Who is MiCA, and why does a founder need to know this
MiCA (Regulation (EU) 2023/1114, in force since June 2023) is the EU's regulatory framework for crypto businesses. Its licensing regime for crypto-asset service providers became applicable December 30, 2024, and the transitional period that let previously-operating firms keep serving EU clients while their applications processed ended July 1, 2026. Any exchange serving EU residents now needs genuine authorization from a national regulator, registered centrally through ESMA, with passporting that lets one country's license cover all 27 member states plus the wider EEA.
It's not a new proposal or a transition-period technicality anymore. As of July 2026, it's the operating reality for any exchange with EU users, with no grace period left.
Why this happened
The EU spent several years building a framework that treats crypto exchanges the way it already treats other financial infrastructure: licensed, supervised, accountable to a named regulator. The stated goals are the usual ones for financial regulation: consumer protection, market integrity, a level playing field between exchanges willing to comply and ones that weren't.
What makes this moment specifically worth a founder's attention is the scale of the shakeout, and a distinction worth being precise about. MiCA authorization isn't a single license. It covers ten separate categories of crypto-asset service, and firms apply for whichever combination matches what they actually do. Custody, portfolio management, and advice are each their own category. So is operating an actual trading platform, and that one carries its own, higher capital requirement specifically because it's the highest-risk activity on the list.
That matters here because the two numbers aren't the same thing. Out of roughly 1,200 crypto firms that were previously operating legally in the EU under the old rules, a broad count of firms holding some MiCA authorization looks reasonably large. The number specifically authorized to operate a trading platform, the license that actually lets a venue run the kind of order-book exchange a token gets listed on, is much smaller. As of a mid-2026 count, it was under 20 firms across the entire EU. Custody-only or advice-only authorization doesn't cover that activity at all, no matter how legitimate the firm otherwise is.
What actually changed
Before July 2026, an exchange could generally serve EU users under a patchwork of national rules, informal tolerance, or simply by not being enforced against yet. After July 2026, that's gone. An exchange either has genuine authorization for the specific service it's providing, or it doesn't have a legal basis to provide that service to EU customers.
Two nuances worth understanding, because both trip people up. First: authorization isn't necessarily permanent or unconditional. A national regulator can grant a license and later restrict what that entity can do, including barring it from onboarding new customers, if it finds compliance failures after the fact, without revoking the underlying license entirely. "Authorized" and "currently unrestricted" aren't guaranteed to be the same thing. Second: the official register itself records refusals and withdrawals alongside active authorizations. A firm appearing in a search result doesn't automatically mean it's currently authorized. The status field is what matters, not just presence in the data.
What this means for you as a founder
If you're choosing where to list a token and any meaningful part of your target audience is in the EU, an exchange's MiCA status is now a real input into that decision, not a footnote. An exchange that can't legally onboard the users you're trying to reach isn't a viable venue for reaching them, regardless of how attractive its other terms look. Specifically, check that the venue holds authorization for operating a trading platform, not just any MiCA category. A firm can be a genuinely licensed CASP and still not be licensed to run the exchange you'd be listing on.
The criteria for choosing an exchange more broadly are covered separately. Regulatory reach is one of six things worth checking, not the only one. But it's the one that's changed the most recently, and the one most likely to be wrong if you're working from information that's more than a few months old.
Consequences of getting this wrong
The direct cost is straightforward: a listing fee paid to a venue that can't legally serve the users you wanted it for. That's money spent on access you don't actually get.
The less obvious cost is time. A listing process takes weeks to negotiate and longer to show results. Discovering a regulatory problem after you've committed budget and attention to a venue is a much more expensive way to learn about it than checking beforehand.
When this doesn't apply to you at all
If your project has no meaningful EU user base and no plan to build one, this entire topic changes very little about your listing decision. It's still worth understanding as context, since it's a visible sign of where regulatory scrutiny on this industry is heading generally, but it's not a reason to eliminate or prioritize any particular venue if EU reach was never part of your strategy.
Worth being honest about this rather than manufacturing urgency that doesn't apply to your specific situation.
How to actually check a venue's status
Check the legal entity, not the brand name. A trading brand is frequently operated by a legal entity with a completely different registered name. Look up the company's actual legal registration before searching any authorization database. Searching the brand name alone can return nothing even when the underlying entity is genuinely authorized, or vice versa.
Confirm the specific service category, not just "authorized" as a yes/no. A venue needs authorization specifically for operating a trading platform to legally run the kind of exchange a token lists on. Custody or advice authorization doesn't cover it.
Use a navigation tool for readability, but verify anything with real stakes against the official register directly. The primary data is a regulator-published register, not a polished interface. Several third-party trackers make it searchable by entity name and country, which is useful for a first pass, but treat the official source as the final word, not a convenient mirror of it.
A pending application does not extend operating rights past the transitional deadline. "We're applying" was a meaningful signal before July 1, 2026. After that date, it isn't. The transitional allowance for previously-operating firms is over, and a pending application doesn't grant a legal basis to keep serving EU clients in the meantime.
Don't assume size or reputation equals authorization, or the reverse. Some widely recognized names in the industry are not currently authorized to operate a trading platform in the EU; some less prominent ones are. There's no shortcut that substitutes for checking the specific entity and category.
Advice
If EU users are part of your strategy, check your target exchange's current authorization status directly against ESMA's public register before applying anywhere. Not from an article, including this one, since status moves month to month.
Don't assume size or reputation equals authorization. Some of the most recognized names in the industry are not currently authorized; some less prominent ones are. There's no shortcut that substitutes for checking.
If a venue is authorized, check whether that authorization is currently unrestricted, not just whether it exists. A license can come with active limitations attached.
Build this into your exchange-selection process as one criterion among several, not a standalone decision. See the fuller framework here.
Revisit before every application, not once. This is the fastest-moving fact in your entire listing decision right now.
Where this comes from: ESMA's public regulatory framework and enforcement timeline, aggregate authorization figures from ESMA's public register, current as of mid-August 2026. Deliberately excludes any exchange-specific status — that changes too fast to responsibly publish in an article, and checking your specific target directly is safer than trusting any snapshot, including this one.