CASP Register

Skip key takeaways

Key takeaways: the ESMA CASP register after the MiCA deadline 5

Updated September 8, 2026

The headline counts from our own raw-CSV parse of the ESMA CASP register, dated 20 July 2026, the custody correction we caught, the June 2026 authorization wave and where conversion from pre-MiCA registrations stands.

• ESMA publishes the register, NCAs and the EBA build it ESMA publishes the register but does not build it - national competent authorities and the EBA supply the records, and the register is updated on a regular basis rather than on a fixed clock
• Three lists, none of them complete on its own Three lists answer three different questions, and none of them is complete: the CASP register, the non-compliant entities list and the home authority's own register
• Verify entity, LEI, service and withdrawal date Verify the legal entity, the LEI and the individual service, and read the withdrawal date before treating a row as a live authorization
• Match the service text, never the letter prefix Match the service field on its description text, never on the letter prefix, because the register documents a controlled vocabulary it never published
• Absence from the register proves nothing Absence from the CASP list is not proof of anything - notification timing and passporting windows produce lawful firms a name search misses, and a group hit is not a hit on your counterparty

Copy takeaways

If your platform is part of the custody-authorized population this data quantifies, or you are still building toward a MiCA authorization, we can walk through what it means for your jurisdiction and service mix.

See our MiCA compliance software development services

Anyone can call themselves a licensed crypto firm. Settling whether that is true is a short procedure and runs against three public lists, none of which is complete on its own. This guide covers how the MiCA crypto-asset service provider register is assembled, what each field in it actually means, and where a careless lookup returns the wrong answer about a counterparty, a vendor or a client you are about to onboard.

In short: ESMA publishes the CASP register as a set of CSV files fed by the national competent authorities, not by its own investigation. A row in it is not proof of a live authorization, because withdrawn records stay published for five years. Absence from it is not proof of anything either, because a firm can operate lawfully on a notification still inside its 40-working-day window, which only has to reach the register by the intended start date, under a passport whose host state no list shows yet or in the gap between a grant and its publication. Read the service field as text rather than as a letter prefix: on the 8 September 2026 file a prefix match missed 16 of the 218 custody records a text match found. Verify the legal entity, then the identifier, then the individual service. In that order.

What the CASP register is and who feeds it

The register exists because Article 109 of MiCA instructs ESMA to build it. It covers four populations rather than one: white papers for crypto-assets that are neither asset-referenced nor e-money tokens, issuers of asset-referenced tokens, issuers of e-money tokens and authorized crypto-asset service providers. Only the last of those answers the question of whether a firm is licensed to do what it says it does.

ESMA does not investigate the firms it lists. National competent authorities grant the authorizations and send the records on, and the maintenance duty sits in one subparagraph of Article 109: "ESMA’s register shall be publicly available on its website and shall be updated on a regular basis. In order to facilitate such updating, the competent authorities shall communicate to ESMA any changes notified to them regarding the information specified in paragraphs 2 to 5." There is no fixed number of days in which ESMA must publish, and no statutory promise that the file you are reading reflects yesterday's decisions.

The one hard clock in the chain runs the other way, from the authority to ESMA. Under Article 63(13), "Competent authorities shall, within two working days of granting authorisation, communicate to ESMA the information specified in Article 109(5)", and the information must be available in the register by the date the firm starts providing services. Withdrawals travel on a looser rule, without undue delay and with no fixed number of days attached.

Practically, the register is still an interim artifact. ESMA publishes it as a collection of CSV files on its MiCA activities page, states that it republishes at weekly intervals, and notes on the same page that information already reported to it or already visible in a national register will not be displayed immediately. That warning is the reason a register check is a starting point rather than a verdict.

The three lists you actually check

A verification that looks at one list answers a narrower question than the person asking usually thinks. There are three, they are built for different purposes by ESMA and by the national authorities, and none of them carries a completeness guarantee.

List	What it holds	What a hit means	What a miss means
ESMA CASP register (CASPS.csv)	Authorization records sent in by national competent authorities, including withdrawn ones	An authorization was granted and reported. Read the withdrawal date before concluding it is live	Nothing on its own. The firm may be newly granted, notified under a different route, or unauthorized
ESMA list of non-compliant entities (NCASP.csv)	Entities a competent authority has reported for providing services in breach of MiCA	A supervisor has publicly flagged the entity. Stop and escalate	Nothing. The list is non-exhaustive by law and depends on what authorities choose to report
National register of the home authority	The authority's own record of who may serve its market, in its own vocabulary	The authorization exists at source, which is where it is created	Ambiguous. It can mean no authorization is needed, an application under assessment or an unlawful operation

The negative list is thinner than people expect. Article 110 requires ESMA to establish "a non-exhaustive register of entities that provide crypto-asset services in violation of Article 59 or 61", and sets the content floor low: "The register shall contain at least the commercial name or the website of a non-compliant entity and the name of the competent authority that submitted the information." An NCASP record can therefore be a trading name, a few domains and the reporting authority, with no legal entity and no identifier to match against. It is a strong negative signal when it fires and worthless as a clean bill of health.

The NCASP.csv file is published alongside the CASP one and read the same way. When the ESMA file and a national register disagree, neither one wins by rank. The authority that granted the authorization is where the fact originates, and ESMA republishes what it was sent, so a mismatch is a question for the home authority rather than a puzzle to solve by picking a source. The authorities describe the same layering themselves. BaFin notes that a German authorization surfaces in three places, the Federal Gazette, its own company database and the ESMA interim register. The AMF states that its white lists are not updated in real time and points readers to the ESMA register alongside it. The AFM goes further and spells out the three possible meanings of a miss in its own crypto register, which is the clearest statement of the problem we found from any authority.

How to verify a CASP step by step

Work down the record rather than across the search results. A counterparty still assembling that record instead of holding one is walking through the process our CASP license application guide documents. Each step below maps to a column in CASPS.csv, and the field names come from ESMA's own field description file.

Step	What to confirm	Register field	Failure it catches	If it fails
1. Legal entity	The exact legal name that will sign the contract, not the brand on the website	ae_lei_name, ae_commercial_name	A group affiliate or a non-EU company trading under a familiar brand	Ask which entity is the contracting party and re-run the check on that name
2. Identifier	The 20-character LEI, matched against the entity's own filings	ae_lei	Two similarly named firms, or a name changed since the record was filed	Match the LEI in the GLEIF record before accepting a name-only hit
3. Home authority	Which competent authority granted the authorization, and in which Member State	ae_competentAuthority, ae_homeMemberState	A claim of EU-wide authorization with no home supervisor behind it	Escalate to the named home authority, which is where the fact originates
4. Services	Every service you will actually buy, read from the service field rather than assumed	ac_serviceCode	A firm authorized to exchange crypto-assets that is also holding your keys	Read the service text yourself, then ask the counterparty for the authorization decision reference
5. Host states	Whether the record lists the Member States where your users sit	ac_serviceCode_cou	A cross-border offer that has not been passported yet	Check the host-state field again after the passport window and ask the home authority meanwhile
6. Status and dates	The authorization date and, above all, whether a withdrawal date is filled in	ac_authorisationNotificationDate, ac_authorisationEndDate	A withdrawn authorization still visible in the file	Treat a filled withdrawal date as disqualifying until the home authority says otherwise
7. Digital surface	The website and any trading platform website against the domain you are dealing with	ae_website, ae_website_platform	A white-label front end on a domain the register never mentions	Ask who operates the domain and which authorized entity receives the money
8. Freshness	How old the record is before you rely on it	ac_lastupdate	A stale row that predates a recent change of status	Re-download the file and confirm the record with the home authority

The withdrawal date is the field most checks skip, and it is the one that decides the answer. A withdrawn authorization does not vanish from the file: under Article 109, "Any withdrawal of an authorisation of an issuer of an asset-referenced token, of an issuer of an e-money token, or of a crypto-asset service provider, and any measure notified in accordance with paragraph 6, shall remain published in the register for five years." A firm that lost its license last quarter is still in the file, and the only thing separating it from an authorized one is a date in a column many spreadsheet views hide.

Commercially, the service list matters more than the row that carries it. An authorization is not a general permission to be a crypto business, it names the services it covers, and Article 59 makes that explicit: "Competent authorities that grant authorisations in accordance with Article 63 shall ensure that such authorisations specify the crypto-asset services that crypto-asset service providers are authorised to provide." A withdrawal can also be limited to a single service, which means a live record with a clean status can still be missing the one permission you are buying. If you are not sure which permission that is, our breakdown of the ten CASP services maps them to what a platform actually does, and custody is the service where the gap between marketing language and authorized scope is widest.

Host states carry a structural blind spot. Passporting information reaches ESMA within ten working days of the filing, and under Article 65(4) the firm "may begin to provide crypto-asset services in a Member State other than its home Member State from the date of receipt of the communication referred to in paragraph 3 or at the latest from the 15th calendar day after having submitted the information referred to in paragraph 1". There is a real window in which the right to serve a country exists before any list shows it.

How we caught our own parsing error

The service field is where automated checks quietly go wrong, and the reason is documented in ESMA's own paperwork. The field description file announces the format of ac_serviceCode as a controlled vocabulary, saying that the following values are permissible, and then leaves the list of permissible values empty. A vocabulary is announced and never supplied, so each authority fills the field in its house style.

We hit this parsing our own copy of the file. Counting custody authorizations by matching the letter prefix a. against the service field returned a number that was too low. Some Cypriot and Estonian records give the services as plain descriptive text with no letter prefix at all, so a prefix match never sees them and drops every custody record filed that way. Re-running the count against the service description text instead recovered the missing records.

Snapshot, 8 September 2026: the CASPS.csv file downloaded that morning held 341 rows, 339 of them active and 2 carrying a withdrawal date, across 26 home jurisdictions in the ae_homeMemberState column, three of them EEA rather than EU. That is a reading taken on one day, not a property of the register. The file is overwritten weekly, so re-run the count yourself rather than quoting this one.

Re-checking the same file on 8 September 2026 showed the defect is still there. Against 339 active records, a letter-prefix match found 202 custody records and a description-text match found 218, so 16 records were missed. Thirteen of them were Cypriot and three Estonian. One Dutch row also carries no letter prefix, which is the reason to keep the claim narrow: those two jurisdictions account for the records missed in the runs we performed, and the formatting inconsistency itself is broader than two countries. Elsewhere the letters are present but delimited by a tab, or by no space at all, or attached to a service name with a typo in it.

The procedure that survives all of this is simple. Match on the service description text case-insensitively rather than on the letter prefix, do not assume that two rows of the same file use the same delimiters, and read the row yourself before acting on a screening tool that reports a counterparty holds no custody authorization at all. Retain a dated copy of the CSV you checked as well, because ESMA overwrites these files in place at stable URLs and last month's evidence is not recoverable from today's download.

Entities that are not CASPs but may provide crypto-asset services

The false negative that survives most checks is a firm that is absent from the CASP list and entirely lawful. Article 59 allows two routes, and the second is easy to miss: "a credit institution, central securities depository, investment firm, market operator, electronic money institution, UCITS management company, or an alternative investment fund manager that is allowed to provide crypto-asset services pursuant to Article 60."

Those seven categories of existing financial institution do not apply for a CASP authorization. They notify their home authority at least 40 working days before providing the services for the first time, the authority checks the notification for completeness, and it then sends ESMA the same Article 109(5) information a CASP record carries. Under Article 60, "ESMA shall make such information available in the register referred to in Article 109 by the starting date of the intended provision of crypto-asset services." So the notifying entities do appear in the register, through a different door and on a different clock, and what a lookup misses is a notification still inside its window rather than the route itself. Whether that appearance makes the firm a CASP or leaves it under a different label entirely is the distinction our CASP vs VASP guide draws out. A bank that shows up with a thin service list and no authorization narrative behind it may well be one of them, and the AFM makes the same point in plain language on its own register page: the notification route is only open to firms already authorized to provide certain financial services. A third-country firm can also reach EU users with no register footprint at all, which is the territory of reverse solicitation and a reason to establish who approached whom before treating absence as a finding.

How to read a transitional record

Some records carry the residue of the transitional regime that ran before MiCA applied in full, and reading them as though they were ordinary authorizations produces wrong conclusions in both directions. The rule in Article 143(3) is that "Crypto-asset service providers that provided their services in accordance with applicable law before 30 December 2024, may continue to do so until 1 July 2026 or until they are granted or refused an authorisation pursuant to Article 63, whichever is sooner." Member States were free to shorten that window or decline it entirely, and a simplified authorization procedure was available for firms already authorized nationally.

Three consequences follow. Grandfathered activity was national activity, so a firm that operated legally for years under a national regime has no MiCA record from that period to point at. The transitional clock ran differently by Member State, which means two firms with identical histories can have very different register footprints. And a firm that never had transitional cover, because it was not providing services lawfully before 30 December 2024, was never entitled to trade on the transition at all. If a counterparty is winding down rather than authorized, the shape of that exit is itself diligence material, and we cover what a compliant one looks like in our guide to the wind-down plan.

Issuers are a different lookup

Checking a token issuer is not the same job as checking a service provider, and running it against the CASP file returns nothing useful. The interim register publishes five CSV files, and issuers sit in their own two: EMTWP.csv for e-money token issuers and their white papers, and ARTZZ.csv for issuers of asset-referenced tokens. A third file, OTHER.csv, holds white papers for crypto-assets that are neither.

Two facts about that lookup save time. As downloaded on 8 September 2026, ARTZZ.csv was 276 bytes of header row with zero data rows in it, so an empty result there is the file's actual content rather than a failed download, and a counterparty claiming an authorized asset-referenced token has nothing in the register to point at. And the EBA, which people reach for next, publishes no general register of ART or EMT issuers at all. Its MiCA role is assessing whether a token is significant and supervising the ones that are, so issuer lookup runs through the ESMA files or nowhere. Note also that nobody vets the white papers themselves: ESMA states on its register page that they have not been reviewed or approved by any competent authority, and the offeror or issuer alone is responsible for the content.

False positives that survive a careless check

Four patterns produce a confident wrong answer, and all four survive a name search.

• The group entity. MiCA protections attach to the specific authorized legal entity, not to a brand or a corporate family. An authorized European subsidiary tells you nothing about the offshore parent whose terms of service you are actually signing.
• The similar name. Commercial names can repeat and legal names shift after restructurings. This is what the LEI is for, and it is the one field in the record that cannot be approximated.
• The white-label front end. A separate trading platform website field, ae_website_platform, sits in the record next to the firm's own website, so a hit on the company behind the technology says nothing about the entity taking your customer's money.
• The pre-MiCA national register. CySEC still publishes the register of its older national regime next to the MiCA one. The page whose breadcrumb reads Crypto Asset Service Providers (CASPs)- National Regime is the pre-MiCA list, while the MiCA entities live under a separate navigation entry on the CySEC site. Citing the wrong one turns a lapsed national registration into a claimed MiCA authorization.

Misrepresentation of status is itself prohibited, which is worth quoting in full when a counterparty is being evasive. Article 59 reads: "A person who is not a crypto-asset service provider shall not use a name, or a corporate name, or issue marketing communications or undertake any other process suggesting that it is a crypto-asset service provider or that is likely to create confusion in that respect." A firm that describes itself as MiCA-ready, MiCA-aligned or in the final stage of authorization is not describing an authorization.

How Pharos Production helps

Counterparty verification is a workflow, not a search, and it belongs inside onboarding rather than in a spreadsheet somebody refreshes when they remember. We build and audit the systems behind that workflow, from register ingestion and LEI matching to the evidence trail a supervisor expects to see. If you are wiring register checks into onboarding, or building toward an authorization of your own, our MiCA compliance software development team can work through what your service mix and jurisdictions require.

Sources: Regulation (EU) 2023/1114 (MiCA), Articles 59, 60, 63, 64, 65, 109, 110 and 143, consolidated text on EUR-Lex; ESMA Interim MiCA Register files CASPS.csv, NCASP.csv, ARTZZ.csv, EMTWP.csv and OTHER.csv, with the accompanying field description file, downloaded 8 September 2026; the ESMA MiCA activities page; the ESMA public statement on the end of the MiCA transitional period, ESMA75-113276571-1679 of 17 April 2026; the EBA page on its supervisory role under MiCA; national register pages published by BaFin, the AMF, the AFM and CySEC.

FAQ

Last updated: September 8, 2026

Quick answers to common questions about custom software development, pricing, process and technology.

Expand all Collapse all

Search FAQs

Popular

Type to filter questions and answers. Use Topic to narrow the list.

Showing all 6

• ★ Featured question. What is the CASP register?

  Copy link Copies a direct link to this answer to your clipboard.

  It is the public register ESMA maintains under Article 109 of MiCA, covering authorized crypto-asset service providers alongside token issuers and crypto-asset white papers. ESMA publishes it as a set of CSV files built from records that national competent authorities and the EBA send in, so it is a consolidated view of national decisions rather than an independent assessment.

• How do I check whether a company is an authorized CASP?

  Copy link Copies a direct link to this answer to your clipboard.

  Open the CASP file in the ESMA interim register and work down the record rather than across search results: match the exact legal entity that will sign your contract, confirm the LEI, note the competent authority and home Member State, read the service list for the specific service you are buying, check the host Member States, and check whether a withdrawal date is filled in. Confirm anything unclear with the home competent authority, which is where the authorization originates.

• Does a company in the register definitely hold a valid license?

  Copy link Copies a direct link to this answer to your clipboard.

  No. A withdrawn authorization stays published in the register for five years, so a row on its own proves only that an authorization once existed. The withdrawal date field is what separates a live authorization from a lapsed one, and a withdrawal can also be limited to a single service, leaving the rest of the record intact.

• A firm is not in the CASP register. Is it operating illegally?

  Copy link Copies a direct link to this answer to your clipboard.

  Not necessarily. Credit institutions, investment firms, electronic money institutions, central securities depositories, market operators, UCITS management companies and alternative investment fund managers can provide crypto-asset services through a notification to their home authority rather than a CASP authorization.

  Those entities do reach the register, but only by the date they intend to start, so a notification still inside its 40-working-day window is lawful and not yet visible. A record can also be newly granted and not yet published or, if you are looking at a national register, the firm may be serving that country under a passport from another Member State. Absence is a reason to ask, not a conclusion.

• What is the difference between the ESMA register and a national register?

  Copy link Copies a direct link to this answer to your clipboard.

  The national competent authority grants the authorization and records it first, in its own vocabulary and, in Germany for example, in an official gazette as well. ESMA republishes what authorities send it, which makes the ESMA file the single consolidated view across the Union.

  Neither ranks above the other, so a disagreement between them is a question for the home authority.

• Why does the register's service field not parse cleanly?

  Copy link Copies a direct link to this answer to your clipboard.

  ESMA documents the service field as a controlled vocabulary and then leaves the list of permissible values empty in its own field description file, so each authority fills the field in its house style. Some use letter prefixes, some use plain descriptive text, and delimiters and spacing vary.

  Match on the service description text rather than on the letter prefix, or the count will be short.

I work with startup founders who need a dedicated software development team but don’t want to gamble on hiring, random outsourcing, or opaque delivery.
Most founders face the same problem sooner or later.
Early technical and team decisions lock the product into tech debt, slow delivery, missed milestones and constant re-hiring. By the time this becomes visible, fixing it is already expensive.

As a CTO and software architect, I help founders design, build and run dedicated development teams that work as a true extension of the startup. Not as a black-box vendor.

My focus is on complex products where mistakes are costly:

• Web3 and blockchain platforms
• FinTech and regulated products
• High-load startup systems
• MVP → scale transitions

We don’t do body-shopping.
We don’t sell generic outsourcing.

Instead, we help founders:

• build the right team structure from day one
• keep technical ownership and transparency
• scale delivery without losing control
• avoid vendor lock-in and hidden risks

Teams are aligned with the product roadmap, business goals and long-term architecture. Not just short-term velocity.