How to check a fintech is licensed, in five minutes

Almost every app that holds your money has to appear in a public register, and those registers are free to search. The check below takes about five minutes, uses nothing but official sources, and answers two questions: whether the firm is authorised at all, and what happens to your balance if it goes under.

What it will not tell you is whether the app is any good. A licence is a floor, not a recommendation. It means a regulator has looked at the company's capital, its owners and its procedures, and that there is somebody to complain to when things go wrong.

Where these figures come from. The register counts on this page were read on 5 September 2026 from our own mirror of ESMA's MiCA register: 333 authorised crypto-asset service providers, licensed in 26 countries by 25 national regulators. Every register linked below was opened and confirmed on 9 September 2026. Rules, limits and addresses change, so follow the link before relying on anything here.

What the check can and cannot tell you

A register entry gives you three things: the legal entity standing behind the brand, the type of authorisation it holds, and the list of activities that authorisation covers. It does not tell you whether the company is well run, whether it is solvent today, or whether the product is right for you. Those are different questions, and no register answers them.

The entry also names a company, not an app. Brands are marketing; authorisations sit with legal entities, often in a different country from the one on the website. That is why the first step is finding the legal name, and why searching the brand alone is the most common way this check fails.

The five-step check

1. Find the legal name

Open the terms of service or the footer of the website and look for a company name, a registered address and a company number. A firm that holds money is required to tell you who it is; where that is hard to find, treat the difficulty itself as part of the answer.

Write the name down exactly as it appears, legal form included. Registers index the entity, so a search for the brand and a search for "Example Payments UAB" will not always return the same thing.

2. Look for an entry

For anything involving crypto in the EU, the register to search is ESMA's: it is republished weekly as a set of CSV files, one of which lists every authorised crypto-asset service provider in the bloc. For accounts, cards and transfers the equivalent is the EBA's central register of payment and e-money institutions, with its register of credit institutions covering banks.

There is no partial credit at this step. Either the entity is listed or it is not, and "not listed" is a complete answer on its own.

3. Read the type of licence

The three are indistinguishable inside an app and are not the same thing. A bank takes deposits and its customers fall under a deposit guarantee scheme. An e-money institution issues electronic money against funds it must safeguard, and a payment institution executes payments; neither is covered by that guarantee.

Plenty of well-known apps are e-money institutions rather than banks, which is not a problem in itself. It becomes one only when the marketing implies otherwise and the customer finds out at the worst possible moment.

4. Read what it may do

This is the step most people skip. An authorisation is not blanket permission: it lists named activities, and the list differs between firms that look identical from the outside. Under MiCA there are ten services, lettered A to J, and a provider holds only those it applied for and was granted.

Read the row, not the badge. "Licensed" and "licensed for the thing you are about to do" are two different claims, and only one of them is in the register.

5. Check the warnings

Alongside the register of authorised firms, ESMA publishes a file of entities that national regulators have flagged for providing crypto services without the required licence; it currently runs to roughly 160 entries. National regulators keep their own warning lists too, and those cover far more than crypto.

Search both the legal name and the brand name here, because enforcement notices tend to name whichever the public would recognise. As the Polish regulator puts it on its own list: a firm's absence from the list does not relieve you of the duty to check it in reliable sources.

Where to click

Four addresses cover the whole check. All are free and none of them asks you to register.

• ESMA - interim MiCA register
• EBA - payment and e-money institutions register
• FCA - Financial Services Register (United Kingdom)
• ESMA - non-compliant entities (NCASP.csv)

What a licence actually covers

Under MiCA an authorisation is granted for named services rather than for crypto in general. Here is how the authorised providers in the register break down by service, as read on 5 September 2026. One provider can hold several, so the column does not sum to the total.

The bottom row is the one worth pausing on. Of 333 authorised providers, 21 may operate a trading platform, and 78 hold exactly one service out of the ten. Custody is the most common permission by a distance, which figures: it is the one almost every business model needs.

The differences show up in firms you have heard of. Coinbase's Luxembourg entry lists seven services and operating a trading platform is not among them; Bitstamp's Luxembourg entry does include it. Kraken appears twice in Ireland, once for a bundle of eight services and once, separately, for the trading platform alone. None of that is a scandal, and all of it is invisible unless you read the services column rather than the presence of a row.

If the firm fails, who pays you back

A bank in the EU. Deposits are covered by a deposit guarantee scheme up to 100,000 EUR per depositor, per bank. That level survived the revision of the directive adopted on 30 March 2026, and it applies per person, so a joint account is covered twice over.

A bank in the UK. The Financial Services Compensation Scheme pays up to 120,000 GBP per eligible person, per firm. The limit rose from 85,000 GBP on 1 December 2025, which a good many comparison pages have yet to notice.

An e-money or payment institution. No deposit guarantee at all. Instead the firm must safeguard client funds, either by keeping them segregated in an account at a bank or by covering them with an insurance policy or guarantee. That shields the money from the firm's own creditors, but it is not a compensation scheme: no fixed payout, no timetable, and the treatment of the safeguarding account varies between member states. The FSCS says it plainly on its own site - it cannot protect money held with e-money institutions and payment providers.

A crypto provider under MiCA. Rules on custody, segregation of client assets and complaint handling, plus a regulator to complain to. No compensation scheme. If the assets are gone, MiCA gives you a process, not a payout.

This is the practical reason the check is worth five minutes. "Regulated by" on a landing page is usually a true statement; it just answers a narrower question than most readers assume it does.

Four things that should slow you down

None of these proves anything on its own. Each is a reason to spend two more minutes in the register before moving money.

• The site names a regulator but never names the legal entity or a licence number. The regulator is the easy half to claim.
• The entry exists, but for a different activity than the one being sold to you - a custody permission, say, on a page advertising trading.
• The entity is authorised in one country while the marketing, the language and the support hours all point at another. Passporting makes that legitimate; it also makes it worth confirming.
• The name turns up on a warning list. ESMA's non-compliant file, for instance, carries the Dutch regulator's entry for MEXC Global, stating that it provided crypto-asset services in the Netherlands without the required MiCA licence.

Frequently asked questions

How do I check if a fintech is licensed?

Find the legal entity name in the terms or the footer, then search it in the register that matches the service: ESMA's MiCA register for crypto, the EBA registers for banks, e-money and payment institutions, or your national regulator's search. Then read the entry for the type of licence and the activities it covers, and check the warning lists.

Does being in the ESMA register mean the app is safe?

No. It means a national regulator authorised that entity for named services and can be complained to. It says nothing about the quality of the product, and MiCA carries no compensation scheme if your assets are lost.

Is my money in a neobank guaranteed?

Only if the neobank is a bank. Deposits at an EU bank are covered up to 100,000 EUR per depositor, and at a UK bank up to 120,000 GBP since 1 December 2025. Money held at an e-money or payment institution is safeguarded rather than guaranteed, which is a weaker and slower form of protection.

What is the difference between a bank licence and an e-money licence?

A bank may take deposits, lend them out, and its customers fall under a deposit guarantee scheme. An e-money institution issues electronic money against funds it must keep segregated or insured, cannot lend them out, and its customers are not covered by that scheme.

What if the company is not in any register?

Then it is not authorised for that service in the market you are checking, which is reason enough not to fund the account. Check the spelling of the legal name first, since registers index the entity rather than the brand, and make sure you are searching the right register for the service.

How often do the registers change?

ESMA republishes the MiCA register weekly, so an authorisation granted this week may not appear until next. Our own copy of it was refreshed on 5 September 2026. National registers update continuously, which is why every figure here carries the date it was read.

How we compiled this

The counts come from our mirror of ESMA's published CASP register, refreshed on 5 September 2026 and matched against the exchanges we track: 67 of the 72 have an entry. We do not grade licences and we do not treat an authorisation as an endorsement - the register status is shown as a fact on each profile, next to everything else we measure.

Every register in the source list was opened on 9 September 2026 to confirm it is still the right address and still publicly searchable. See also our searchable copy of the MiCA register.

Sources

Official registers and regulator pages only. Each was opened on the date shown; addresses and limits change without notice, so follow the link rather than trusting a number copied from somewhere else, including from here.

• ESMA - interim MiCA register - link checked on September 9, 2026
• ESMA - authorised crypto-asset service providers (CASPS.csv) - link checked on September 9, 2026
• ESMA - non-compliant entities (NCASP.csv) - link checked on September 9, 2026
• EBA - credit institutions register - link checked on September 9, 2026
• EBA - payment and e-money institutions register - link checked on September 9, 2026
• KNF - search of supervised entities (Poland) - link checked on September 9, 2026
• KNF - public warning list (Poland) - link checked on September 9, 2026
• BaFin - company database (Germany) - link checked on September 9, 2026
• ACPR - REGAFI, register of authorised firms (France) - link checked on September 9, 2026
• CNMV - entity search (Spain) - link checked on September 9, 2026
• CNMV - warned entities (Spain) - link checked on September 9, 2026
• FCA - Financial Services Register (United Kingdom) - link checked on September 9, 2026
• FSCS - deposit protection limit - link checked on September 9, 2026
• FSCS - e-money and FSCS protection - link checked on September 9, 2026
• European Commission - deposit guarantee schemes - link checked on September 9, 2026