MiCA in 2026: Licence Hubs, Passports, and the New Map of European Crypto

Europe's crypto market now runs on 373 licences. Twenty-two months after the MiCA licensing regime switched on, and three months after its last transitional window closed, ESMA's interim MiCA register lists 373 active crypto-asset service providers (CASPs) across 27 of the 30 EEA states. Shortly before the deadline, around 1,700 national transitional registrations were still active, according to a Notabene briefing. The licensed universe is a fraction of the market that existed under national regimes.

The headline count also hides more than it shows. Germany appears to dominate European crypto licensing, yet almost none of its entries are new crypto firms. Malta, Luxembourg, Ireland and Austria host most of the world's largest exchanges. Half of all licensed firms can serve every EEA market from a single authorisation, while the other half never leave home.

This analysis works through every row of the register as published on 16 October 2026, using the cleaned dataset maintained by CASP Tracker, and reads it against ESMA's grandfathering list, its peer review of Malta and the European Commission's plan to centralise supervision. It asks four questions: where firms are really licensed, why they chose those jurisdictions, how far a licence travels, and what happens to this map once ESMA takes over. Every figure can be explored in the interactive MiCA Licence Map that accompanies this piece.

Germany's Lead Is a Banking Story

Germany accounts for 106 of the 373 entries, 28% of the register and almost three times France's total. Read at face value, it is Europe's crypto capital. The register's own legal-basis column says otherwise. Of Germany's 109 raw rows, 101 cite Article 60 of MiCA, and only 8 cite Article 63.

The difference matters. Article 63 is the full CASP authorisation that a crypto business must win from scratch. Article 60 lets institutions that already hold a banking or investment licence add crypto services by notifying their regulator in advance. Germany's numbers are savings banks, cooperative banks and brokers switching on crypto trading for existing customers. They are not a wave of new crypto companies.

Strip out banks, brokers and other traditional finance and the ranking inverts. France leads crypto-native licensing with 32 firms, followed by the Netherlands and Germany on 24 each, Malta on 21 and Cyprus on 19. Across the register, 246 entries are crypto-native and 127 come from traditional finance.

Figure 1. Source: ESMA interim MiCA register (CASPs file), via CASP Tracker, 16 Oct 2026. Revoked authorisations excluded. Firm type classified by entity name.

The split has to be inferred because the register does not consistently record it. 179 of its 378 raw rows leave the legal basis blank, including every row filed by France, Cyprus, Malta, Luxembourg and Ireland. For a dataset meant to give the market legal certainty, that is a material gap.

The Licence-Shopping Map

If Germany is where banks notify, a handful of smaller jurisdictions is where the global exchanges went. Malta hosts OKX, Crypto.com, Gemini, Blockchain.com and Gate. Luxembourg hosts Coinbase, Bitstamp and Ripple. Ireland hosts Kraken. Austria has become an unexpected hub for exchanges headquartered outside the EU: Bybit, KuCoin, BingX and WhiteBIT all route their European business through Vienna.

Three forces shaped these choices. The first was speed. The Netherlands authorised MoonPay on 30 December 2024, the day the regime began, and Malta licensed OKX, Crypto.com and Bitpanda on 27 January 2025. Second came language and legal familiarity, which favour English-speaking common-law systems such as Malta, Ireland and Cyprus. Third was supervisory infrastructure: Luxembourg and Ireland already ran large fund and payments sectors and could absorb complex group structures.

Figure 2. Source: ESMA interim MiCA register, via CASP Tracker, 16 Oct 2026; Decrypt, 24 Jun 2026.

Speed carried a cost. In July 2025 ESMA published a fast-track peer review of how Malta's MFSA had authorised one CASP. It credited the MFSA's resources and expertise, but found that some material issues were not fully resolved when the licence was granted and that some risk areas had not been adequately assessed. ESMA addressed its recommendations to every national regulator, not only Malta. The message was that a race to license first would be watched.

The absence on the map is as telling as any presence. Binance withdrew its MiCA application with Greece's Hellenic Capital Market Commission on 24 June 2026, a week after Reuters reported it would be rejected, and began suspending services in markets including France. The world's largest exchange by volume entered the post-transition era without a European licence.

One Licence, Thirty Markets

MiCA's central promise is the passport: authorisation in one member state, notification to the rest, and access to a market of some 450 million people. The register shows that promise being used in two opposite ways. 149 firms serve only their home state. 150 have notified all or nearly all of the 30 EEA states. Only 74 sit anywhere in between.

Figure 3. Source: ESMA interim MiCA register (passporting notifications), via CASP Tracker, 16 Oct 2026. 373 active entries.

The two camps are different kinds of business. Traditional finance makes up 84 of the 149 home-only firms, mostly regional banks offering crypto to existing local customers. Crypto-native firms make up 121 of the 150 pan-European passports. For an exchange, a licence that does not travel has little commercial value.

The consequence is that consumer protection in much of Europe is now imported. Poland, Hungary and Romania have no home-licensed CASP at all, yet between 175 and 182 firms are cleared to serve each of them. Portugal has one home licence and 190 firms passporting in. Malta, home to 23 firms, is served by 164. For these markets the regulator that matters most sits in Valletta, Vienna, Luxembourg or Dublin, which is exactly the asymmetry that has fuelled the push for supervision at EU level.

The Deadline Effect

MiCA was meant to give Europe one rulebook, but member states set their own transitional windows. Under Article 143(3), each could let incumbents keep operating on national registrations for up to 18 months. ESMA's list shows the spread: six months in the Netherlands, Poland and Finland, twelve in Germany, Ireland and Austria, eighteen in France, Malta, Cyprus and Luxembourg.

The register records firms clearing each of those windows. 44 entries are dated December 2025, as the 12-month windows closed. 75 are dated June 2026, the final month before the 18-month windows shut on 1 July. Together those two months account for 119 of the 371 entries dated up to the end of October, almost a third of the register.

Figure 4. Source: ESMA interim MiCA register (authorisation and notification dates), via CASP Tracker, 16 Oct 2026; ESMA list of grandfathering periods under Article 143(3).

The pattern is consistent country by country. France authorised 12 firms in June 2026 alone, a third of its total, and Cyprus 9. Malta licensed 7 that month, including FalconX, Strike and Bequant. The deadline was a forcing function, and applicants and regulators alike worked to it.

The wave did not stop on 1 July. Germany recorded 48 new entries between July and October 2026, almost all bank notifications. Notification is not bound by the grandfathering clock, so that tail is likely to keep rising as more regional banks follow.

What Europe's Licences Actually Permit

MiCA defines ten crypto-asset services, and the register records which ones each firm may provide. The distribution shows an industry built around access rather than venues. 62% of licensed firms may hold crypto for clients, 58% may transfer it and 56% may execute orders. Only 22 firms, 6% of the register, are authorised to operate a trading platform.

Figure 5. Source: ESMA interim MiCA register (service codes a to j under Article 3(1)(16)), via CASP Tracker, 16 Oct 2026.

That scarcity is structural. A trading platform carries the heaviest obligations in MiCA, from operating rules to market-abuse surveillance, and most brokers route orders to a small number of venues rather than run their own. The licensed venues include Kraken, Bitstamp, Bitvavo, OKX and Gate, alongside regulated market infrastructure such as Börse Stuttgart's operator and 360T. Price formation for European retail crypto is concentrated in very few hands.

Licence breadth also tracks the firm type identified earlier. Crypto-native firms hold an average of four services each, while banks and brokers average two. Banks tend to add a narrow layer of custody and execution to an existing relationship. Crypto firms apply for the full stack because the stack is the product.

The stablecoin side is narrower still. ESMA's register lists 25 e-money token issuers, including Circle, Paxos and Société Générale Forge, and no asset-referenced token issuer at all. USDT, the largest stablecoin globally, has been progressively delisted for EU users because its issuer did not seek authorisation.

The Map Is About to Be Redrawn From Paris

The map described above rests on national choices: national windows, national review standards and national speed. That foundation is now in question. On 4 December 2025 the European Commission published a market integration package that would make ESMA the direct supervisor of every CASP, removing those powers from national authorities. The legislative process is expected to take at least a year, but the direction is set.

The register itself makes the case for the change. Enforcement is as uneven as licensing. ESMA's list of non-compliant entities names 178 firms offering crypto services without authorisation, and 169 of them, 95%, were reported by Italian authorities. Either unlicensed activity is overwhelmingly an Italian problem, or most regulators are not reporting it. The second reading is the more plausible one.

Data quality is the other gap. ESMA planned to fold its interim CSV files into its IT systems by mid-2026. In October the register still ships as weekly spreadsheets, nearly half its rows omit the legal basis, and some entries carry authorisation dates weeks in the future. A single supervisor would at least bring a single standard of record-keeping.

For the licensing hubs, centralisation changes the basis of competition. Malta, Luxembourg, Ireland and Austria won their exchanges partly through speed and accessibility at the authorisation stage. Under ESMA supervision that advantage narrows, and firms licensed quickly may face a second, harder look, as the Malta peer review foreshadowed. What remains is everything a regulator cannot export: talent pools, banking relationships, legal services, language and the quality of the operating environment. The hubs that keep their firms will be the ones that compete on those terms.

Conclusion

The first map of MiCA is not the map its headline numbers suggest. Germany's lead is a banking phenomenon. The real competition for crypto-native firms took place among a handful of smaller states, and Malta, Luxembourg, Ireland and Austria won the largest brands. The passport split the market into firms that stay home and firms that cover all of Europe, leaving several member states almost entirely supervised from abroad. A third of all licences were issued against the clock.

None of this is a failure of MiCA. It is what a single rulebook looks like when it is administered by thirty regulators moving at thirty speeds. The next phase will test whether a single supervisor can turn that rulebook into a single market. For firms, the strategic question is shifting from where to get licensed fastest to where to build a durable European operation. The register is public, but it was not designed to be read. That is why the data behind this analysis is published as an interactive MiCA Licence Map, where every firm, service and passport can be explored by country.