The European Union’s Markets in Crypto-Assets (MiCA) regulation has already registered 174 Crypto-Asset Service Providers (CASPs) as of March 2026. Yet a striking anomaly emerges: only 14 of these entities are authorized to operate a centralized cryptocurrency exchange (CEX). This stark contrast, drawn from EU and EEA public registers, reveals profound differences in how various business models are landing across jurisdictions.
10 Service Codes: What MiCA Authorizes CASPs to Do
MiCA defines 10 categories of crypto-asset services. The distribution across all 174 authorized entities highlights a clear pattern:
- Custody & Administration: 114 CASPs (most common)
- Transfer Services: 105 CASPs
- Exchange (Crypto-to-Fiat): 90 CASPs
- Execution of Orders: 90 CASPs
- Exchange (Crypto-to-Crypto): 77 CASPs
- Reception & Transmission: 51 CASPs
- Portfolio Management: 30 CASPs
- Advice on Crypto-assets: 21 CASPs
- Placing of Crypto-assets: 18 CASPs
- Operation of a Trading Platform: 14 CASPs (rarest)
The dominance of custody and transfer services reflects that nearly all operators—especially traditional financial institutions—include them as baseline offerings. German banks, for instance, added transfer services as a natural extension of existing payment infrastructure, requiring only a notification process. Conversely, the fact that only 14 entities hold authorization to operate a trading platform—a marketplace with a matching engine or order book—signals the highest regulatory bar under MiCA.
Where Licenses Are Concentrating, and Why
Geographic clustering tells a compelling story. Germany leads with 51 CASPs (29% of all authorizations), but these are predominantly retail-banking custodians and broker-dealers like Commerzbank and DZ BANK. Their applications cover narrow service codes suited to a traditional broker model. In contrast, Malta (12 CASPs) and Cyprus (10 CASPs) host global exchange brands: OKX, Crypto.com, Gemini, eToro, and Revolut, all holding broad authorizations including trading platform operation.
The reason is regulatory familiarity. BaFin in Germany has decades of experience with banks and broker-dealers but limited exposure to crypto-native exchange models. Meanwhile, regulators in Valletta and Nicosia have processed applications from globally recognized exchanges at scale, making them more comfortable with complex order-book platforms. For a founder, choosing a jurisdiction where the regulator already understands your business model can significantly reduce application friction—even though the regulation is identical across the bloc.
Where the Big Names Registered
Major exchanges clustered based on pre-existing relationships and regulator track records:
- Ireland: Kraken chose Dublin because its team was already there, holding VASP and EMI licenses. Ireland was the first country to authorize a global exchange under MiCA.
- Luxembourg: Coinbase and Bitstamp registered here, leveraging prior CSSF approvals for other financial services.
- Austria: Bybit and KuCoin followed Bitpanda’s lead after the FMA implemented MiCA early and demonstrated practical familiarity with exchange models.
- Cyprus: eToro and Revolut expanded existing CySEC relationships into CASP authorization.
- Netherlands: Bitvavo and MoonPay secured first-wave AFM authorizations in December 2024.
The pattern is consistent: exchanges did not choose jurisdictions abstractly; they went where the regulator already knew their business model or where implementation was furthest advanced.
Passporting: One License for the Entire EU
A single MiCA authorization from any member state covers the entire European Economic Area (30 countries) through passporting—requiring only an administrative notification. Pan-European platforms like Kraken, Bitvavo, Bitstamp, and Bitpanda have passported to all 30 markets from their home base. Traditional German and Spanish institutions, however, list only their home country, using MiCA as domestic compliance rather than expansion infrastructure.
Founders building for EU retail clients need not apply in 30 jurisdictions. One well-chosen authorization, passported across the Union, is how the leading exchanges cover the entire market.
Jurisdictions with No Track Record Yet
Ten jurisdictions within MiCA’s scope have produced zero public CASP authorizations: Croatia, Estonia, Greece, Hungary, Iceland, Italy, Norway, Poland, Portugal, and Romania. Among them, Poland is especially urgent. Once the most popular European jurisdiction for pre-MiCA crypto licensing, its domestic MiCA implementation has still not passed as of March 2026. With the EU-wide deadline of July 1, 2026 looming—just four months away—hundreds of Polish VASPs cannot upgrade to CASP status, facing potential regulatory limbo.
Romania is the only country still listed as “to be announced” for its National Competent Authority (NCA). Without a designated regulator, no domestic CASP applications can be processed at all, creating a compliance vacuum.
Reading the Register as a Strategy Map
The 174 MiCA authorizations are not evenly distributed because business models are not. For exchange founders, Malta and Cyprus offer the most comparable reference pool. For pure custody and broker-dealer models, Germany, Spain, and the Netherlands have the most precedent. For advice and portfolio management products, the EU has almost no established reference cases yet—an open field for early movers.
The CASP register is not just a list of approved firms; it is a strategic map drawn by the companies that got there first. Understanding it is the key to navigating the new European crypto regulatory landscape.