA register: several interfaces or brands of the same company (an app and a “pro” interface, for example) count as one. Providers whose registration, by authorisation or by notification, is in force in the register are counted, assigned to the country of the competent authority. This total includes 1 entity still listed in the register that has ceased its services in the European Economic Area. Excluded: 2 authorisations ended in the register and 1 player without its own authorisation, distributing the offer of an authorised provider. 5 entities listed in the register whose authorisation takes effect after this date are counted from their authorisation date.
• Coverage: the count covers 377 of the 377 providers in force in the ESMA register as of 25/10/2026.
• ESMA register: the analyses of legal basis, notified countries, services and dates rely on the official ESMA register, synchronised on 25/10/2026, for the providers in force at the date of the data. They are, country by country, the same providers as in the Uncrypt database.
• Legal basis: Article 63 (crypto-asset service provider authorisation) or Article 60 (notification by an already regulated institution). ESMA states it for only 8 countries; for 179 providers it is absent and never inferred. Comparisons in this document on this criterion are therefore limited to these 8 countries.
• “Banking term” indicator: the register does not publish the type of institution. To describe the German notifications, Uncrypt counts company names containing a banking term (Bank, Sparkasse, Volksbank, Raiffeisen, Sparda, PSD, Landesbank, Girozentrale, eG, Genossenschaft). It is a reading aid, not a legal classification.
• Passport: number of countries listed, for each provider, in the ESMA register's list of countries of service provision, grouped in three classes (a single country, 2 to 24 countries, 25 countries or more). The list is declarative and measures neither activity nor the number of clients.
• Operating country: country where the group is actually managed (management seat of the parent company or group), recorded for each entity from a dated source. An absorbed entity takes the country of its acquirer, an entity that remains autonomous keeps its own, and an offshore incorporation (Seychelles, British Virgin Islands...) or a mere registered address is never used. When no official document names the country, the field is left empty. Declarative or press sources (the company's profile, an article, the registered seat alone) are distinguished in the flows (dashed line) and in the counts.
• Origin and passport: the operating country is matched, by LEI code, with the number of countries notified in the ESMA register. A gap is a provider whose operating country differs from the authority's country; an “entry point” is an authority (at least five providers) where fewer than half of the providers are managed from the country itself.
• Dates: authorisation or notification date as published in the register. A registered provider whose date has not yet been reached is not counted before that date.
• Updates: the barometer follows the Uncrypt database and is recalculated each time it is updated; the data date appears at the top of the page.
• Reading: this barometer describes register entries. It does not assess authorities or providers and is not a ranking.

10Cite, download, print

When reusing the figures or the map, please cite the source and the data date:

Uncrypt, Where are MiCA providers registered, and where are they managed from?, based on the ESMA register, data as of 28/10/2026, uncrypt.eu/en/barometre/qui-est-derriere-les-agrements-mica

Who produces what

• ESMA register. Official source of the registrations: list of providers, competent authorities, legal basis, authorisation or notification dates and notified countries.
• CASP Tracker. Open project (casptracker.eu) that structures the ESMA interim register, used as a data source under a CC BY 4.0 licence.
• Uncrypt. Matching of each registration, by LEI code, with the register of the national authority, manual collection of the country where each provider's group is managed from a dated source, calculations, maps, charts and data updates. This work is specific to Uncrypt and does not exist in any official register.

Data: CASP Tracker (casptracker.eu), based on the ESMA MiCA interim registers (CC BY 4.0).

The full document prints without the interactive elements. In the print dialog, choose “Save as PDF”.