MiCA Decoded is a 12-article weekly series for Bitcoin.com News, co-authored by LegalBison’s Co-Founding and Managing Directors: Aaron Glauberman, Viktor Juskin and Sabir Alijev. LegalBison advises crypto and FinTech companies on MiCA licensing, CASP and VASP applications, and regulatory structuring across Europe and beyond.
If the EU has already issued 174 MiCA licenses, why are there only 14 actual crypto exchanges on the list? To demystify this, we need to decode what the public registers are really telling us about how crypto businesses are setting up in Europe.
That contrast, drawn from the EU and EEA public registers as of March 2026, captures the central question the register raises: which business models are landing in which jurisdictions and why?
The data answers that question, and the pattern is not what most crypto license holders expected.
10 service codes: what MiCA authorizes CASPs to do
The regulation defines 10 categories of crypto-asset services. The distribution across all 174 authorized entities breaks down as in the table below (any authorization can cover one or more of them).
How does a market serving hundreds of millions of users have only 14 authorized venues to actually operate a live trading platform?
| Service | CASPs | MiCA Definition | Strategic Examples |
| Custody & Administration | 114 | Safekeeping or controlling crypto-assets or the means of access to them (e.g., private keys) on behalf of clients. | Commerzbank: First full-service German bank to receive a dedicated crypto custody license. Coinbase: Operates through major EU hubs (DE, FR, IE) with full custodial infrastructure. |
| Transfer Services | 105 | Providing services for the transfer of crypto-assets from one distributed ledger address or account to another on behalf of a client. | Kraken (Payward): Licensed in Ireland to provide transfer services for crypto across the EEA. Revolut: Secured a CySEC MiCA license to facilitate asset transfers for its 40M+ European users. |
| Exchange (Crypto-to-Fiat) | 90 | Conclusion of purchase or sale contracts for crypto-assets against “funds” (fiat currency) using proprietary capital. | MoonPay: Major on/off-ramp provider for European users to buy crypto with EUR. Bitvavo: The largest Dutch exchange, providing direct EUR-to- crypto markets. |
| Execution of Orders | 90 | Concluding agreements to buy or sell crypto-assets on behalf of clients, including subscriptions at the moment of offer. | Trade Republic: A major European neobroker that executes crypto buy/sell orders for retail investors. Revolut: Uses its CASP status to execute market orders for users directly in-app. |
| Exchange (Crypto-to- Crypto) | 77 | Concluding purchase or sale contracts for crypto-assets against other crypto-assets using proprietary capital. | Crypto.com: Licensed in Malta and Italy to provide massive cross-token trading pairs. OKX: Secured Maltese authorization to provide complex token-to-token swap services. |
| Reception & Transmission | 51 | Receiving a purchase or sale order from a person and transmitting it to a third party for execution. | N26 Bank: Operates a “Reception and Transmission” model where users place orders in the bank app, which are sent to Bitpanda for execution. eToro: Transmits user orders to major liquid crypto hubs for execution. |
| Portfolio Management | 30 | Managing client portfolios on a discretionary, client-by-client basis where portfolios include crypto-assets. | AMINA Bank: Provides institutional-grade managed crypto portfolios and discretionary mandates. Plutos Vermögensverwaltung: Licensed German wealth manager specializing in digital asset portfolios. |
| Advice on Crypto-assets | 21 | Providing personalized recommendations to a client regarding transactions in crypto-assets or the use of crypto services. | Scalable Capital Bank: Provides regulated investment guidance that can include crypto-asset allocations. eToro: Offers social trading features that involve investment guidance and asset “copying” advice. |
| Placing of Crypto-assets | 18 | Marketing crypto-assets to purchasers on behalf of, or for the account of, an offeror or a party related to the offeror. | Bitpanda: Acts as a placement agent for new token projects seeking a European audience. Kraken: Frequently used for the placement and initial distribution of new crypto-assets. |
| Operation of a Trading Platform | 14 | Managing a multilateral system that brings together multiple third-party buying and selling interests to result in a contract. | Bitstamp: One of the few platforms with a full multilateral order book authorized in Luxembourg. OKX: Operates a central matching engine and order book for professional traders in Europe. |
- Custody and transfer services lead because nearly every operator includes them, regardless of primary business model.
- Transfer services show high volume partly because German traditional financial institutions added it as a natural extension of existing payment infrastructure (credit institutions, electronic money institutions), as it comes down to a notification process, the infrastructure work being already present (ICT and DORA compliant). How that authorization applies to fully crypto-native transfer models is still being worked out in practice.
The rarest categories are the most telling.
- Only 14 entities hold authorization to operate a trading platform: a marketplace such as an order book or matching engine. Example: Binance’s trading platform, with charts and visual indicators tools.
- Only 21 hold authorization to provide investment advice: personalized recommendations regarding whether a specific crypto-asset is suitable for the client to buy, sell, or hold. Example: eToro issues newsletters with expert opinion on which crypto-asset is worth considering. The community can also share insights.
- And 30 hold portfolio management: managing client investment portfolios that include crypto-assets. Example: Wyden Capital focuses purely on creating and managing tailored portfolios for investors.
For founders building products in those three service categories, the EU currently has fairly few licensed reference points to benchmark against.
Where crypto licenses in Europe are concentrating, and why
- Germany leads the CASP register with 51 authorizations (29%).
- The Netherlands follows with 23 (13%).
- France and Malta follow with 13 (7%) and 12 (7%), respectively.
- Ireland and Cyprus follow with 11 (6%) and 10 (6%), respectively.
Those headline numbers obscure what is driving the clustering.
Germany‘s 51 CASPs are dominated by traditional financial institutions: Commerzbank, DZ BANK, Boerse Stuttgart and regional Volksbanks. The registered entities in Germany are therefore predominantly retail-banking custodians and broker-dealers, not exchange operators.
Their applications were predominantly for narrow service codes suited to a broker model serving existing fiat account holders. BaFin has processed these types of entities for decades. The regulator’s familiarity is considerable and for banks having already met all the requirements, it is only a notification process with the respective competent authority to also be eligible to provide services under MiCA.
Malta and Cyprus tell the opposite story. OKX, Crypto.com, Gemini, Blockchain.com, eToro, and Revolut hold authorizations in those two jurisdictions.
These platforms applied for broad service code sets covering trading platform operation, exchange activity, and order execution. Their regulators in Valletta and Nicosia have processed applications from globally recognized exchange brands at scale.
The practical implication is that, if a crypto exchange license application lands in Germany, it sits in a queue alongside traditional banks applying for narrower services, such as providing custody and administration of crypto-assets, the execution of orders, and the reception and transmission of orders on behalf of clients.
The same application landing in Malta sits alongside established global exchanges.
Regulator familiarity with the applicant’s business model is a real factor in how an application is reviewed, even when the regulation is identical in both places.
Where did the big names register
For founders choosing a jurisdiction, the register’s most useful signal is not the country count but the company names behind each flag. Acknowledging which jurisdictions were chosen by major CEXes, for example, gives an indication of where it makes sense for a similar project to consider being registered.
Ireland is where Kraken landed, and the choice reflects a pre-existing relationship. Kraken’s team was likely already located in Ireland and already held VASP registrations and an EMI license from the Central Bank of Ireland before MiCA came into force. This certainly made the Fit & Proper evaluation of key personnel holding similar positions on both institutions faster. Ireland was then the natural consolidation point, folding multiple national registrations under a single MiCA authorization. It was also the first major global exchange to clear the Central Bank of Ireland’s CASP authorization process, which gave the jurisdiction an early exchange reference point.
Luxembourg hosts both Coinbase and Bitstamp. For both, Luxembourg was the jurisdiction where the regulator had already processed their prior applications. The CSSF‘s track record with institutional financial services explains the clustering. Coinbase explicitly described Luxembourg as its European crypto hub, citing the country’s approach to blockchain legislation, including successive blockchain laws that adapted Luxembourg’s financial framework for DLT. Bitstamp arrived at the CSSF having already obtained a MiFID license there for operating a Multilateral Trading Facility.
Austria is where Bybit, KuCoin, and the homegrown Bitpanda are based, and the FMA‘s early-mover positioning explains it. Austria completed its domestic MiCA implementing legislation ahead of most EU member states. Bitpanda, which holds roughly 60% of the Austrian retail crypto market, was already FMA-licensed and had shaped the regulator’s familiarity with exchange-type business models. When Bybit and KuCoin were evaluating where to plant their EU entity, they cited the FMA’s timely implementation and practical approach to the authorization process. The Austria cluster is then a consequence of Bitpanda having done the groundwork first.
Cyprus hosts eToro and Revolut, two platforms whose roots in the retail investment and FinTech space predate their crypto offerings. Both had existing CySEC relationships before MiCA. Their CASP authorizations extended a regulatory relationship already in place rather than establishing a new one.
The Netherlands is where Bitvavo and MoonPay registered, and the AFM’s early enforcement posture drove the choice. The Netherlands was among the first EU jurisdictions to grant MiCA authorizations, with its first-wave approvals landing in December 2024. Platforms that wanted to be among the earliest licensed in the EU, and that had existing Dutch VASP registrations, found the AFM pipeline already moving.
The pattern across all five jurisdictions is the same: exchanges did not choose regulators abstractly. They went where the regulator already knew their business model, or where implementation was furthest ahead. That is a practical lesson for any founder now evaluating where to apply.
Passporting: staying home or targeting a whole continent
A single MiCA license from any EU member state covers the entire bloc. Passporting requires only an administrative notification to extend services to additional member states, with no separate application or second regulator review.
When applying, the applicant is required to state where it intends to conduct business.
Pan-European platforms have used this fully: Kraken, Bitvavo, Bitstamp, Bitpanda, and Trade Republic have each passported to 29-30 countries (EU + EEA) from a single home authorization.
Traditional German and Spanish institutions list only their home country, confirming that for those entities, MiCA functions as domestic compliance rather than expansion infrastructure.
The mechanics matter here. Under passporting, the home regulator remains responsible for the platform’s ongoing supervision across all passported markets. The jurisdiction choice is therefore a market-access decision and a regulatory governance decision at the same time.
Founders building for EU retail clients do not need 30 separate applications. One well-chosen authorization, passported across the Union, is how Kraken, Bitstamp, and Bitpanda have covered the entire market.
The jurisdictions with no track record yet
Ten jurisdictions within MiCA’s scope have produced zero public authorization records in the CASP register: Croatia, Estonia, Greece, Hungary, Iceland, Italy, Norway, Poland, Portugal, and Romania.
Poland stands apart from the other inactive jurisdictions, and its situation is more operationally urgent. Along with Lithuania, it was the most popular European jurisdiction for crypto licensing before MiCA. As of March 2026, the local implementation of MiCA has still yet to pass.
This is becoming a source of concern for the numerous VASPs ( crypto companies under the former regime) who are faced with the EU-wide deadline of July 1, 2026, without having the possibility to upgrade their license to a Polish CASP, since the new regime is not live yet.
Romania is the only country still listed as “to be announced” for its NCA (National Competent Authority) designation.
A missing NCA designation points to one thing: the domestic regulatory infrastructure for MiCA oversight is not yet in place. Romania has yet to choose (or form) a national body responsible for enforcement and supervision of crypto-asset service providers.
The July 1, 2026 deadline applies equally to every jurisdiction of the Union, prepared or not. Founders who built their European crypto licensing strategy around a jurisdiction that has not yet activated its regulatory infrastructure are now facing that mismatch, with less than four months to resolve it.
Reading the MiCA register as a crypto license strategy signal
The 174 authorizations across the EU are not evenly distributed because business models are not as well.
The register reflects something that a reading of the MiCA text alone cannot show:
- Where specific types of applications land,
- How regulators who process them compare,
- Which jurisdictions have functional pipelines versus untested ones.
For exchange founders, Malta and Cyprus provide the most comparable reference pool.
For pure custody and broker-dealer models, Germany, Spain and the Netherlands offer the most precedent.
For advice and portfolio management products, the takeaway from the data is that the EU has almost no established reference cases in those categories yet.
Building those products is possible under the new framework, but there is no roadmap from approved comparable entities. The white paper register study we published as of March 19, 2026, showed that MiCA’s token regime is used heavily by offshore entities as a market-access tool, not as a reason to relocate.
The CASP register shows a different pattern: operators seeking to serve EU retail clients are building local presence, choosing jurisdictions based on regulator familiarity with their business model, and passporting from there across the full market.
Not all MiCA jurisdictions are equivalent for every business model. TradFi businesses and crypto-native exchanges have sorted themselves by regulator familiarity, not by regulation text.
For the 14 authorized trading platform operators in the EU, and for the founders who want to join that number, the register is now the most reliable map available: it was drawn by the companies that got there first.
LegalBison advises crypto and FinTech companies on MiCA licensing, CASP and VASP applications, and regulatory structuring across Europe and beyond.
More information at legalbison.com.
This article is based on a study conducted by LegalBison in February 2026, with data updated as of March 23rd, 2026. The content is for informational purposes only and does not constitute legal advice.