How to Check Whether Your Exchange Has a MiCA Licence

Before getting into a taxi in Madrid, you can look at the plate showing its licence number. Something similar has applied to cryptocurrency exchanges since 1 July 2026: either they hold a MiCA licence and appear in a public register, or they cannot offer you their services in Spain. Checking takes five minutes.

Updated on 13 November 2026

An exchange with a MiCA licence is a crypto-asset service provider (CASP) authorised by a national authority of the European Union under Regulation (EU) 2023/1114, known as MiCA, and listed in the register of the European Securities and Markets Authority (ESMA). In Spain, it must also appear on the CNMV’s list of crypto-asset service providers, either with Spanish authorisation or with a passport from another EU country.

What a CASP is and what being authorised under MiCA means

MiCA defines a crypto-asset service provider as a company that, on a professional basis, holds cryptocurrencies in custody, exchanges them for euros or other cryptocurrencies, executes orders or operates a trading platform. Under Article 59, no one may do so in the EU without authorisation as a CASP or, in the case of a bank or an investment firm, without having notified its supervisor (Article 60).

Why the Bank of Spain register no longer counts

Until 2024, many exchanges boasted of being “registered with the Bank of Spain”. That register stemmed from the anti-money laundering law (Law 10/2010) and only checked that the company had anti-money laundering procedures and that its managers were of good repute. The Bank of Spain itself points out in its closing note that it did not supervise their financial, operational or security risks, and that registration did not imply “any approval or verification”.

MiCA has applied since 30 December 2024, and its Article 143(3) allowed firms already operating to continue until 1 July 2026 at the latest. Spain used up that deadline in full. On that day the Bank of Spain closed the register, which can now only be consulted as historical data, and since then, in the CNMV’s words, only providers authorised by the CNMV or other European authorities may operate in Spain.

Step 1: look up your exchange in the CNMV register

Go to the CNMV website, section Consultas a registros oficiales (Official register searches), subsection Proveedores de servicios de criptoactivos (Crypto-asset service providers). You will see an alphabetical list and a link to a PDF, which is the most useful part because it gives four pieces of information for each entity:

• The legal name (for example, “BITCOINFORME, S.L. (BIT2ME)”).
• The type of entity: “PSC (España)” if authorised by the CNMV, “Entidad de crédito (España)” if it is a bank that has notified, or “PSC en régimen de LP” if it comes from another EU country under the freedom to provide services (the famous passport), along with its home country.
• The MiCA services it may provide: custody, exchange of crypto for euros, order execution, platform operation, and so on.
• The date from which it may provide those services in Spain.

As of 13 November 2026, the PDF lists around 200 entities: about ten providers authorised by the CNMV itself, seven Spanish banks and, above all, providers from other EU countries operating here under the freedom to provide services. Three real examples, exactly as they appear: Bitcoinforme, S.L. (Bit2Me), Spanish CASP, since 31/10/2025; Renta 4 Banco, S.A., credit institution, since 21/11/2025; and Bitvavo B.V., under the freedom to provide services from the Netherlands, since 14/07/2025.

Pay attention to the services: if it is only authorised for custody and offers to manage your portfolio, something doesn’t add up.

Step 2: check it in the ESMA register

The European register is kept by ESMA under Articles 109 and 110 of MiCA. It is currently an interim register (Interim MiCA Register) published on ESMA’s MiCA page as five CSV files updated every week. The two you need are:

• CASPS.csv: providers authorised across the EU.
• NCASP.csv: entities providing services without complying with MiCA, as reported by national supervisors.

Download the CSV, open it in Excel or Google Sheets (import it as UTF-8 if accented characters look odd) and use Ctrl+F to search for the trade name or the legal name. Check the supervisor, home country, legal name, website, authorisation date, withdrawal date if any, and the countries where it provides services.

As of 13 November 2026, the CASP CSV contains 404 distinct companies (in 407 rows, as some are repeated) and the non-compliant entities file has 216 rows. ESMA warns that information reported by a national supervisor may take time to appear; for the Spanish market, if they don’t match, the CNMV prevails.

Step 3: if it is based abroad, check the European passport

Most exchanges used by people in Spain are licensed in Malta, Ireland, Luxembourg, Austria or the Netherlands. That is legal: Article 65 of MiCA allows a CASP to operate in other EU countries if its supervisor communicates the list to the others, and it can start no later than fifteen calendar days after requesting it.

Check that Spain is on that list: in the ESMA CSV, “ES” in the countries column; in the CNMV PDF, the type “PSC en régimen de LP” with the home country. Dates may differ without anything being wrong: Bitvavo B.V. appears in ESMA as authorised on 26/06/2025, and in the CNMV as able to operate in Spain from 14/07/2025.

Step 4: make sure the legal name and website match

A scammer can copy the logo and even the trade name of an authorised exchange, but not the entity listed in the register. Carry out three checks:

1. Look in the terms and conditions for the company you are signing the contract with. That legal name must appear in the register, letter for letter.
2. Compare the domain with the website column in the ESMA CSV. An extra hyphen or a changed letter is reason to stop.
3. Check whether the group has several companies. The ESMA CSV lists two Kraken companies with the same website: Payward Europe Solutions Limited, which includes Spain and appears in the CNMV list, and Payward Global Solutions Limited, which only provides services in Cyprus and Ireland. The CNMV warns that MiCA protection covers the authorised entity, not other companies in its group.

Step 5: check the CNMV warnings

If the exchange does not appear in any register, check whether the CNMV has already issued a warning about it. The search tool for flagged entities lets you search by name or part of a name and by date, and has two tabs: CNMV warnings and warnings from foreign regulators. That is where so-called boiler rooms end up, as well as websites impersonating real companies.

Not appearing in the warnings says nothing in its favour, because the list cannot capture every fraudulent website created each week. What counts is being in the register. We saw this in the €1.5 million Tinder romance scam.

Where to look: summary table

What to do if your exchange does not appear

First rule out a simple mistake: search by legal name and not just the brand, and check both registers, because a newly authorised exchange may take time to appear in one of them. If it still does not appear, it cannot provide you with services in Spain, and if it does, you are operating without MiCA protection. Stop sending it money, withdraw your funds to a wallet of your own or to a registered provider, keep screenshots of your balance and transactions, and ask it in writing which company your contract is with. If you suspect fraud, use the CNMV’s investor enquiry service and, if you have been robbed, report it to the Police or the Guardia Civil.

What an authorised exchange does and does not protect you from

A MiCA licence gives you concrete things: the exchange must segregate your crypto-assets and your money from its own and protect them in the event of insolvency (Article 70), sign a custody agreement with you setting out its responsibilities (Article 75), handle your complaints free of charge (Article 71) and submit to the supervision of an authority that can withdraw its licence. In addition, the CNMV is consulting until 16 November 2026 on a circular so that its Complaints Service can also handle complaints against crypto-asset providers, as we explained here.

What it does not give you: no fund will return your money if the exchange goes bankrupt or your funds are stolen. MiCA requires a warning that crypto-assets are not covered by deposit guarantee schemes (Directive 2014/49/EU) or investor compensation schemes (Directive 97/9/EC). Nor does it protect you from bitcoin falling 40%: the licence says the company follows the rules, not that your investment is a good one.

Back to the taxi. The plate doesn’t guarantee that the driver knows the best shortcut, but it does guarantee that someone is answerable for them if things go wrong. If you want the full context of the regulation, start with MiCA explained: what changes for you, and if what you keep on the exchange is stablecoins, continue with Stablecoins and MiCA: EMT, ART and what happens to USDT. Have you checked yours yet?

Frequently asked questions

Is it enough that my exchange was registered with the Bank of Spain?

No. The transitional period ended on 1 July 2026 and on that day the Bank of Spain closed its register of virtual currency providers, which now has only historical value. To operate in Spain, a firm must be on the CNMV’s list of crypto-asset service providers.

Can an exchange licensed in another EU country operate in Spain?

Yes, if its supervisor has notified that it provides services in Spain (Article 65 of MiCA). On the CNMV list it appears as “PSC en régimen de LP” with its home country, and in the ESMA CSV “ES” must appear among the countries where it provides services.

Where is the official register of MiCA-authorised exchanges?

In Spain, on the CNMV website, section Consultas a registros oficiales (Official register searches), subsection Proveedores de servicios de criptoactivos (Crypto-asset service providers). At European level, in ESMA’s interim MiCA register, which is published as CSV files on its MiCA page and updated every week.

If my exchange has a MiCA licence, is my money guaranteed?

No. Crypto-assets are not covered by the deposit guarantee fund or by investor compensation schemes. MiCA requires the exchange to segregate and protect client assets, but if the company goes bankrupt or suffers a theft, there is no public fund to reimburse you.

This content is for informational purposes only and is not investment advice.

{ “@context”: “https://schema.org”, “@type”: “FAQPage”, “mainEntity”: [ { “@type”: “Question”, “name”: “Is it enough that my exchange was registered with the Bank of Spain?”, “acceptedAnswer”: { “@type”: “Answer”, “text”: “No. The transitional period ended on 1 July 2026 and on that day the Bank of Spain closed its register of virtual currency providers, which now has only historical value. To operate in Spain, a firm must be on the CNMV’s list of crypto-asset service providers.” } }, { “@type”: “Question”, “name”: “Can an exchange licensed in another EU country operate in Spain?”, “acceptedAnswer”: { “@type”: “Answer”, “text”: “Yes, if its supervisor has notified that it provides services in Spain (Article 65 of MiCA). On the CNMV list it appears as «PSC en régimen de LP» with its home country, and in the ESMA CSV «ES» must appear among the countries where it provides services.” } }, { “@type”: “Question”, “name”: “Where is the official register of MiCA-authorised exchanges?”, “acceptedAnswer”: { “@type”: “Answer”, “text”: “In Spain, on the CNMV website, section Consultas a registros oficiales (Official register searches), subsection Proveedores de servicios de criptoactivos (Crypto-asset service providers). At European level, in ESMA’s interim MiCA register, which is published as CSV files on its MiCA page and updated every week.” } }, { “@type”: “Question”, “name”: “If my exchange has a MiCA licence, is my money guaranteed?”, “acceptedAnswer”: { “@type”: “Answer”, “text”: “No. Crypto-assets are not covered by the deposit guarantee fund or by investor compensation schemes. MiCA requires the exchange to segregate and protect client assets, but if the company goes bankrupt or suffers a theft, there is no public fund to reimburse you.” } } ] }