Legalbison Decodes MiCA: 174 Registered CASPs, but Only 14 Can Operate a Centralized Exchange

Kuala Lumpur, Malaysia, 2026-04-17 — /EPR Network/ — MiCA Decoded is a 12-article weekly series for Bitcoin.com News, co-authored by LegalBison’s Co-Founding and Managing Directors: Aaron Glauberman, Viktor Juskin and Sabir Alijev.

If the EU has already issued 174 MiCA licenses, why are there only 14 actual crypto exchanges on the list? To demystify this, LegalBison helps decode what the public registers are really telling us about how crypto businesses are setting up in Europe.

That contrast, drawn from the EU and EEA public registers as of March 2026, captures the central question the register raises: which business models are landing in which jurisdictions and why?

Custody and transfer services lead because nearly every operator includes them. The rarest categories are the most telling: only 14 entities can operate a trading platform, 21 can provide investment advice, and 30 hold portfolio management authorization. For founders building in those three categories, the EU currently has very few licensed reference points.

Where crypto licenses are concentrating, and why

Germany leads with 51 CASPs (29%), dominated by traditional financial institutions: Commerzbank, DZ BANK, Boerse Stuttgart, and regional Volksbanks — predominantly custodians and broker-dealers, not exchange operators. BaFin’s familiarity with these entities makes the process largely a notification exercise.
The Netherlands follows with 23 (13%), driven by early AFM enforcement and first-wave approvals in December 2024.

France and Malta each hold 13–12 authorizations (7%). Malta hosts OKX, Crypto.com, Gemini, and others that applied for broad service codes including trading platform operation.

Ireland and Cyprus (11 and 10 respectively) host globally recognized exchanges: Kraken in Ireland, eToro and Revolut in Cyprus — all extending pre-existing regulatory relationships.

The practical implication: a crypto exchange application filed in Germany sits in a queue alongside traditional banks applying for narrow services. The same application in Malta sits alongside established global exchanges. Regulator familiarity with the business model is a real factor, even when the regulation is identical across jurisdictions.

Where the big names registered

The register’s most useful signal is not the country count but the company names behind each flag.
Ireland is where Kraken landed, folding multiple national VASP registrations under a single MiCA authorization. It was the first major global exchange to clear the Central Bank of Ireland’s CASP process.

Luxembourg hosts Coinbase and Bitstamp. Both had prior CSSF relationships — Bitstamp through an existing MiFID license for a Multilateral Trading Facility. Coinbase explicitly cited Luxembourg’s blockchain legislation as its European hub rationale.

Austria is home to Bybit, KuCoin, and Bitpanda. The FMA completed MiCA implementing legislation ahead of most member states, and Bitpanda’s prior FMA licensing established regulator familiarity with exchange-type models that Bybit and KuCoin cited when choosing Vienna.

Cyprus hosts eToro and Revolut, both of which had existing CySEC relationships predating their crypto offerings.

The pattern is consistent: exchanges went where the regulator already knew their business model, or where implementation was furthest ahead.

Passporting: one license, 30 markets

A single MiCA authorization from any EU member state covers the entire bloc. Passporting requires only an administrative notification — no separate application or second regulator review. Kraken, Bitvavo, Bitstamp, Bitpanda, and Trade Republic have each passported to 29–30 countries from a single home authorization, while traditional German and Spanish institutions list only their home country.

Founders building for EU retail clients do not need 30 separate applications. One well-chosen authorization, passported across the Union, is how the major platforms have covered the entire market.

Jurisdictions with no track record yet

Ten jurisdictions within MiCA’s scope have produced zero public authorization records: Croatia, Estonia, Greece, Hungary, Iceland, Italy, Norway, Poland, Portugal, and Romania.

Poland is the most urgent case. It was among the most popular European jurisdictions for crypto licensing before MiCA, but as of March 2026, local MiCA implementation has still not passed. VASPs face the EU-wide deadline of July 1, 2026, without the ability to upgrade to a Polish CASP license, since the new regime is not yet live.

Romania is the only country still listed as “to be announced” for its National Competent Authority designation — meaning its regulatory infrastructure for MiCA oversight is not yet in place.
The July 1, 2026 deadline applies equally to every jurisdiction, prepared or not.

Reading the MiCA register as a strategy signal

The 174 authorizations are not evenly distributed because business models are not either. For exchange founders, Malta and Cyprus provide the most comparable reference pool. For custody and broker-dealer models, Germany, Spain, and the Netherlands offer the most precedent. For advice and portfolio management products, the EU has almost no established reference cases yet.

The CASP register shows that operators seeking to serve EU retail clients are building local presence, choosing jurisdictions based on regulator familiarity, and passporting from there across the full market. Not all MiCA jurisdictions are equivalent for every business model — and the register, drawn by the companies that got there first, is now the most reliable map available.

This article is based on a study conducted by LegalBison in February 2026, with data updated as of March 23, 2026. For informational purposes only; does not constitute legal advice. More at legalbison.com.