MiCA Decoded: 174 Registered CASPs, but Only 14 Can Operate a Centralized Crypto Exchange (CEX)?

MiCA Decoded is simply a 12-article play bid for Bitcoin.com News, co-authored by LegalBison’s Co-Founding and Managing Directors: Aaron Glauberman, Viktor Juskin and Sabir Alijev. LegalBison advises crypto and FinTech companies connected MiCA licensing, CASP and VASP applications, and regulatory structuring crossed Europe and beyond.

If the EU has already issued 174 MiCA licenses, wherefore are determination lone 14 existent crypto exchanges connected the list? To demystify this, we request to decode what the nationalist registers are truly telling america astir however crypto businesses are mounting up successful Europe.

That contrast, drawn from the EU and EEA nationalist registers arsenic of March 2026, captures the cardinal question the register raises: which concern models are landing successful which jurisdictions and why?

The information answers that question, and the signifier is not what astir crypto licence holders expected.

10 work codes: what MiCA authorizes CASPs to do

The regularisation defines 10 categories of crypto-asset services. The organisation crossed each 174 authorized entities breaks down arsenic successful the array beneath (any authorization tin screen 1 oregon much of them).

How does a marketplace serving hundreds of millions of users person lone 14 authorized venues to really run a unrecorded trading platform?

• Custody and transfer services pb due to the fact that astir each relation includes them, careless of superior concern model.
• Transfer services show precocious volume partially due to the fact that German accepted fiscal institutions added it arsenic a earthy hold of existing outgo infrastructure (credit institutions, physics wealth institutions), arsenic it comes down to a notification process, the infrastructure enactment being already contiguous (ICT and DORA compliant). How that authorization applies to afloat crypto-native transportation models is inactive being worked retired successful practice.

The rarest categories are the astir telling.

• Only 14 entities clasp authorization to operate a trading platform: a marketplace specified arsenic an bid publication oregon matching engine. Example: Binance’s trading platform, with charts and ocular indicators tools.
• Only 21 clasp authorization to provide concern advice: personalized recommendations regarding whether a circumstantial crypto-asset is suitable for the lawsuit to buy, sell, oregon hold. Example: eToro issues newsletters with adept sentiment connected which crypto-asset is worthy considering. The assemblage tin besides stock insights.
• And 30 clasp portfolio management: managing lawsuit concern portfolios that see crypto-assets. Example: Wyden Capital focuses purely connected creating and managing tailored portfolios for investors.

For founders gathering products successful those 3 work categories, the EU presently has reasonably fewer licensed notation points to benchmark against.

Where crypto licenses successful Europe are concentrating, and why

• Germany leads the CASP registry with 51 authorizations (29%).
• The Netherlands follows with 23 (13%).
• France and Malta travel with 13 (7%) and 12 (7%), respectively.
• Ireland and Cyprus travel with 11 (6%) and 10 (6%), respectively.

Those header numbers obscure what is driving the clustering.

Germany‘s 51 CASPs are dominated by accepted fiscal institutions: Commerzbank, DZ BANK, Boerse Stuttgart and determination Volksbanks. The registered entities successful Germany are truthful predominantly retail-banking custodians and broker-dealers, not speech operators.

Their applications were predominantly for constrictive work codes suited to a broker exemplary serving existing fiat relationship holders. BaFin has processed these types of entities for decades. The regulator’s familiarity is sizeable and for banks having already met each the requirements, it is lone a notification process with the respective competent authorization to besides beryllium eligible to supply services nether MiCA.

Malta and Cyprus tell the other story. OKX, Crypto.com, Gemini, Blockchain.com, eToro, and Revolut clasp authorizations successful those 2 jurisdictions.

These platforms applied for wide work codification sets covering trading level operation, speech activity, and bid execution. Their regulators successful Valletta and Nicosia person processed applications from globally recognized speech brands astatine scale.

The applicable accusation is that, if a crypto speech licence exertion lands successful Germany, it sits successful a queue alongside accepted banks applying for narrower services, specified arsenic providing custody and medication of crypto-assets, the execution of orders, and the reception and transmission of orders connected behalf of clients.

The aforesaid exertion landing successful Malta sits alongside established planetary exchanges.

Regulator familiarity with the applicant’s concern exemplary is simply a existent origin successful however an exertion is reviewed, adjacent erstwhile the regularisation is identical successful some places.

Where did the large names register

For founders choosing a jurisdiction, the register’s astir utile awesome is not the state number but the institution names down each flag. Acknowledging which jurisdictions were chosen by large CEXes, for example, gives an denotation of wherever it makes consciousness for a akin task to see being registered.

Ireland is wherever Kraken landed, and the prime reflects a pre-existing relationship. Kraken’s squad was apt already located successful Ireland and already held VASP registrations and an EMI licence from the Central Bank of Ireland earlier MiCA came into force. This surely made the Fit & Proper valuation of cardinal unit holding akin positions connected some institutions faster. Ireland was past the earthy consolidation point, folding aggregate nationalist registrations nether a azygous MiCA authorization. It was besides the archetypal large planetary speech to wide the Central Bank of Ireland’s CASP authorization process, which gave the jurisdiction an aboriginal speech notation point.

Luxembourg hosts some Coinbase and Bitstamp. For both, Luxembourg was the jurisdiction wherever the regulator had already processed their anterior applications. The CSSF‘s way grounds with organization fiscal services explains the clustering. Coinbase explicitly described Luxembourg arsenic its European crypto hub, citing the country’s attack to blockchain legislation, including successive blockchain laws that adapted Luxembourg’s fiscal model for DLT. Bitstamp arrived astatine the CSSF having already obtained a MiFID licence determination for operating a Multilateral Trading Facility.

Austria is wherever Bybit, KuCoin, and the homegrown Bitpanda are based, and the FMA‘s early-mover positioning explains it. Austria completed its home MiCA implementing authorities up of astir EU subordinate states. Bitpanda, which holds astir 60% of the Austrian retail crypto market, was already FMA-licensed and had shaped the regulator’s familiarity with exchange-type concern models. When Bybit and KuCoin were evaluating wherever to works their EU entity, they cited the FMA’s timely implementation and applicable attack to the authorization process. The Austria clump is past a effect of Bitpanda having done the groundwork first.

Cyprus hosts eToro and Revolut, 2 platforms whose roots successful the retail concern and FinTech abstraction predate their crypto offerings. Both had existing CySEC relationships earlier MiCA. Their CASP authorizations extended a regulatory narration already successful spot alternatively than establishing a caller one.

The Netherlands is wherever Bitvavo and MoonPay registered, and the AFM’s aboriginal enforcement posture drove the choice. The Netherlands was among the archetypal EU jurisdictions to assistance MiCA authorizations, with its first-wave approvals landing successful December 2024. Platforms that wanted to beryllium among the earliest licensed successful the EU, and that had existing Dutch VASP registrations, recovered the AFM pipeline already moving.

The signifier crossed each 5 jurisdictions is the same: exchanges did not take regulators abstractly. They went wherever the regulator already knew their concern model, oregon wherever implementation was furthest ahead. That is simply a applicable acquisition for immoderate laminitis present evaluating wherever to apply.

Passporting: staying location oregon targeting a full continent

A azygous MiCA licence from immoderate EU subordinate authorities covers the full bloc. Passporting requires lone an administrative notification to widen services to further subordinate states, with nary abstracted exertion oregon 2nd regulator review.

When applying, the applicant is required to authorities wherever it intends to behaviour business.

Pan-European platforms person utilized this fully: Kraken, Bitvavo, Bitstamp, Bitpanda, and Trade Republic person each passported to 29-30 countries (EU + EEA) from a azygous location authorization.

Traditional German and Spanish institutions database lone their location country, confirming that for those entities, MiCA functions arsenic home compliance alternatively than enlargement infrastructure.

The mechanics substance here. Under passporting, the location regulator remains liable for the platform’s ongoing supervision crossed each passported markets. The jurisdiction prime is truthful a market-access determination and a regulatory governance determination astatine the aforesaid time.

Founders gathering for EU retail clients bash not request 30 abstracted applications. One well-chosen authorization, passported crossed the Union, is however Kraken, Bitstamp, and Bitpanda person covered the full market.

The jurisdictions with nary way grounds yet

Ten jurisdictions wrong MiCA’s scope person produced zero nationalist authorization records successful the CASP register: Croatia, Estonia, Greece, Hungary, Iceland, Italy, Norway, Poland, Portugal, and Romania.

Poland stands isolated from the different inactive jurisdictions, and its concern is much operationally urgent. Along with Lithuania, it was the astir fashionable European jurisdiction for crypto licensing earlier MiCA. As of March 2026, the section implementation of MiCA has inactive yet to pass.

This is becoming a root of interest for the galore VASPs ( crypto companies nether the erstwhile regime) who are faced with the EU-wide deadline of July 1, 2026, without having the anticipation to upgrade their licence to a Polish CASP, since the caller authorities is not unrecorded yet.

Romania is the lone state inactive listed arsenic “to beryllium announced” for its NCA (National Competent Authority) designation.

A missing NCA designation points to 1 thing: the home regulatory infrastructure for MiCA oversight is not yet successful place. Romania has yet to take (or form) a nationalist assemblage liable for enforcement and supervision of crypto-asset work providers.

The July 1, 2026 deadline applies arsenic to each jurisdiction of the Union, prepared oregon not. Founders who built their European crypto licensing strategy astir a jurisdiction that has not yet activated its regulatory infrastructure are present facing that mismatch, with little than 4 months to resoluteness it.

Reading the MiCA registry arsenic a crypto licence strategy signal

The 174 authorizations crossed the EU are not evenly distributed due to the fact that concern models are not arsenic well.

The registry reflects thing that a speechmaking of the MiCA substance unsocial cannot show:

• Where circumstantial types of applications land,
• How regulators who process them compare,
• Which jurisdictions person functional pipelines versus untested ones.

For speech founders, Malta and Cyprus provide the astir comparable notation pool.

For axenic custody and broker-dealer models, Germany, Spain and the Netherlands offer the astir precedent.

For proposal and portfolio absorption products, the takeaway from the information is that the EU has astir nary established notation cases successful those categories yet.

Building those products is imaginable nether the caller framework, but determination is nary roadmap from approved comparable entities. The achromatic insubstantial registry survey we published arsenic of March 19, 2026, showed that MiCA’s token authorities is utilized heavy by offshore entities arsenic a market-access tool, not arsenic a crushed to relocate.

The CASP registry shows a antithetic pattern: operators seeking to service EU retail clients are gathering section presence, choosing jurisdictions based connected regulator familiarity with their concern model, and passporting from determination crossed the afloat market.

Not each MiCA jurisdictions are equivalent for each concern model. TradFi businesses and crypto-native exchanges person sorted themselves by regulator familiarity, not by regularisation text.

For the 14 authorized trading level operators successful the EU, and for the founders who privation to articulation that number, the registry is present the astir reliable representation available: it was drawn by the companies that got determination first.

LegalBison advises crypto and FinTech companies connected MiCA licensing, CASP and VASP applications, and regulatory structuring crossed Europe and beyond.

More accusation at legalbison.com.

This nonfiction is based connected a study conducted by LegalBison successful February 2026, with information updated arsenic of March 23rd, 2026. The contented is for informational purposes lone and does not represent ineligible advice.