How to check a crypto provider in ESMA's MiCA register

Date: 8 November 2026. Author: Redazione LX20 Law Firm. Publisher: LX20 Law Firm.

To check a crypto provider, find its exact legal identity in the official register and compare the listed services with those you want to examine. Do not stop at a brand or the phrase “MiCA authorised”. A register entry concerns an entity and an activity scope; it does not guarantee product returns, absence of risk or the authenticity of whoever contacts you.

This guide describes a general information check as of the stated date. It does not assess specific providers or constitute an invitation to invest or personalised advice. A complete assessment may require further examination of the service, contractual documents and how it is offered.

Start with the official source

Independently open ESMA's MiCA page, which links to the register and its categories. Do not rely solely on a screenshot sent by the purported provider. Interfaces and data formats may change: follow links on the authority's page rather than paths copied from outdated guides.

The register distinguishes information about service providers, issuers and white papers. These categories are not equivalent. Finding a token document does not answer whether a particular company is authorised for its proposed service. Identify which section you are consulting and what information it contains before using a result.

Connect the brand and legal entity

Retrieve the contracting entity's name from service documents rather than relying on a logo. A group may use the same brand for several companies in different countries. The company named in promotional messaging may differ from the entity in terms applicable to your relationship. Record discrepancies for clarification.

Compare identifiers available in the register and official communications from the competent authority. Similar names are insufficient. Where an identifier appears, use it to reduce ambiguity without treating it alone as a guarantee. The check should establish which entity the recorded decision or status concerns.

Check the specific service

Regulation (EU) 2023/1114 of 31 May 2023, known as MiCA, distinguishes crypto-asset services in Article 3. Article 59 governs their provision framework, and Article 109 concerns the register. Source: MiCA. The commercial label “crypto platform” alone does not describe the service's legal scope.

Compare the actual activity with available information: custody is different from advice. Do not extend a result for one category to every activity promoted by the group. European authorities expressly remind readers to check which services a provider may offer in their warning on crypto-assets.

Check who is using that identity

Even a genuine name can be copied. Compare domains and contact information with relevant official sources and documents of the identified entity. Do not resolve discrepancies using a phone number in the same suspicious message. Find an independent channel. Checking authorisation and checking the contact's identity are separate steps.

A message referencing the register and requesting funds to a new address does not become trustworthy through that reference alone. Preserve details needed for examination without sharing passwords or private keys. This caution concerns the contact's identity rather than a negative assessment of the provider whose name is used.

Read a missing result without rushing to conclusions

If the entity cannot be found, check its name, category and the date of the consulted data. Look for information from the relevant national authority. Do not replace the register with a general search returning only advertising. Equally, no result from an initial search does not justify public accusations without further examination.

Do not confuse a submitted application with obtained authorisation. If a provider uses wording such as “pending”, ask for its current basis for the examined activity and seek official confirmation. Do not use old transitional regime references as automatic evidence of today's position. Information must reflect the checking date.

A fictional example

A company assesses a crypto service presented under the brand “Example Digital”. Its terms name a different company from the brochure. The manager does not immediately conclude that something is unlawful: clarification about the service-providing entity is requested and compared with the register and listed services. References and open questions are retained.

An email then arrives using the same brand but a different domain. It is treated as a separate identity check without attributing message-authentication capability to the register. This case is entirely invented and describes no provider, client or engagement of the Firm.

Record scope and limitations

Record the date, source and examined entity, identifying which services were compared. The check captures available information rather than providing a permanent guarantee. ESMA also explains that inclusion of certain white papers in the register does not mean authority approval. Document verification should retain these distinctions even in an internal summary.

If the service or contracting entity later changes, revisit the relevant information instead of relying on an old note. Keep the new result separate from earlier findings so colleagues can understand what was checked at each stage. This makes the record useful without overstating the conclusions it supports.

For the Firm's relevant practice overview, see Fintech, Digital Assets & Web3.