Where Europe's crypto exchanges are actually licensed

Germany has authorised more crypto-asset service providers than any other country in the European Union. Its list is also, where consumer crypto trading is concerned, close to empty.

That contradiction is the most useful thing in the MiCA register, and it is invisible if you only read the national totals. We keep a copy of the register beside the 72 consumer crypto exchanges we track, and reconciling the two says more about where Europe's retail crypto market actually sits than any league table does.

The register in numbers

Our snapshot holds 279 authorisations, granted across 25 countries by 23 national regulators, covering 164 distinct legal entities. The concentration is steep:

The five largest — Germany, France, the Netherlands, Malta and Cyprus — account for more than half of everything MiCA has authorised so far. Read as a league table, Germany wins comfortably.

Now match it against the brands people actually use

Of the 72 consumer exchanges in our directory, 67 map to an authorisation in the register; five do not. Group those 67 by the regulator that licensed them and the table inverts:

Germany, holder of 56 authorisations — one in five of the entire register — licenses none of them.

That is not a gap in our data; it is what the German list is made of. Read the 56 names and you find Volksbanks and Raiffeisenbanks, private banks such as Berenberg and Hauck Aufhäuser, brokers, asset managers and custody arms of exchange groups. The most common permission on the German list is execution of orders (31 of 56), followed by reception and transmission of orders (21). These are institutions letting existing customers get crypto exposure through a bank or broker they already use — not venues competing for retail traders.

The Dutch, Maltese and Austrian lists are shorter and far more consumer-facing. In practice a German retail investor buying on an app is usually trading on a Dutch, Maltese or Austrian licence.

The permission almost nobody has

A MiCA authorisation is not a single badge. Each one enumerates which of ten services the provider may offer, and the distribution is lopsided:

The average authorisation covers 3.7 services and 23 providers hold seven or more. But operating a trading platform — running the venue where orders actually meet, which is what most people picture on hearing "crypto exchange" — appears just 18 times in 279. Bitvavo, OKX and Kraken are among the few that hold it.

Custody permissions are common because so many holders are banks adding a safekeeping line. The venue permission is scarce because it is the hardest to obtain and the least widely sought: most authorised firms intermediate crypto rather than operate a market in it. When a platform says it is "licensed under MiCA", the useful question is which of the ten services that covers.

How to read a licence claim

Three questions separate a meaningful compliance claim from a decorative one.

Which entity holds it? The register lists legal entities, not brands, and the two rarely match. Kraken's authorisation reads Payward Global Solutions Limited, Coinbase's reads Coinbase Luxembourg S.A., Gemini's reads Gemini Intergalactic EU Ltd. Searching the register for the name on the app usually returns nothing.

Which country granted it, and does that matter to you? Under passporting, one national licence serves the whole EEA, so an unfamiliar Maltese or Irish entity behind a familiar app is normal rather than alarming. What changes with the country is which regulator you complain to.

Is the brand still the licence holder? Authorisations outlive brands. Some businesses in our directory have wound down while their permissions passed to a successor entity trading under a different name — which is why we label those cases explicitly instead of showing a green tick that implies a company still serving customers.

Why we publish this

We track ratings, reviews and sentiment for these platforms daily, and the licence position is what readers most often get wrong — in both directions. Some assume a household name must be authorised in their own country; others treat an unfamiliar foreign entity as a warning sign when it is the same licence their neighbour's app runs on.

The register is public. Everything above is what falls out of reading it against a list of brands people actually use. The full searchable table — every provider, its regulator, country and authorised services — is on our MiCA licence register page.