Romania and Poland had not authorised a single crypto-asset service provider (CASP) of their own as of 4 November 2026, and Hungary had authorised one. Yet our recent report on MiCA found that more than 160 firms licensed elsewhere in the EU could serve customers in each country (passporting data as of 21 September 2026).
So a crypto counterparty serving your customer’s country may be supervised by a regulator somewhere else.
Under the Markets in Crypto-Assets Regulation (MiCA), a crypto firm authorised in one EU member state can provide specified services in others after the required cross-border notification, a right known as passporting.
Before you send customer funds or data to another provider, your counterparty due diligence should establish four things: which legal entity you’re dealing with, which regulator licensed it, which services its licence covers, and whether it can passport those services into your customer’s country.
This article sets out four steps to establish each of them.
Romania, Poland and Hungary rely on firms licensed elsewhere
181 CASPs authorised in other member states held passporting rights to provide services in Romania, 173 in Poland and 167 in Hungary. For each firm, start with its home regulator’s register: the regulator in the EU country that granted its MiCA licence.
Belgium has authorised two firms of its own, against 189 that can passport in, so most firms with permission to serve Belgian customers are supervised from another country.
Passporting rights show where a firm is allowed to operate. A firm can hold passporting rights in countries where it has no customers, so these numbers show how many firms could serve a market. Your own due diligence should establish whether a particular firm does.
How do you find the regulator behind a MiCA-licensed crypto firm?
Say your customer withdraws crypto to an exchange that markets to Romanian, Polish or Hungarian users. Before you send the Travel Rule data, your blockchain analytics tool may only link the destination address to the exchange’s brand.
To find out which legal entity you’re dealing with, which regulator licensed it and what it’s allowed to do under MiCA, follow these four steps:
1. Identify the specific legal entity that will receive the transfer
Exchange groups often run several entities, and the one serving EU customers can sit in a different member state from the brand’s head office. Regulators find this hard too: when the Dutch AFM warned against MEXC, it said it was unclear from which country and which legal entity the exchange offered its services.
2. Look up the entity in its home regulator’s MiCA register
The home regulator is the one in the EU country that licensed the entity. Its own register is the primary source, and it usually shows a new or withdrawn licence before EU-wide lists such as ESMA’s interim MiCA register do.
Hungary’s first CASP shows why: the country’s central bank (MNB) authorised it in July 2026, but it had not appeared on ESMA’s interim register by early November.
Note which route the entity used. Most CASPs apply to their home regulator for authorisation (Article 63). Banks, investment firms and other regulated financial institutions can instead notify their regulator and provide crypto services under their existing licence (Article 60), so they can only offer the crypto services that licence allows.
3. Confirm its MiCA licence covers the service you’re using
A MiCA licence lists specific services, such as transfer services or custody and administration of crypto-assets, and these can be fewer than the brand offers.
4. Confirm it can passport that service into your customer’s country
A firm’s home-country licence does not automatically establish that it can provide every service across the EU. Confirm that its passporting rights include the relevant service in, for example, Romania. If your risk assessment also depends on whether it actually serves customers there, keep supporting evidence such as local-language terms or local payment options.
Repeat these steps for each entity you send to, and again when licences, passporting rights or group structures change.
Why a crypto firm’s MiCA licence can change after onboarding
Working only with regulated VASPs is easier to defend when your records name the regulator that authorised each counterparty and the services its licence covers.
“The first rule of the Travel Rule is to know who you’re doing business with.”
Neil Samtani, Founder and CEO, VASPnet
A firm’s regulatory status can change after onboarding. If its home regulator withdraws the licence supporting its passport, it can no longer provide those services through that passport. Group structures change too: Coinbase previously held 13 national registrations across the EU and now serves EU customers through one entity authorised in Luxembourg. Either change can leave older counterparty records out of date, naming a licence that no longer exists or an entity that no longer serves EU customers.
How VASPnet tracks MiCA licences and passporting
VASPnet tracks MiCA licences and passporting rights across the EEA alongside regulatory data and warnings in other jurisdictions. Each counterparty profile brings together the entity’s regulatory status, home regulator and the markets it may serve.
Users can also subscribe to a VASP group and receive notifications when its membership changes, so they know when to review their counterparty records.