Choosing the right provider: 7 criteria that matter

Your provider holds your money, your ID details and – at least for a while – your bitcoin. There is usually no deposit protection for bitcoin held there: the statutory protection of up to €100,000 applies to bank deposits.^[1] So choose a provider by criteria, not by advertising or bonuses. Don’t worry: you can check the following seven yourself, no prior knowledge needed. At the end, you tick them off in a checklist.

Criterion 1: MiCA authorisation – and how to check it

Anyone who sells, holds or transfers bitcoin for others in the EU needs authorisation as a crypto-asset service providerGlossaryCASP (crypto-asset service provider)A company that professionally provides crypto-asset services to customers – such as trading, exchange, custody or transfers. In the EU, every CASP needs an authorisation under MiCA.On the learning path: Stage 4 · Step 1 – Ways to get Bitcoin →In the glossary →× under MiCAGlossaryMiCA (Markets in Crypto-Assets Regulation)The EU regulation on markets in crypto-assets. Since 30 December 2024, exchanges, brokers and custodians in the EU have needed authorisation; the last transitional period ended on 1 July 2026. MiCA regulates providers, not Bitcoin itself.In the glossary →×, the EU regulation on crypto assets. The transition period ended on 1 July 2026: providers without authorisation may not take on new clients or advertise, and must wind down their EU business in an orderly way.^[2] That includes big names: Binance no longer accepts new clients in the EU^[3] and was not in the register on 24 September 2026.^[4]

An authorisation from one EU country is valid throughout the EU once the provider has notified the authorities in advance. All authorisations are listed in the register of ESMAGlossaryESMA (European Securities and Markets Authority)The EU authority for securities and financial markets, based in Paris. What matters to you is its MiCA register: it lists all crypto-asset service providers authorised in the EU.In the glossary →×, the EU securities regulator; those granted by BaFin, Germany’s financial regulator, also appear in its company database.^[5]

1. Find the company name

   The legal notice (imprint) or the terms and conditions name the company behind the brand. Sometimes there are several – BISONProvider · ExchangeBISONCrypto app from the Boerse Stuttgart Group: no trading fee, but a spread – withdrawals to your own wallet: €0 fee (as of 09/2026).Licence: MiCA (BaFin, Germany) · reviewed Sept 2026Costs: no trading fee, average Bitcoin spread 1.25% per buy or sell (as of Sept 2026)Our profile →Official website ↗×, for example, uses one for trading and one for custody.^[4]

2. Search the ESMA register

   On ESMA’s MiCA register page, download the list of authorised crypto-asset service providers (CASPS.csv) and search for the company name. The list is updated weekly.^[6]

3. Read the entry

   Check the competent authority, the authorised services and whether your country is among those the provider has notified. The services reveal the business model: for RelaiProvider · Bitcoin appRelaiBitcoin-only app where your bitcoin land directly in your own wallet – with a savings plan and a MiCA licence.Licence: MiCA (AMF, France) · reviewed Sept 2026Costs: 1% service fee plus an unquantified margin in the price … (as of Sept 2026)Our profile →Official website ↗×, only exchanging crypto for money is registered, not custody^[4] – the bitcoin go straight into a wallet whose keys you manage yourself.^[7]

4. Cross-check

   ESMA also keeps a list of non-compliant providers.^[6] If the provider is on it, or you can’t find its company at all, that’s a stop sign.

Criterion 2: Real bitcoin, not a price product

Some offers don’t sell you bitcoin but a product that only tracks the price: an exchange-traded product (ETPGlossaryETP (Exchange Traded Product)Umbrella term for exchange-traded securities such as ETFs, ETCs and ETNs. With a Bitcoin ETP, you hold a security that tracks the price – but no bitcoin keys of your own.On the learning path: Stage 4 · Step 1 – Ways to get Bitcoin →In the glossary →×), a certificate or a contract for difference (CFD). The test: can I send my bitcoin to an address I control myself? If not, you’re buying price exposure. When that can still make sense is explained in Bitcoin ETPs in your securities account.

Criterion 3: Withdrawal to your own wallet

Withdrawal is the basis of self-custodyGlossarySelf-custodyYou hold the private keys to your bitcoin yourself – in your own wallet rather than with a provider. Nobody can freeze your bitcoin. But nobody can help you if you lose your seed phrase and keys.On the learning path: Stage 5 · Step 1 – Understanding custody →In the glossary →× – and your emergency exit if you want to switch provider. Check three things:

• Is it possible at all? With Bitcoin appsTermBitcoin appA smartphone app you can use to buy, save and often also store bitcoin.In the glossary →AdLicensed providers with a paid linkProviders from our comparison21bitcoinBitcoin app · MiCA (FMA, Austria)No paid link for your country · Profile →RelaiBitcoin app · MiCA (AMF, France)No paid link for your country · Profile →BISONExchange · MiCA (BaFin, Germany)No paid link for your country · Profile →All 4 compared – including non-partners →*Paid link: if you sign up or buy through it, we earn a commission. Your price stays the same. How we make money →18+ · Crypto assets are highly volatile; you could lose all your money. No deposit protection.× and exchanges usually yes, with some brokers no.
• What does it cost? 21bitcoinProvider · Bitcoin app21bitcoinBitcoin-only app from Austria: Auto-Invest savings plan from €10, 0% purchase fee from day 8.Licence: MiCA (FMA, Austria) · reviewed Sept 2026Costs: Instant buy 1.49%, selling 1.49%, Auto-Invest savings plan from day 8: 0% (as of Sept 2026)Our profile →Official website ↗× charges a flat 1,000 sats (0.00001 BTC); BISON charges €0 for it (as of September 2026).^[9],[10]
• How does the proof work? For withdrawals of more than €1,000 to a self-hosted address, the provider must check whether the address belongs to you or is controlled by you (Travel RuleGlossaryTravel Rule (Transfer of Funds Regulation)An EU rule requiring crypto providers to send details of the sender and recipient with transfers. Since 30 December 2024, for more than €1,000 from or to your own wallet, the provider also checks that the address is yours.On the learning path: Stage 5 · Step 4 – First withdrawal →In the glossary →×).^[8] That’s normal, not a warning sign.

Your first withdrawal to your own wallet walks you through the first withdrawal, including the address check.

Criterion 4: Compare costs honestly

The advertised fee is often only part of the cost:

Cost component	What to look out for
Fee per purchase	Percentage or flat fee? Does it also apply to the savings plan?
SpreadGlossarySpread (bid-ask spread)The difference between the buy and sell price. With many apps, the spread is the real fee – it just doesn’t appear as a separate item on your statement.In the glossary →×	A mark-up in the buying price – is it shown openly?
Payment method	SEPA usually has no surcharge, cards often cost extra.
Withdrawal	Flat, dynamic or no fee at all?
Selling	Will the same costs apply again when you sell later?

Two examples (as of September 2026): BISON charges no trading fee but applies a spread of 1.25% on average for bitcoin; deposits by card, Apple Pay or Google Pay cost 2.49%.^[10] Relai charges a 1% service fee, and card payments cost an extra 3%.^[7]

The fee calculator works it out for your amount; Understanding fees explains the background.

Criterion 5: Savings-plan terms

If you want to buy small amounts regularly, the savings planGlossarySavings plan (Bitcoin savings plan)Automatically buying bitcoin at fixed intervals with a fixed amount, for example $50 a month. A savings plan takes the question of the right moment off your hands, but doesn’t promise a higher return.On the learning path: Stage 4 · Step 4 – Setting up a savings plan →In the glossary →× matters more than the instant buy. Compare minimum amount, interval and costs (as of September 2026):

• 21bitcoin: from €10 per execution; a 0% service fee from the eighth day of an active savings planTermSavings plan (Bitcoin savings plan)Automatically buying bitcoin at fixed intervals with a fixed amount, for example $50 a month.On the learning path: Stage 4 · Step 4 – Setting up a savings plan →In the glossary →AdLicensed providers with a paid linkProviders from our comparison21bitcoinBitcoin app · MiCA (FMA, Austria)No paid link for your country · Profile →RelaiBitcoin app · MiCA (AMF, France)No paid link for your country · Profile →BISONExchange · MiCA (BaFin, Germany)No paid link for your country · Profile →All 11 compared – including non-partners →*Paid link: if you sign up or buy through it, we earn a commission. Your price stays the same. How we make money →18+ · Crypto assets are highly volatile; you could lose all your money. No deposit protection.×.^[11]
• Relai: at least €50 per purchase; with a monthly savings plan, one €100 purchase per calendar month carries no service fee.^[7]

Setup is covered in Setting up a Bitcoin savings plan.

Criterion 6: Security for your account

• Two-factor authentication: Germany’s Federal Office for Information Security (BSI) advises using two-factor authenticationGlossaryTwo-factor authentication (2FA)Logging in with two independent proofs, such as a password plus a code from an authenticator app. For accounts with exchanges and Bitcoin apps, 2FA is a must – and SMS codes are the weakest option.On the learning path: Stage 4 · Step 3 – Buying Bitcoin →In the glossary →× wherever a service offers it. The safest options are a hardware security key (FIDO2) or a passkey: they resist common phishing attacks. A code sent by SMS or generated by an authenticator app, by contrast, can be captured by a fake site in real time.^[12] SMS codes are also exposed to SIM swappingGlossarySIM swappingFraudsters get your mobile number transferred to their own SIM card and so receive your text-message codes. They use this to take over accounts that are only protected by SMS. Protection: 2FA via an app or security key instead of SMS.On the learning path: Stage 6 · Step 2 – Spotting scams →In the glossary →×^[13] – use an app if you can.
• Protection for withdrawals: Good providers let you put withdrawal addresses on an approved list (whitelistGlossaryWhitelist (address book)A list of withdrawal addresses that you have stored and confirmed with your provider in advance. When it’s active, withdrawals can only go to these addresses – effective protection if someone breaks into your account.On the learning path: Stage 5 · Step 4 – First withdrawal →In the glossary →×) and require extra confirmation for new addresses.
• Segregated client assets: MiCA obliges custodians to keep their clients’ crypto assets legally separate from their own, so that the provider’s creditors can’t reach them in an insolvency.^[14] Clients of unauthorised providers don’t have this protection.^[2] Nor does it protect against hacks or a long wait to get your assets back.

Criterion 7: Transparency and being reachable

A reputable provider publishes its price list, explains risks clearly and can be reached through official channels. Be careful if a ‘provider’ contacts you out of the blue, promises high returns or steers you to a platform via messenger groups. No one reputable ever asks for your seed phraseGlossarySeed phrase (recovery phrase)A sequence of usually 12 or 24 words from which your wallet derives all its private keys. Anyone who knows the words has full access to your bitcoin – so they belong in an offline backup and never in anyone else’s hands.On the learning path: Stage 5 · Step 3 – Backing up your seed phrase →In the glossary →× – no provider, no support team, no authority.

Check the web address letter by letter, then open the site only via your own bookmark, and download apps only from the official store. The typical scams are covered in Spotting & avoiding scams.

Providers from our overview

The following providers meet our minimum criteria: authorised, real bitcoin, withdrawal to your own wallet. Check them yourself against the seven criteria all the same. No rush – the best start is one you understand.

You’ll find more apps and exchanges – including non-partners – in the provider overview. Banks and neobrokers now appear in the ESMA register too, such as Trade Republic, DekaBank (German savings banks) and DZ BANK (German cooperative banks).^[4] The same criteria apply to them, especially on withdrawals and spread. How we select providers and how we fund ourselves is explained in our methodology and on the transparency page.

Your checklist