14
October
2026
•
Reports
Three months post MiCA deadline: key findings
A summary of VASPnet's new paper on how Europe's crypto-asset service provider landscape has changed in the three months since the MiCA deadline.
Introduction
Introduction
Three months after MiCA's final transitional period ended, 372 crypto-asset service providers (CASPs) hold permission to operate under MiCA, up from 257 on 30 June. This is a summary of VASPnet's new paper on how Europe's crypto market has changed since the deadline, and what that means for institutions reviewing their counterparties.
The market grew by almost half in three months
On 30 June, VASPnet recorded 257 CASPs permitted to provide services under MiCA across 30 European Economic Area (EEA) jurisdictions. By 13 October the figure was 372, an increase of 115 or 45%.
Germany added 48 permissions and Cyprus added 12, together 60 of the 115. Germany, France, the Netherlands and Cyprus now hold 196 of the 372 permissions, or 53%. Germany alone holds 105.
Hungary, Poland and Romania still have no MiCA-authorised CASP of their own.
With the count up by 115 in 105 days, a counterparty review completed before the deadline may already be out of date.
Passporting reaches further than local licensing
Under MiCA, a firm authorised in one member state can passport its services into the others. A market with no domestic CASPs can still have a large, regulated presence.
In VASPnet's September passporting data, Romania has authorised no CASPs of its own, yet 181 firms authorised elsewhere can operate there. Belgium records 189 incoming passported firms alongside two domestic ones. Poland and Hungary show the same pattern, with 173 and 167 incoming firms and no domestic authorisations.
A firm may hold passporting rights in a market without serving customers there, so a counterparty review starts with the home regulator’s register.
Where the leading exchanges are authorised
VASPnet identified MiCA authorisations held by 23 of CoinMarketCap's top 100 exchanges, almost a quarter. Malta hosts five, including Crypto.com, Gate.io, Gemini and OKX. Austria and Cyprus host four each, and Luxembourg three.
In July, VASPnet reviewed 78 leading centralised exchanges drawn from CoinDesk’s ranking and found that 50 had no identifiable EU regulatory presence before MiCA, although their public terms did not appear to restrict EU customers. A familiar exchange brand does not tell you which legal entity serves EU customers, or under which permission.
Exchanges often serve markets where they hold no licence. Our analysis of the FATF’s offshore VASP report looks at the gap. Registered somewhere, active everywhere: what the FATF’s oVASP report means for compliance teams.
What happened to the legacy registrations
Before 31 December 2024, five jurisdictions held most of Europe's national VASP registrations. Poland held 1,519, the Czech Republic 660 (partial data), Lithuania 639, Estonia 548 and Bulgaria 293, a total of 3,659 registrations. By 13 October 2026, the five had authorised 26 CASPs between them.
Much of that drop reflects consolidation, because many of the registrations belonged to the same groups: Coinbase held 13 registrations across the EU under two legal entities and now operates under one MiCA authorisation issued in Luxembourg, while Bitpanda went from 10 registrations and licences to three MiCA licences.
When a VASP group consolidates like this, a counterparty file built on the old entity goes out of date. Rather than repeating searches to spot the change, VASPnet users can subscribe to a VASP group and receive notifications when its membership changes.
Some legacy providers moved into other businesses: VASPnet's review found legacy firms moving into securities activities, technology services and operations outside the EU, from the UAE to Switzerland.
Germany held 15 legacy registrations and now has 105 MiCA authorisations, most of them existing financial institutions entering through Article 60.
Public regulatory action since the deadline
Nine of the 30 EEA jurisdictions have published MiCA-related warnings, orders or penalties since their transitional periods ended. Together they hold 154 of the 372 authorisations, or 41%.
The notices range from Austria’s FMA penalising an authorised firm and Cyprus’s CySEC issuing a general warning to Italy’s CONSOB ordering access blocked to 14 websites and Malta’s MFSA warning about a provider that falsely claimed MiCA authorisation.
These counts cover published notices only, and since MiCA allows regulators to delay or anonymise publication and informal supervision is never made public, the figure is a minimum and says more about individual firms than about how well any regulator supervises.
Four details to refresh in a counterparty file
A licence or notification on a register is the starting point for due diligence. For each CASP relationship, record:
- The legal entity providing the service. A firm that held a national registration in 2024 may now serve European customers through a different group company in another member state.
- Its regulatory route. Article 63 authorisation for new CASPs, or Article 60 notification for existing financial institutions such as banks and investment firms.
- The services it is permitted to provide. A MiCA permission lists the services the firm may provide, which can be fewer than the brand offers.
- Home supervisor. For a passported firm, this is the competent authority in its home jurisdiction, which can differ from the regulator in your customer’s country.
If any of these has changed since your last review, we encourage you to update the assessment. A familiar brand or an earlier national registration cannot answer these questions on its own.
Read the full paper
The full paper, Three months post MiCA deadline: Changes in Europe's crypto-asset service provider landscape, has the country-by-country data, the passporting tables, the legacy registration comparison and the supervisory notices behind these findings.
VASPnet tracks MiCA authorisations, passporting and regulatory action across the EEA. To see how this data could support your counterparty reviews, contact us at contact@vaspnet.com.