Crypto exchanges and MiCA: what changes for you and how to check if your platform is authorized

MiCA is short for the Markets in Crypto-Assets Regulation, officially Regulation (EU) 2023/1114. It was adopted on May 31, 2023 and published in the Official Journal of the EU on June 9 that year. It's a regulation, not a directive: it applies as written in every member state, without each country rewriting it its own way. For the first time, the same rule applies in Madrid, Lisbon and Warsaw.

It covers three groups. Anyone who issues crypto-assets and offers them to the public, which takes a disclosure document called a white paper. Anyone who issues stablecoins. And, the part that affects you most as a user, crypto-asset service providers (CASPs): custody, trading platforms, exchanging crypto for euros or for other crypto, executing orders, advice, portfolio management and transfers.

It also leaves things out. It doesn't apply to unique, non-fungible crypto-assets, such as art or collectible NFTs, or to services provided in a fully decentralized way with no intermediary at all. And it isn't a tax law: what you report to the tax authorities runs on a separate track, and the EU's DAC8 directive, which applies from January 1, 2026, requires providers to report to tax administrations. The Spanish side of that is in the guide to crypto taxes in Spain.

The transitional period is the detail that has caused the most confusion. Article 143 of MiCA allowed platforms that were already operating legally before December 30, 2024 to keep going, until July 1, 2026 at the latest, while their authorization was being processed. Each country could shorten it or scrap it: the Netherlands, Poland and Finland set it at 6 months; Germany, Ireland and Austria at 12.

Spain did a small U-turn. In 2023 the government announced it would cut the period by six months, to December 2025, but in the end it notified ESMA of the maximum 18 months. Only firms already providing services and listed before December 30, 2024 in the Bank of Spain's register could use it. That register had existed since 2021 for anti-money-laundering purposes and was never a supervisory license. Today it's closed: in its last snapshot, dated July 1, 2026, all 137 of its entities are marked as deregistered. If a platform boasts about being “registered with the Bank of Spain”, that tells you nothing anymore. The competent authority is the CNMV, Spain's securities regulator (the Bank of Spain handles stablecoin issuers), and since July 1, 2026 only MiCA authorizations count.

The CNMV put it in writing in its statement of June 15, 2026 (in Spanish): platforms that didn't get authorized needed a plan so their customers could take out their crypto and their money, or arrange a transfer to an authorized provider. And it warned investors with this line:

“

From July 1, investors who deal with an unauthorized entity will not have the protection offered by the MiCA Regulation.

Eight days later, ESMA got more specific in a public statement. Unauthorized platforms had to “immediately stop onboarding new EU clients, refrain from opening new client relationships or accounts, and cease marketing activities and solicitation.” From then on they could only help you sell, transfer or close positions, and hold your crypto only for the period strictly necessary for an orderly exit. ESMA also reminded firms based outside the EU that they cannot provide MiCA services to EU clients or solicit them, and that customers who stay with an unauthorized platform don't benefit from MiCA's safeguards.

A MiCA authorization isn't a decorative badge. It obliges the platform to follow specific rules that you're entitled to hold it to:

• A European passport. A platform authorized in one country can serve you in another after notifying its supervisor (Article 65). That's why an exchange authorized in Malta, Ireland or Luxembourg can operate legally in Spain.
• Your crypto, kept apart from theirs. It must hold clients' crypto-assets separately from its own and keep them legally segregated from its estate, so its creditors can't claim them if it goes bust (Article 75).
• Liability if it loses them. It's liable to you for losses caused by incidents attributable to it, up to a cap: the market value of the crypto-asset at the time of the loss.
• Your euros, in a bank. Client money must be deposited with a credit institution or a central bank by the end of the next business day, in a separate account (Article 70).
• Free complaints. It has to publish its complaints procedure, give you a template to file one and keep a record of complaints (Article 71). And every supervisor must have its own complaints channel (Article 108).
• Conduct rules. It must act honestly, fairly and professionally, give you clear information that isn't misleading, warn you about the risks and publish its pricing and fee policy on its website (Article 66).

That's why my video on the three best exchanges of 2026 has a whole chapter titled “Por qué la licencia MiCA lo es todo ahora” (why the MiCA license is everything now). The ranking, with its pros and cons, is in the video; here I'm sticking to the criteria, which work for any platform.

Los 3 MEJORES Exchanges de criptomonedas en 2026 (con licencia MiCA)7:21

It doesn't protect you from the market either. A flawless exchange can sell you a coin that then drops 80% without breaking a single rule. MiCA doesn't judge whether a project is any good: for most crypto-assets, the white paper is notified to the supervisor but not approved before it's published.

Nor does it shield you from the fine print of the corporate group. The CNMV and ESMA keep making the same point: MiCA's protections only apply to the legal entity authorized in the EU, not to other companies in the same group or to non-EU entities trading under the same brand. Check your contract to see which company is actually providing the service.

And watch out for the “halo effect”. In July 2025 ESMA warned that a MiCA license must not be used as a marketing tool or to suggest that products falling outside the regulation are regulated, as is the case with many derivatives and “earn” products. The license covers specific services of a specific company, and the register shows you which ones.

There are more gaps. MiCA doesn't require every platform to check whether you understand what you're buying (it does when the firm advises you or manages your portfolio), so complex products are still one click away. And if you keep your crypto in your own wallet, the law won't protect you from your own mistakes: there, you're the custodian, so it's worth reading the guide to hot vs cold wallets. What's still on you:

• The price and liquidity risk of whatever you buy.
• Choosing the right legal entity and the country it serves you from.
• Spotting the scams that pose as real platforms (covered in the guide to crypto scams).
• Reporting your trades to the tax authorities (in Spain, the Agencia Tributaria).

I keep repeating it in my video descriptions: check the license in the official CNMV and ESMA registers. Here's how:

1. 01

   Find the legal name

   The terms and conditions or the website footer name the company that provides the service, with its legal form (Ltd, S.A., GmbH, S.L.). The brand name isn't enough.

2. 02

   Search ESMA's register

   ESMA's MiCA page hosts the interim register: a set of CSV files that open in any spreadsheet. The service providers (CASP) file shows the entity, its supervisor, its home country, the authorization date, the authorized services and the countries where it provides them.

3. 03

   Cross-check with the CNMV

   On the CNMV website, which has an English version, go to “Registration files” and then “Crypto-asset service providers”. Its list includes the firms authorized in Spain and those from other countries operating here under a passport.

4. 04

   Check the services

   An entity may be authorized for custody but not to operate a trading platform, or the other way around. Make sure the service you use is on the list.

5. 05

   Look at the warnings

   ESMA also publishes a file of non-compliant entities, and the CNMV keeps its warnings about unauthorized firms, the so-called “chiringuitos financieros” (boiler rooms). If your platform shows up there, get out.

6. 06

   Mind the date

   ESMA updates its register every week, so a very recent authorization may take a few days to show up. If in doubt, ask the CNMV before you send any money.

Figures from ESMA's interim register as of October 16, 2026, with entries updated up to the 15th. Banks only need to notify the CNMV that they offer crypto services; platforms such as Bit2Me or Criptan need a full authorization. The section for asset-referenced token (ART) issuers still has no entries, and the register keeps licenses for firms that no longer operate here, such as Gemini, which left the European Economic Area in April 2026. To make sense of the fine print, the CNMV explains on its MiCA page (main text in Spanish) which entities can operate and with what risks, and it publishes a list showing the date from which each foreign firm may provide services in Spain.

On June 30, 2026, I published a video with a blunt title: “Binance se va de Europa” (Binance is leaving Europe). The nuance matters: Binance hasn't closed your account, but it has no MiCA license and, since July 1, it can't provide you with regulated services in Spain. Here's what can be verified, with dates:

• June 24, 2026. Binance withdraws the MiCA authorization application it had filed with the Greek supervisor, the Hellenic Capital Market Commission, without having received a decision. It says it will seek authorization in another member state, without saying which.
• July 1, 2026. In Spain and other EU countries it stops accepting new sign-ups, deposits, spot trading and new Earn subscriptions, among other services. Withdrawals stay open. That same day, its Spanish company, Binance Spain S.L., is marked as deregistered in the Bank of Spain's register.
• August 2026. An investigation by the firm Sandmark says it opened and funded new accounts from Spain after July 1 without any warning about the missing license. Binance replies that it is working to comply.
• October 1, 2026. According to Euronews, citing the Financial Times, ESMA and the supervisors of France, Germany and Greece, along with the Dutch AFM, are questioning how it keeps serving European customers from its Abu Dhabi entity by relying on “reverse solicitation”. Binance says it's working toward MiCA authorization.
• October 15, 2026. Binance still doesn't appear in ESMA's register or in the CNMV's list: it has no MiCA license in any EU country.

Reverse solicitation (Article 61 of MiCA) lets a non-EU company serve you only if you're the one who seeks it out, on your own exclusive initiative. The moment it courts you with ads, sponsorships or messages, the exemption no longer applies, whatever the contract says. ESMA insists it's a very narrow exception that must not be used to get around MiCA. In plain English: if an unauthorized platform is advertising to you, it isn't doing you a favor.

Binance se va de Europa: la ley MiCA y cómo proteger tus criptos antes del 1 de julio6:38

Bitget: no license and a $388 million theft

Bitget has no MiCA license either: as of October 15, 2026, it isn't in ESMA's register or the CNMV's list. Its European subsidiary has an application pending with the Austrian supervisor, and the company itself says it will only serve EU customers once it's authorized. It was never listed in the Bank of Spain's register, so it couldn't use the Spanish transitional period either, and it shut down all its services in France on March 31, 2026 after talks with the French regulator.

On September 24, 2026, it also suffered the theft of about $388 million from its hot and warm wallets, the largest of 2026 according to The Block. The attacker exploited a flaw in a third-party security product to obtain internal credentials and issue fake withdrawal orders. Bitget says its cold wallets weren't affected and that its user protection fund covers the losses; it resumed withdrawals in phases between September 28 and October 2.

Based on these facts, my view is simple: neither Binance nor Bitget for trading from Spain while they lack a MiCA license. What if you still have funds on an unauthorized platform? Here's what ESMA and the CNMV recommend: ask the platform for its exit plan and move your crypto to an authorized provider or to a wallet of your own. In the June video I suggest three steps, and if you've never taken crypto off an exchange, the MetaMask tutorial shows you how to do it without losing it along the way.

Cómo Crear tu Wallet MetaMask y Pasar Dinero del Exchange sin Perderlo20:30

Since December 30, 2024, Regulation (EU) 2023/1113, known as the Travel Rule, has applied too. Every crypto-asset transfer between providers travels with information on the originator (name, wallet address, home address, ID document number and customer number or, instead, date and place of birth) and on the beneficiary (name and wallet address). Unlike many bank transfers, crypto has no minimum amount: the regulation requires the same information whatever the size of the transfer.

With your own wallets, which the rules call self-hosted, the regime is lighter, but it exists. The provider must collect the information and, if the transfer exceeds €1,000, assess whether that address really belongs to you. How it checks depends on each platform, so keep your wallet handy and answer with real information.

MiCA splits stablecoins into two types. E-money tokens (EMTs) reference a single official currency, such as the euro or the dollar. Asset-referenced tokens (ARTs) are tied to anything else: a basket of currencies, commodities or a combination of assets.

EMTs come with tough rules. Only banks and e-money institutions can issue them, the issuer must redeem them at any time and at par value, and neither the issuer nor the platforms may pay interest for holding them. If someone offers you a yield for keeping a stablecoin on a European platform, ask how that squares with the ban in Article 50.

On non-compliant stablecoins, ESMA was clear on January 17, 2025: platforms had to stop offering them for trading, with restrictions before the end of January and a “sell-only” mode until the end of March at the latest. Custody and transfers were still allowed. The best-known case was USDT (Tether), whose issuer isn't authorized in the EU: several big platforms pulled USDT trading for customers in the European Economic Area, and Binance, for example, removed its spot pairs on March 31, 2025.

As of October 16, 2026, ESMA's register listed 25 EMT issuers, including Circle (authorized in France, with USDC and EURC), and no ART issuers. Tether wasn't on it. Holding USDT in your own wallet isn't illegal; what changed is that regulated EU platforms can't offer it to you for trading. And while a MiCA-compliant stablecoin carries less risk, it isn't risk-free.

Qué es Tether (USDT): la cripto que usas cada día sin saber lo que esconde10:23

Once the license checks out, the rest is a calm comparison. This table sums up what to look at:

The exchange I use is OKX, and in this tutorial I show you from the inside what signing up with a licensed platform looks like: registration, KYC checks, euro deposits, transfers and trading. The fact that I use it doesn't mean you have to: always check the register. And if you reach the leverage chapter, only go in if you understand the risk; I explain it in the guide to risk management.

OKX Tutorial 2026: Cómo Registrarse, Comprar y Vender con Euros | Ley MiCA28:09

OKX and the licensed alternatives

Why OKX? Its European subsidiary, OKX Europe Limited, has held a MiCA license from Malta's MFSA since January 27, 2025 and, according to the CNMV's list, has been allowed to provide services in Spain since November 27, 2025. At the entry tier it charges 0.20% maker and 0.35% taker on spot trades and doesn't charge for SEPA deposits (checked on October 17, 2026). The license covers its MiCA services, not products that fall outside them, such as derivatives. The downsides count too: in February 2025 a group company pleaded guilty in the United States to operating as an unlicensed money transmitter and agreed to pay more than $504 million, and in April 2025 Malta's anti-money-laundering watchdog fined Okcoin Europe, part of the same group, about €1.1 million. If you want to try it, open your OKX account: it's an affiliate link, so I earn a commission at no extra cost to you.

It isn't the only option. As of October 15, 2026, besides OKX, these platforms had a MiCA license, a passport for Spain and real activity: Bit2Me (the Spanish one on this list, authorized by the CNMV), Kraken, Coinbase, Bybit EU, Crypto.com, Bitpanda, Revolut, eToro and Bitvavo. Gemini and KuCoin EU hold licenses but can't be used: the first left Europe, and the Austrian regulator barred the second from starting operations (the latest published decision, from May 2026, kept that ban in place). I compare them in the exchanges section, my detailed take is in the OKX review and the step-by-step for your first purchase is in how to buy bitcoin.

Red flags

• It doesn't appear in any register, or it only shows you a “license” from outside the EU.
• It promises fixed or “risk-free” returns.
• An “account manager” contacts you on social media, WhatsApp or Telegram.
• It asks you to pay a fee or a “tax” before it lets you withdraw your money.
• Its name or website looks suspiciously like those of a well-known platform.
• It rushes you: “today only”, “last spots left”.

If any of this sounds familiar, stop and go through the guide to crypto scams. Everything about custody is in the security section. This is general information, not legal or financial advice; before you invest, read the risk warning.