MiCA register: authorised or just notified?

On 30 September 2026, ESMA published a new version of the MiCA register of crypto-asset service providers: 364 rows, 361 legal entities. The file draws no distinction between a full CASP authorisation (Article 59) and a notification by a bank or investment firm (Article 60). We ran our own count: at least 110 of the 361, or 30%, are banks or are demonstrably listed under such a notification.

What is in the 30 September version?

The register is a CSV file (CASPS.csv) on ESMA's MiCA page. The file carries a modification date of 30 September 2026, and ESMA shows ‘Last update: 30 September 2026’ above the register. The key figures:

• 364 rows. On 21 August 2026 there were 335, so 29 rows were added in six weeks.
• 361 legal entities. 358 unique LEI codes plus three Greek companies without an LEI. Three German institutions appear twice, with two different dates: EUWAX, Deutsche WertpapierService Bank and DekaBank.
• 27 home countries: 24 EU member states plus Norway, Iceland and Liechtenstein.
• 2 rows with an end date. All the others are current.
• Each row also lists the countries the provider has passported into. A passport only means a provider is allowed to operate in a country, not that it takes on customers there.

Germany accounts for more than a quarter of all rows. That is mainly down to banks, as shown below.

Authorisation or notification: what is the difference?

Under MiCA, a crypto provider without any other financial licence has to apply for a CASP authorisation (Article 59, following the procedure in Article 63). That is the route taken by, for example, Bitvavo, Finst and BLOX with the Dutch AFM.

An institution that is already under financial supervision can instead submit a notification (Article 60). The rules by type of institution:

• Banks may offer crypto services if they notify their supervisor at least 40 working days in advance.
• Investment firms (brokers) may do so only for crypto services equivalent to the investment services for which they are already authorised.
• Electronic money institutions may, through a notification, only hold and transfer their own e-money tokens.

That notification is not a one-line formality. Among other things, the institution has to submit a business plan, its ICT documentation, its custody policy and its procedure for segregating client assets.

The drawback for anyone reading the register: ESMA puts both routes in the same file, under the heading ‘Authorised crypto-asset service providers’, with no column to tell them apart. In the CSV, a bank with a notification looks exactly like an exchange with an authorisation.

How many banks and brokers are listed?

Because the CSV doesn't say, we counted in two ways.

By name: at least 85 banks

We searched the names for bank, banco, banca, banque, banka and pank, and for compounds such as Volksbank, Raiffeisenbank, CaixaBank and Kutxabank. That gives 87 rows and 85 legal entities: 23.5% of the 361.

• 64 of the 87 rows come from Germany. Of those, 47 are cooperative banks with ‘eG’ in their name (Volksbanken, Raiffeisenbanken, VR-Banken), plus one Raiffeisenbank without that suffix.
• Outside Germany: 6 Spanish banks (including BBVA, CaixaBank and Openbank), 4 from Liechtenstein, 3 from Luxembourg and 2 from France.
• The Netherlands: one, ClearBank Europe.

This is a lower bound. Banks whose name does not contain the word ‘bank’ are left out, such as Berenberg and BNY. Brokers are left out entirely.

Where the supervisor says so itself

Four supervisors publish a list that does make the distinction:

• AFM: the download states ‘CASP Authorisation (art.63)’ or ‘CASP Notification (art.60)’ for each row.
• AMF: uses A numbers for an authorisation and N numbers for a notification.
• CNMV: lists ‘entidad de crédito’ for banks.
• CySEC: keeps a separate list for Article 60.

We set those four lists against the ESMA rows:

This is where the name count falls short. Of those 30 notifications, only 9 carry a bank name. The other 21 are brokers, asset managers and payment institutions, such as Vivid Money, One Trading and Change Securities in the Netherlands, Finary and CoinShares in France, and Trading 212 and XTB in Cyprus.

Adding it up: at least 110 of the 361

To the 85 legal entities with a bank name we add the 25 that have no bank name but which a supervisor, or ESMA itself, says are listed under Article 60:

• 7 in the Netherlands, 7 in France and 7 in Cyprus;
• 1 in Germany (JT Technologies, justTRADE);
• 3 e-money institutions in Lithuania and Malta, where ESMA itself refers to Article 60(4) in the comments column.

Together that makes at least 110 of the 361 legal entities: 30%. The real figure is higher, because in countries such as Germany, Luxembourg and Liechtenstein we did not check brokers without a bank name one by one.

The reverse also happens: a broker can hold a full authorisation. Interactive Brokers Ireland is an investment firm, but the Central Bank of Ireland lists it as ‘authorised as a CASP in accordance with Article 63’. eToro appears on both CySEC lists. So you cannot infer the route from the type of company. The register of the provider's own supervisor is the only reliable source.

Which well-known names are listed with a notification?

According to the national registers, these firms are listed under Article 60:

• Trade Republic, N26, flatexDEGIRO and Scalable Capital (BaFin). For each of them, BaFin cites ‘Art. 59 Abs. 1b’, the legal basis for institutions with a notification.
• BBVA and Openbank (CNMV, entidad de crédito).
• Vivid Money, One Trading, Change Securities and Webull Securities (Europe) (AFM). According to the AFM, Webull will not start offering crypto services until 1 November 2026.
• Trading 212 and XTB (CySEC, notification list).

These firms appear in our own register of MiCA authorisations labelled ‘notification (Art. 60)’ rather than ‘authorisation’.

Deutsche Bank has been in the file since this version, with a date of 12 October 2026. That date falls after the file was published. In September the bank said it expected BaFin approval in October, for the custody of bitcoin, ether and a few stablecoins for corporate clients. Three more German cooperative banks are listed with an October date.

What the register doesn't tell you

Besides the missing distinction between authorisation and notification, our check on 2 October turned up the following:

• An LEI typo. For Zap (Strike) Europe, ESMA writes the LEI with the letter O instead of the digit 0. That code does not exist at GLEIF. The Maltese supervisor, the MFSA, has the correct one.
• An outdated LEI. Bitpanda GmbH is listed with an LEI that GLEIF retired after a merger on 20 February 2026. The authorisation holder now carries LEI 98450086582EV2FFC109.
• A date in 2028. ESMA lists Regular Finance with 11 September 2028. The AMF list gives 11 September 2026.
• Dates that differ from the home supervisor's, by anything from one day to six weeks. For Trade Republic, BaFin gives 24 April 2025 and ESMA 28 April. For Swissquote, the CSSF gives 5 June 2026 and ESMA 24 April.
• Being listed is not the same as being active. KuCoin EU is listed with an authorisation from the Austrian FMA. Under an FMA decision of 18 February 2026, the company may not yet commence operations. On 18 May 2026 the FMA lifted only the separate ban on taking on new customers.

Want to check for yourself who is listed? Searching by LEI works better than searching by brand name. We explain how in Checking a MiCA authorisation yourself.

Does it matter to you as an investor?

For everyday use, usually not. A bank or broker with a notification may provide the same kind of services, and has to submit a policy on custody and segregation of client assets with its notification. The supervisor is then that of the bank or broker.

The difference comes down to three things:

1. Scope. Through a notification, a broker may only provide crypto services that fit its existing investment licence. An e-money institution may only hold and transfer its own e-money tokens.
2. Where to check. If you want to know on what basis a firm is listed, look at the national supervisor, not the ESMA file.
3. What a bank offers. A notification does not mean every customer can buy crypto. Some of the banks focus on custody for corporate clients. BBVA, Openbank and KBC offer it only to their own account holders.

When it makes no difference: if all you want to know is whether a platform is under European supervision, either route may be enough. The EU passport determines where a provider may operate, regardless of the route. See the EU passport of an authorisation. To compare platforms side by side on fees and authorisation, use the comparison tool. More on the rules themselves is on our MiCA page.

This article is for information only and does not constitute legal or investment advice.

Frequently asked questions

Is a MiCA notification the same as a CASP authorisation?

No. A CASP authorisation (Article 59) is a full application procedure for a crypto provider. A notification (Article 60) is submitted by an institution that already holds a banking, investment or e-money licence, at least 40 working days before it starts. The ESMA register lists both without distinction.

Is my bank MiCA-authorised?

Look up your bank's name or LEI in ESMA's CASPS.csv file or in our register. If it is listed, check with the national supervisor on what basis: the AFM in the Netherlands, BaFin in Germany, the CNMV in Spain. In the 30 September version, 85 legal entities carry a bank name.

How can I tell whether a provider has an authorisation or a notification?

Not from the ESMA CSV, but from the register of the home-country supervisor. The AFM spells it out in its download, the AMF uses A and N numbers, CySEC keeps two separate lists, and BaFin writes ‘Art. 59 Abs. 1a’ (authorisation) or ‘Abs. 1b’ (notification).

How many crypto providers have a MiCA authorisation?

The ESMA version of 30 September 2026 contains 364 rows for 361 legal entities. At least 110 of them are banks or institutions with a notification. ESMA does not give an exact number of ‘real’ authorisations.

How often does ESMA update the register?

ESMA says it publishes ‘at regular intervals’ and names no fixed frequency. Between 21 August and 30 September 2026, 29 rows were added.

Sources: ESMA, MiCA page and CASPS.csv (version of 30/09/2026); AFM, register of crypto firms (overview of 07/09/2026); AMF, liste blanche PSCA (30/09/2026); CNMV, relación de proveedores de servicios de criptoactivos (02/10/2026); CySEC, MiCAR lists for Articles 60 and 63; BaFin, Unternehmensdatenbank; Central Bank of Ireland, register; FMA (Austria), press release of 18/05/2026; GLEIF; MiCA Article 60 (Regulation (EU) 2023/1114); The Industry Spread and Futu News on Deutsche Bank. Last checked: 2 October 2026.