As of March 2026, public registers across the EU and EEA show that 174 crypto-asset service providers (CASPs) have obtained MiCA authorization, yet only 14 of them are permitted to operate a centralized exchange (CEX). This stark contrast highlights the market stratification under MiCA: most licensed firms focus on narrow services like custody, transfer, or exchange, while building a matching engine and order book remains a rare privilege.
10 Service Codes: Custody and Transfer Dominate, Only 14 for Exchange Operation
MiCA defines 10 categories of crypto-asset services. The distribution across all 174 authorized entities is as follows: custody and administration (114) leads, followed by transfer services (105), exchange (crypto-to-fiat, 90), execution of orders (90), and exchange (crypto-to-crypto, 77). Niche categories include reception and transmission (51), portfolio management (30), advice on crypto-assets (21), placing of crypto-assets (18), and the rarest — operation of a trading platform (14).
The high numbers for custody and transfer stem from nearly every operator bundling these as basic infrastructure. German traditional financial institutions, for instance, added transfer services as a natural extension of their existing payment rails. In contrast, operating a trading platform requires building a multilateral system that brings together third-party buy and sell orders, a far more complex undertaking. Only platforms like Bitstamp and OKX hold this authorization today.
Geographic Concentration: Germany Leads with Banks, Malta Becomes Exchange Hub
License distribution shows clear territorial patterns. Germany (51, 29%) tops the list, but its CASPs are overwhelmingly traditional retail banks (Commerzbank, DZ BANK, Boerse Stuttgart) and broker-dealers, applying for narrow service codes (custody, execution, reception and transmission). BaFin's familiarity with banking models streamlines these applications.
By contrast, Malta (12, 7%) and Cyprus (10, 6%) have become havens for global exchanges: OKX, Crypto.com, Gemini, Blockchain.com, eToro, and Revolut all hold authorizations there. These platforms applied for broad service code sets covering exchange operation, order execution, and trading. Regulators in Valletta and Nicosia have processed applications from established global exchange brands at scale, making these jurisdictions naturally attractive for similar projects.
Other notable nodes include Netherlands (23), France (13), Ireland (11, home to Kraken), and Luxembourg (where Coinbase and Bitstamp are based). The CSSF's early embrace of blockchain legislation and MiFID experience drew the two major exchanges.
Why Major Exchanges Chose Their Jurisdictions
Exchange giants did not pick registration locations randomly. Kraken chose Ireland because its team already held VASP and EMI licenses from the Central Bank of Ireland, making the MiCA transition smoother. Coinbase and Bitstamp settled in Luxembourg, where the CSSF had processed their prior applications and where successive blockchain laws adapted the financial framework for DLT. Austria attracted Bybit, KuCoin, and homegrown Bitpanda thanks to the FMA's early positioning as a crypto-friendly regulator.
For founders planning to apply for a MiCA license, the current register offers a clear signal: if the goal is to operate an exchange, prioritize Malta, Cyprus, Ireland, or Luxembourg — regulators there have handled similar cases and offer greater efficiency and predictability. Germany, despite its high license count, is better suited for narrow-service traditional finance entities, and an exchange application there may face a longer queue alongside retail banking custodians.