On July 1, 2026, the last grandfathering window under the EU’s Markets in Crypto-Assets Regulation slammed shut. Any exchange serving customers in the European Economic Area without a CASP (crypto-asset service provider) authorization is now operating illegally, full stop. As Paybis — itself granted Latvian CASP authorization in May 2026 — has noted, that leaves precisely zero legacy-only exchanges able to legally serve EU clients, no matter how long they operated before the cutoff. There is no extension mechanism written into the regulation, and ESMA spent June publicly telling unauthorized firms to activate their wind-down plans.
The practical question for anyone holding crypto in Europe is simple: which platforms can I actually use now, and how do I check that a platform’s licensing claim is real? This piece answers both, including a step-by-step walkthrough of ESMA’s public register. For the regulatory background, our MiCA explainer covers how the framework is built; here we stay strictly practical.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Changed on July 1, 2026
MiCA’s licensing rules for service providers technically applied from December 30, 2024, but Article 143(3) let firms that were already legally operating keep serving customers while their application was processed. Member states could shorten that window, and several did: Germany and Ireland closed theirs on December 31, 2025, while the Netherlands, Poland, Latvia, Hungary, and Slovenia allowed only six months. July 1, 2026 was the longest runway any member state could grant, and it has now expired everywhere.
The result is a cliff edge. A firm either holds a CASP authorization from a national regulator, or it cannot lawfully offer crypto trading, custody, brokerage, or exchange services to EEA residents. In a June 2026 public statement, ESMA told firms without authorization to arrange an orderly exit that returns or transfers client assets.
How big is the licensed universe? The count shifts depending on which tracker you check and when: The Block put ESMA’s register at 244 CASPs back in June 2026, and by July Tech Insider’s own tally found 297 records spanning 293 authorized firms, a jump that tracks the register’s weekly growth. Cryptolady.pro put the figure at 280 full CASP authorizations on ESMA’s register as of July 9, 2026, while TheCryptoRegister counted 294 authorised CASP entities by July 18, and the tracker site casptracker.eu also landed on 294 licensed companies around the same period. The register grows weekly as national regulators grant new approvals. Zoom in on exchanges specifically and the picture narrows considerably: EU MiCA Directory tracked 105 major exchanges under the regime as of August 2, 2026, but a cluster of independent trackers converge on a much smaller number of fully operational venues, since most register entries are brokers, custodians, and fintech apps rather than trading venues. SpazioCrypto counted 14 MiCA-licensed trading platforms in a June 2026 review of ESMA’s data, MEXC put the figure at “around 14” centralized exchanges holding full CASP licenses as of late June 2026, and Tech-Insider’s own count landed on roughly 14 major consumer exchanges as of July 2026, including eToro and Bitvavo. ExchangeAtlas narrowed the field further still, crediting only 7 major exchanges, among them Coinbase, Kraken, and OKX, with full MiCA trading licenses as of July 2026. Among the world’s 100 largest exchanges by volume, CASP-Tracker found 17 held a MiCA license as of July 31, 2026.
The Licensed Exchanges: Full Table (July 2026)
The table below covers the major retail-facing exchanges that hold full CASP authorization for trading services as of late July 2026. The licensing state is the “home” member state whose regulator issued the authorization; passporting (explained below) extends that license across the whole EEA.
| Exchange | Licensing state | Notes |
|---|---|---|
| Coinbase | Luxembourg | Licensed by the CSSF on June 20, 2025. Moved its EU hub from Ireland to Luxembourg as part of the authorization. |
| Kraken | Ireland | Payward Europe Solutions Ltd, authorized by the Central Bank of Ireland on June 25, 2025. Also holds a MiFID license for derivatives. |
| eToro | Cyprus | CySEC authorization from January 2025. Crypto sits alongside its stock and CFD offering. |
| Bitvavo | Netherlands | AFM-licensed. The dominant euro spot venue in the Dutch market. |
| Bybit EU | Austria | Bybit EU GmbH, authorized by the FMA on May 28, 2025, with its EU headquarters in Vienna. Datawallet’s MiCA comparison, dated July 31, 2026, rates the platform 4.7/5 for trust and lists over 600 tradable cryptocurrencies. |
| OKX | Malta | OKX Europe Ltd, authorized by the MFSA on January 27, 2025. One of the first movers among global majors. |
| Bitstamp | Luxembourg | Bitstamp Europe S.A., CSSF-licensed. Now part of the Robinhood group. |
| Crypto.com | Malta | Foris DAX MT Ltd, MFSA authorization from January 2025. |
| Bitpanda | Germany | BaFin license, plus additional authorizations via Austria’s FMA and Malta’s MFSA. The only major with three. |
| Revolut Digital Assets | Cyprus | CySEC-licensed entity handling crypto for Revolut’s EEA app users. |
| Gate.io EU | Malta | Gate Technology, MFSA-authorized. Runs a separate EU platform from its global exchange. |
| One Trading | Netherlands | Vienna-based, AFM-licensed. Institutional and pro-trader focus, spun out of Bitpanda. |
| Bullish | Germany | Bullish Europe GmbH, authorized by BaFin on September 4, 2025. |
| WhiteBIT EU | Austria | WB-Shields Innovations GmbH, FMA-authorized. |
| Bit2Me | Spain | Bitcoinforme S.L., authorized October 31, 2025. Spain’s largest home-grown exchange. |
| Backpack Exchange | Latvia | Trek Technologies SIA, authorized May 27, 2026. One of the newest entries in the register. |
Names change at the entity level, and that matters when you verify. You will not find “Coinbase” in the register; you will find Coinbase Luxembourg S.A. Kraken appears as Payward Europe Solutions. Crypto.com is Foris DAX MT. WhiteBIT’s EU arm shows up as WB-Shields Innovations GmbH, its Austria-licensed entity, with CASP-Tracker listing the record’s status as last updated August 3, 2026. The register keeps adding entries, too: the EU MiCA Directory logged bitFlyer EUROPE S.A. as CSSF-authorized on June 26, 2026, covering four distinct crypto-asset services, a reminder that the list below is a snapshot, not a finish line. Keep this in mind for the verification walkthrough below.
Notable Absentees
The list of who is missing tells you as much as the list of who made it.
Binance: withdrew, then exited
The world’s largest exchange filed its CASP application with Greece’s Hellenic Capital Market Commission on January 23, 2026. Five months later, on June 24, Binance withdrew the application rather than face a formal refusal, with reporting from CoinDesk and Euronews pointing to MiCA’s “fit and proper” test for owners and managers, a hurdle complicated by the company’s 2023 US settlement and founder Changpeng Zhao’s conviction. Binance suspended new orders, deposits, and sign-ups for EU residents on July 1, 2026, keeping accounts in withdrawal-only mode. The company says it plans to reapply through another member state. Our full breakdown of the Binance EU exit covers what account holders should do now.
Tether: never applied
Tether took a different path: it simply never sought the e-money-token authorization MiCA requires of stablecoin issuers, citing objections to the regulation’s reserve rules. USDT has consequently been removed from licensed venues for EEA users, a process that started early. Coinbase delisted USDT for European customers back in December 2024, and Crypto.com followed in January 2025. The compliant alternatives are Circle’s USDC and euro-denominated EURC, which qualify as e-money tokens under Circle’s French electronic money institution license. The full story is in our USDT delisting piece.
Everyone else
MEXC, Bitget, and Upbit remain outside the register as of late July 2026, per casptracker.eu, along with dozens of smaller offshore venues. Some are reportedly preparing applications. Until an entry appears in ESMA’s register, treat any “coming soon to Europe” messaging as marketing, not authorization.
How Passporting Works
A CASP license is national in origin but European in effect. Once Malta’s MFSA authorizes OKX Europe, the firm can notify regulators in the other 26 EEA states and offer identical services there without new licenses. That single-license, whole-bloc model is called passporting, and it explains the licensing geography you see in the table above.
Small states with fast, well-staffed regulators attracted an outsized share of applications. According to ESMA register data cited by CCN in June 2026, Germany accounts for roughly 25 percent of all CASP authorizations and the Netherlands about 12 percent, but Malta, Austria, Cyprus, and Luxembourg punch far above their weight among the retail exchange heavyweights, a pattern that holds even as the overall register swelled from the 244 CASPs The Block counted in June 2026 to the 293 authorized firms (297 records) Tech Insider tallied in July, and as EU MiCA Directory’s exchange-specific count grew to 105 major venues under the regime by August 2, 2026. Critics, including officials quoted in French financial press, have warned about “regulatory shopping.” For you as a user, the practical takeaway is neutral: a Maltese license and a German license carry identical legal force everywhere in the EEA.
One consequence worth knowing: your contractual counterparty is the licensed EU entity, not the global parent. Disputes go through the home-state regulator’s complaint channels, so a Coinbase user in Portugal escalates, ultimately, to Luxembourg’s CSSF, and a Kraken user anywhere in the bloc looks to the Central Bank of Ireland.
How to Verify Any Platform in ESMA’s Register: Step by Step
This is the part that actually protects you. Licensing claims on exchange landing pages are unverified marketing until you check them against the source. ESMA, the EU’s markets authority, maintains the union-wide public register of every authorized CASP, and anyone can search it free. Here is the exact process.
- Go to the official source. Open ESMA’s MiCA page at esma.europa.eu and follow the link to the CASP register, or go straight to ESMA’s registers portal at registers.esma.europa.eu and select the MiCA CASP register. Type the address yourself. Do not click a “verify our license” link on an exchange’s own site, which can point anywhere.
- Search by legal entity name, not brand name. Searching “Kraken” may return nothing; searching “Payward” will. If you do not know the legal entity, scroll to the footer of the exchange’s website or open its terms of service, where the contracting entity must be named. Mismatch between the entity in the terms and the entity in the register is itself a red flag.
- Check the home member state and regulator. The register entry lists the authorizing national authority. Cross-check it against what the exchange claims. A platform claiming a “Luxembourg license” whose register entry shows a different state, or no entry at all, is misrepresenting itself.
- Read the authorized services list. Each entry specifies which of MiCA’s ten crypto-asset services the firm may provide: operating a trading platform, custody, exchange of crypto for funds, order execution, brokerage (reception and transmission of orders), advice, portfolio management, transfer services, and placing. A firm licensed only for custody cannot lawfully run a trading venue. More on why this matters in the next section.
- Confirm the entry is current. The register shows authorization dates and flags withdrawals. Regulators can and do pull licenses. If the status looks odd, check the national regulator’s own register (BaFin, CSSF, MFSA, CySEC, AFM, and the Central Bank of Ireland all publish theirs) for the latest word.
- Optionally, use a tracker as a shortcut, then verify. Sites like casptracker.eu present the ESMA data in a friendlier format with brand names attached to legal entities. They are useful for orientation, but treat the ESMA register itself as the final authority before you move money.
The whole check takes under five minutes. Make it a habit before any first deposit, and repeat it if a platform you already use gets acquired or rebrands.
What “Authorized” Covers, and What It Doesn’t
A MiCA license is not one thing. Authorization is granted per service, and the differences matter to your money.
Trading vs custody vs brokerage
An exchange in the table above typically holds authorization for operating a trading platform, custody, and exchange of crypto-assets for funds, meaning it can match your orders, hold your coins, and handle your euros. A broker, by contrast, may only be licensed to receive and transmit orders, routing them to a venue elsewhere; plenty of the 297 register records — spanning 293 authorized firms, per Tech Insider’s July 2026 count — are exactly that. Custodians hold assets but run no market. When you evaluate a fintech app that “offers crypto,” check which category its register entry actually falls into, because your protections track the licensed activity.
What the license actually gets you
Authorized CASPs must segregate client assets from house funds, maintain minimum capital, publish honest marketing, run complaint procedures with escalation to the home regulator, and meet custody-liability rules that make the firm answerable for lost or misappropriated client crypto. Those are real, enforceable obligations that did not exist for most European crypto users before 2025.
What it does not get you
No deposit insurance. Crypto held at a licensed CASP is not covered by the deposit guarantee schemes that protect bank balances up to 100,000 euros, and it is generally outside investor-compensation schemes too. Market risk stays entirely yours: a license says nothing about whether a token is a good buy. Staking yields, token listings, and price volatility are not underwritten by anyone. MiCA also leaves genuinely decentralized protocols and self-custody wallets out of scope, so nothing about the July deadline stops you holding your own keys.
If You Keep Using an Unlicensed Offshore Platform
MiCA regulates firms, not individuals. No EU law criminalizes a private person logging into an offshore exchange, and plenty of Europeans will keep doing so through VPNs after July 2026. Honesty about that reality is more useful than pretending otherwise, so here is what you are actually accepting when you do it.
| Factor | Licensed CASP (EEA) | Unlicensed offshore platform |
|---|---|---|
| Legal standing | Authorized to serve you; enforceable EU contract | Serving you in breach of EU law; may cut you off any time |
| Asset segregation | Required by MiCA, supervised | Unknown; whatever the platform claims |
| Complaint recourse | Formal process, escalation to a national regulator | Support ticket, then nothing |
| Stablecoins | USDC, EURC, other authorized e-money tokens | USDT and anything else, no issuer oversight |
| Sudden exit risk | Wind-down rules require orderly return of assets | Withdrawal-only mode or geoblock with little notice |
| KYC and account terms | Standardized, GDPR applies | Variable; VPN use usually violates the platform’s own terms |
The VPN route carries a specific trap: virtually every offshore exchange’s terms of service prohibit access from restricted jurisdictions. Trip a geolocation or document check later, at withdrawal time, say, and the platform can freeze the account for the very terms breach the VPN enabled, leaving you with no regulator to appeal to. Binance’s July 1 shift to withdrawal-only mode for EU users shows the abrupt-exit pattern even at the well-run end of the offshore spectrum.
A parallel world of deliberately unregulated platforms exists too, particularly in gambling, where no-KYC crypto casinos take deposits with no identity checks at all. Whatever you think of them, understand that they sit entirely outside MiCA’s protections; if you want the mechanics, our guide to how crypto casinos work explains the custody and provably-fair models involved. The same logic applies as with offshore exchanges: convenience traded against zero recourse.
Red Flags Before You Deposit
- License claims without a register entry. “Fully regulated,” “EU compliant,” or a wall of regulator logos, but no findable entry in ESMA’s register under any entity named in the terms of service.
- Entity mismatch. The website’s terms name a Seychelles or BVI company while the marketing implies an EU license held by a different entity in the group.
- USDT still offered to EEA customers. After July 1, 2026, a platform actively offering USDT pairs to European users is either unlicensed or ignoring its obligations. Either way, bad sign.
- Encouraging VPN use. Any platform that winks at geoblock circumvention is telling you how it treats rules generally.
- Registration-only status presented as a license. Some firms cite old national registrations (like France’s basic PSAN registration or a Polish VASP entry) that were superseded by MiCA. Registration under a pre-MiCA regime is not CASP authorization.
- Pressure tactics around the deadline. “Migrate your funds to our new EU platform” emails deserve the same five-minute register check as anything else; scammers have been impersonating licensed brands since spring 2026.
One more strategic note: Europe’s cliff-edge model now diverges sharply from the American approach, where the GENIUS Act took a stablecoin-first path. If you operate across both markets, our GENIUS Act vs MiCA comparison maps the differences.
FAQ
Is it illegal for me to use Binance or another unlicensed exchange from the EU?
No. MiCA imposes obligations on service providers, not retail users. The firm breaks EU law by serving you; you break, at most, the platform’s own terms of service if you use a VPN. The real cost is practical: no segregation guarantees, no regulator to complain to, and the risk of sudden freezes or geoblocks.
Can I still hold USDT in Europe?
Yes. Holding USDT in a self-custody wallet remains legal, and nothing forces you to sell. What changed is distribution: licensed venues cannot offer or list it for EEA customers, so converting USDT now means an offshore venue, a DEX, or swapping into USDC or EURC first.
Does a MiCA license mean my funds are insured?
No. Client assets must be segregated and the firm is liable for custody failures, but there is no deposit guarantee scheme behind crypto balances. A licensed exchange going bankrupt is still a mess; the license improves your odds of recovery, not a guarantee of it.
What happens to coins left on Binance after July 1, 2026?
Accounts of EU residents moved to withdrawal-only mode, per Binance’s June 2026 notices. Funds remain accessible for withdrawal to another platform or a private wallet, but new trades, deposits, and product access are suspended. Moving assets to a licensed venue or self-custody sooner rather than later avoids depending on that arrangement holding.
Why are so many big exchanges licensed in Malta, Austria, or Luxembourg?
Passporting makes the home state a one-time choice, so firms picked regulators known for crypto expertise and predictable timelines. MFSA (Malta) authorized OKX and Crypto.com in January 2025, months before larger states processed their first majors. The license’s legal force is identical regardless of which member state issued it.
Does MiCA cover DeFi protocols or my hardware wallet?
Fully decentralized protocols without an intermediary fall outside MiCA’s scope, and self-custody is untouched. The moment a company intermediates the service (a front-end operator taking fees, for instance) the analysis changes, and ESMA has signaled that “decentralization theater” will be looked through. For everyday users, holding your own keys remains fully legal across the EEA.
