MiCA warning list: 216 entries, Lithuania adds 27

The public ESMA register of firms that, according to a national supervisor, offer crypto services without the required MiCA authorisation now holds 216 entries. That is 49 more than the 167 in our article of 25 August. Most of the growth comes from one new reporter: on 6 November the Bank of Lithuania submitted 27 entries, where Lithuania previously stood at zero. Italy's CONSOB remains by far the largest reporter, with 180 of the 216.

The warning list in short

• 216 entries in ESMA's NCASP.csv file, counted on 12 November 2026. According to the server header, ESMA's file was last modified on 11 November 2026; the newest line is dated 6 November.
• Six supervisors have submitted something: CONSOB (Italy) 180, the Bank of Lithuania 27, the FSMA (Belgium) 6, and the Czech central bank, the AFM (Netherlands) and the Slovak central bank 1 each.
• Lithuania is new: all 27 Lithuanian entries carry a decision date of 27 October (5) or 3 November 2026 (22).
• Italy has fallen from almost 99% to just over 83% of the total, mainly because others have been added. In absolute terms Italy rose too, from 165 to 180.
• 24 of the 30 EU and EEA countries have never submitted anything. Germany and France are still at zero.
• A list without your provider is not a clean bill of health. An empty spot only means that no supervisor has reported the firm.

What changed since August

In August the file held 167 entries: 165 from CONSOB, one from the AFM and one from the Slovak central bank. That figure comes from CryptoTicker's count of 16 August 2026, which we did not check ourselves at the time. The current position, however, we counted ourselves in the file ESMA publishes.

The sums add up: 27 (Lithuania) + 15 (Italy) + 6 (Belgium) + 1 (Czechia) = 49 more, and 167 + 49 = 216. Italy's share: 165 of 167 is 98.8%, 180 of 216 is 83.3%.

On 4 November, in the version of 29 October, Finance Magnates counted 188 entries, 179 of them from CONSOB. That fits: between 29 October and now, 28 were added, 27 from Lithuania and one from Italy. That last point is our own comparison of two counts and not a statement by ESMA.

What each entry contains

ESMA describes the fields in a separate file. Each entry gives the reporter, the country, the name of the firm, the website, a description of the reason and the date of the supervisor's decision. According to that field description, the decision concerns crypto services in breach of Article 59 or 61 of MiCA, the articles that require an authorisation or a notification.

For the Lithuanian entries, the reason mentions services such as safekeeping of crypto for clients, exchange of crypto for money or for other crypto, and transfers. We do not name names. An entry is a supervisor's statement about a firm, and we only read what is in the file. If you want to see the names, they are in ESMA's file itself.

There is one field we cannot interpret. The field for a possible infringement as determined by ESMA under Article 17 of the ESMA Regulation is set to "Yes" for all 27 Lithuanian entries and to "No" for all 189 others. The file does not explain what that means in practice.

Why this is still a poor safety check

The list growing does not make it complete. There are 30 EU and EEA countries, and six of them submitted something. Germany has by far the most providers in the register of authorised firms, yet stands at zero in the warning list. According to Finance Magnates, BaFin issued 89 warnings about crypto services in 2026 up to 3 November, and France's AMF has put 64 names on its own list since January. Those warnings are published on the supervisors' own sites and not in the ESMA file.

Two things follow:

• If a firm is on the list, a supervisor has made a statement about it. Take that seriously.
• If a firm is not on the list, you know nothing. The country may publish its warnings elsewhere, it may not have reported anything yet, or there may be nothing wrong.

What you can check

The conclusive check is the reverse one: is the provider in the register of authorised firms? That is the same ESMA register, only the other file (CASPS.csv). We keep track of it in our MiCA authorisations register, per provider and per service. For more on the latest growth of that register, read MiCA register: 397 entries, 16 more from Germany.

Keep three things in mind:

1. Check the name of the entity, not the brand on the website. A global platform may have a European entity with its own authorisation.
2. Check which services the authorisation covers. A provider may be authorised to execute orders but not for custody.
3. Also search the website of the supervisor in your country, because it publishes warnings that are not in the ESMA file. For the seven providers in our comparison you will find the supervisor for each platform. General tips against scams are in our safety checklist.

For the background to the empty-list problem, read EU crypto warning register: 165 of 167 from Italy.

What does this mean for you as a European investor?

Netherlands. The AFM has submitted one entry. If a provider is recommended to you, check the authorisations register and the AFM's website too.

Belgium. The FSMA appears in the file with 6 entries, a newcomer since August. The Belgian entries refer to a warning on the FSMA's website.

Germany, France, Spain, Portugal and Poland. The supervisors in these countries (BaFin, AMF, CNMV, CMVM and KNF) have no entry in the file. That says nothing about their own warnings. Look at their own sites.

Italy and Lithuania. If you are dealing with a firm from one of these countries, it is more likely to appear in the file, because their supervisors report actively. That says something about their reporting behaviour and not about the quality of the market.

Tax. This changes nothing about what you have to report to the tax authorities. For each country, see our overview of crypto tax in Europe.

What is not certain yet

• What the ESMA infringement field means. It is only set to "Yes" for Lithuania. ESMA does not explain it in the file.
• When other countries will start reporting. The file sets no deadline or obligation for supervisors to submit anything; 24 of the 30 countries have not done so yet.
• Whether the list will become complete. As of 12 November it is impossible to tell how many of the warnings in national lists will ever make it into the ESMA file.
• The August position. The 167 entries come from a CryptoTicker count and were not recounted by us. The growth of 49 is therefore a comparison with that count.

This article is not investment advice or legal advice. Crypto can lose a great deal of value and you could lose your entire stake.

Frequently asked questions

What is the ESMA warning register?

It is a public list in ESMA's NCASP.csv file of firms that, according to a national supervisor, offer crypto services in breach of MiCA. The supervisors submit the entries themselves; ESMA adds nothing to them.

How many entries does it hold now?

216, counted on 12 November 2026. Of these, 180 come from CONSOB in Italy and 27 from the Bank of Lithuania.

Does "not on the list" mean a provider is safe?

No. 24 of the 30 EU and EEA countries have submitted nothing. Instead, check whether the provider is in the register of authorised firms.

Where do I find the official files?

On esma.europa.eu, in the section on the interim MiCA register: NCASP.csv for the warnings and CASPS.csv for the authorisations.

Is an entry in the register a conviction?

The file does not say. It records that a supervisor has taken a decision about a firm. The details are with the supervisor.

Sources

Read on 12 November 2026.

• ESMA: NCASP.csv, the list of non-compliant providers, last modified 11 November 2026 according to the server header, our own count on 12 November 2026.
• ESMA: description of the fields of the interim MiCA register, read on 12 November 2026.
• ESMA: MiCA page with the interim register, read on 12 November 2026.
• Finance Magnates: Italy Filed 95% of the EU's Register of Unlicensed Crypto Firms, 4 November 2026.
• ESMA: CASPS.csv, the register of authorised providers, read on 12 November 2026: Germany has 130 of its 407 rows, the most of any country.