ESMA (European Securities and Markets Authority)

ESMA (European Securities and Markets Authority) is the EU’s securities and markets regulator. It has been operating since 1 January 2011, is based in Paris and is tasked with protecting investors, keeping financial markets orderly and safeguarding financial stability.^[1],[2]

The MiCA register

Under the MiCAGlossaryMiCA (Markets in Crypto-Assets Regulation)The EU regulation on markets in crypto-assets. Since 30 December 2024, exchanges, brokers and custodians in the EU have needed authorisation; the last transitional period ended on 1 July 2026. MiCA regulates providers, not Bitcoin itself.On the learning path: Stage 4 · Step 2 – Choosing a provider →In the glossary →× regulation, crypto-asset service providers (CASPsGlossaryCASP (crypto-asset service provider)A company that professionally provides crypto-asset services to customers – such as trading, exchange, custody or transfers. In the EU, every CASP needs an authorisation under MiCA.On the learning path: Stage 4 · Step 2 – Choosing a provider →In the glossary →×) are authorised by national authorities – in Germany by BaFinGlossaryBaFin (Germany’s Federal Financial Supervisory Authority)Germany’s financial regulator, based in Bonn and Frankfurt am Main. In Germany, it is responsible for authorising and supervising crypto service providers under MiCA, and it warns about unauthorised offers.On the learning path: Stage 6 · Step 2 – Spotting scams →In the glossary →× – not by ESMA. But ESMA keeps the central register, including a list of authorised providers and one of firms operating without authorisation. It consists of CSV tables that are updated weekly, so new authorisations don’t show up immediately (as of September 2026).^[3]

The MiCA transitional period ended across the EU on 1 July 2026 at the latest: providers without authorisation may no longer take on new EU clients and must wind down their EU business. If you still hold bitcoin with one of them, you aren’t covered by MiCA’s safeguards; ESMA advises moving it to an authorised provider or to a self-hosted wallet.^[5]

How to use the register

Search for the company name given in the provider’s legal notice or terms, not the brand – large providers often operate through several companies. The entry shows the competent authority, the permitted services and the countries in which the company may operate.^[4] If the company is missing, appears among the firms without authorisation, or your country isn’t among those listed, steer clear. Step-by-step instructions are in MiCA & regulation simply explained.