Answer · confidence: partial

How can US or EU buyers check which crypto firms may legally sell?

Research question: Which regulated crypto firms can a US or EU buyer check to confirm they are legally allowed to sell them coins, and how can they check?

The records name Bitpanda, which received MiCA authorization from Austria's FMA ¹, and list Coinbase, Kraken, OKX and Bybit as major exchanges holding MiCA authorisations ¹⁰. To check, a buyer should confirm the exchange has an entry in the ESMA register rather than relying on a compliance badge ², and should confirm the specific legal entity they contract with, since protections do not extend to affiliates or entities authorised outside the EU ⁶. Since 1 July 2026, providing crypto services to EU clients without a CASP authorisation is illegal ¹⁵, and an old national registration does not count as MiCA authorisation ⁴. The records provide no US registration check; the only US item is FinCEN's order restricting certain transmittals involving Bitzlato ¹¹, so the US part of the question is only partly answered. The newest fact is dated 30 September 2026 ², so the EU information is current as of October 2026.

Checked 2026-10-18. Only documented and supported facts are used.

Dig deeper on this question

Sources

[1] supported

Bitpanda GmbH received MiCA authorization from the Austrian Financial Market Authority (FMA), so it is a regulated crypto firm a European buyer can verify through that regulator.

"Bitpanda GmbH received MiCA authorization from the Austrian Financial Market Authority (FMA)"

Best Crypto Platforms Regulated in Europe in 2026: MiCA Licensed

[2] supported

A MiCA-licensed exchange is one with an entry in the ESMA register, not one that merely displays a compliance badge on its homepage.

"In short, a MiCA licensed exchange is one with an entry in the ESMA register, not one with a compliance badge on its homepage."

MiCA Licensed Crypto Exchanges 2026: Full EU List

[3] supported

Since 1 January 2020, companies in Germany that custody crypto assets for third parties need a permit from BaFin, the German financial regulator.

"Seit dem 1. Januar 2020 bezeichnet der Begriff Kryptoverwahrer in Deutschland Unternehmen, die Kryptowerte (z. B. Bitcoin, Ethereum) für Dritte verwahren oder verwalten. Unternehmen, die diese Dienstleistung anbieten, benötigen seitdem eine Erlaubnis der Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)."

Kryptoverwahrer

[4] supported

An exchange that only cites an old national registration rather than a MiCA CASP licence is not authorised under MiCA.

"If an exchange only references an old national registration rather than a MiCA CASP licence, it isn’t authorised under MiCA."

MiCA-Licensed Binance Alternative (EU)

[5] supported

The European Securities and Markets Authority (ESMA) coordinates the implementation of MiCAR and works with national regulators such as BaFin to ensure consistent application across EU member states.

"Die Europäische Wertpapier- und Marktaufsichtsbehörde (ESMA) koordiniert die Umsetzung von MiCAR und sorgt für eine einheitliche Verwaltungspraxis in allen EU-Mitgliedstaaten."

Kryptoverwahrer

[6] supported

MiCA protections apply only to the specific legal entity authorised in the EU, not to affiliated entities or those authorised outside the EU, so buyers must check which entity they contracted with.

"Crucially, MiCA protections only apply to the specific legal entity authorised in the EU — not to affiliated entities or those authorised outside the European Union — so check carefully which entity you have contracted with."

MiCA Licensed Crypto Exchanges 2026: Full EU List

[7] supported

The first German BaFin licences for crypto custody were granted in summer 2021.

"Im Sommer 2021 hat die BaFin die ersten Lizenzen im Bereich Kryptoverwahrung erteilt."

Kryptoverwahrer

[8] documented

The document says Bitzlato's services could be used by legitimate actors, but comparable services may be found at other virtual asset service providers, including those in jurisdictions with robust AML/CFT frameworks and regulatory oversight.

"Although Bitzlato offers services that could potentially be used by licit actors, those services may be found other VASPs, including VASPs located in jurisdictions with robust AML/CFT frameworks and regulatory oversight."

Imposition of Special Measure Prohibiting the Transmittal of Funds Involving Bitzlato (Treasury Department, Financial Crimes Enforcement Network, 2023-01-23)

[9] supported

Several firms have obtained MiCA authorisation in 2025 and 2026, including Bitpanda, which received its licence from Germany's BaFin in January 2025.

"Several firms obtained MiCA authorisation in 2025 and 2026, including Bitpanda from Germany's BaFin in January 2025"

Markets in Crypto-Assets

[10] supported

Coinbase, Kraken, OKX and Bybit are named as major exchanges that hold MiCA authorisations.

"Major exchanges including Coinbase, Kraken, OKX and Bybit hold authorisations."

MiCA CASP Authorisation After the Transition Period

[11] documented

FinCEN's order prohibits certain transmittals of funds involving Bitzlato by covered financial institutions and by any domestic financial institution.

"prohibits certain transmittals of funds by any domestic financial institution or involving Bitzlato by any covered financial institution."

Imposition of Special Measure Prohibiting the Transmittal of Funds Involving Bitzlato (Treasury Department, Financial Crimes Enforcement Network, 2023-01-23)

[12] supported

Since 1 July 2026, anyone serving EU clients without a MiCA licence is in breach of EU law and must stop, so a firm without authorisation is not legally permitted to sell to EU buyers.

"from 1 July 2026 anyone serving EU clients without a MiCA licence is in breach of EU law and must stop"

MiCA CASP Authorisation After the Transition Period

[13] supported

ESMA stated that any entity providing crypto-asset services to EU clients without a MiCA licence after the transitional period would be in breach of EU law.

"ESMA said any entity providing crypto-asset services to EU clients without a MiCA license after that date would be in breach of EU law"

Markets in Crypto-Assets

[14] supported

A firm can be authorised as a CASP, or, if it is a bank, investment firm or similar regulated firm, can notify its regulator instead of applying for full authorisation.

"Firms providing any of MiCA's ten crypto-asset services to EU clients now need authorisation as a CASP under Article 63 — or, for banks, investment firms and certain other regulated firms, a notification to their regulator at least 40 working days in advance under Article 60."

MiCA CASP Authorisation After the Transition Period

[15] supported

After the transition ended on 1 July 2026, providing crypto-asset services in the EU/EEA without a CASP authorisation is illegal, and providers whose authorisation ended or who ESMA flagged as non-compliant fall outside it.

"With the transition ending on 1 July 2026, providing crypto-asset services in the EU/EEA without a CASP authorisation is illegal."

MiCA CASP Register: The Full License List for the EU