How to actually verify a CASP authorisation in the ESMA register, including the parts that regularly mislead people

After the end of the MiCA transition period, here has been a wave of impersonation using EU regulators and licensed exchanges, and people usually go to ESMA (European Securities and Markets Authority) CASP register to check the legal entity and the services it's authorised to provide. The problem is that the information in the register often won't match what you see in the app or in the message. The brand name may be different from the legal entity, an LEI may be more useful than the name, and some regulators don't issue a separate licence number. Those details can make a legitimate firm look suspicious, or make a fake one look convincing if you don't know what you're looking at.

The name in the register is the legal entity, not necessarily the brand. A crypto platform can operate through a subsidiary or another company that never appears in the app, so searching the name you know and finding nothing doesn't mean the company isn't authorised. If the platform tells you which entity holds its authorisation, the LEI is usually the better identifier to check because it stays tied to that legal entity even when the brand name doesn't.

Licence numbers can be misleading too. There isn't one EU-wide format, and some regulators don't issue a separate number for this authorisation at all. Malta's MFSA doesn't publish a public licence register in the same form, while Austria's FMA doesn't assign a separate reference number for this authorisation. So if an exchange can't give you a "MiCA licence number", that alone doesn't tell you anything. You need to find the legal entity in the regulatory record and check the authorisation attached to it. MiCA also treats custody, exchange for funds, exchange for other crypto-assets, transfers, order execution, portfolio management and advice as separate services. A company can be authorised for some and not others, so a claim that an exchange is "MiCA licensed" doesn't tell you whether the particular service mentioned in a migration message is covered.

Not finding a company in the register can also mean different things. An application might still be pending, a firm might serve EU clients through an authorised partner, or it might not target the EU at all. A firm can also withdraw an application. Binance withdrew its Greek application on 24 June, for example. That's different from a regulator warning that a firm is providing services without authorisation, as the Dutch AFM did with MEXC. Third-party lists often blur these situations together, which is also why their numbers for the total number of authorised CASPs vary. ESMA publishes authorisation records rather than a simple list of unique companies, so one legal entity can have multiple records. The register is updated roughly weekly as well, so any total you see outside ESMA is only a snapshot.

But remember that finding the entity in the register confirms that the company is authorised, but it doesn't confirm that the message you received is genuine. With the migration scams going around now, I'd treat the message as unverified even if the branding and regulatory language look right. Don't use the link in the message to check anything. Open the ESMA register yourself, find the legal entity, match the LEI if it's available, check the services listed under the authorisation, and contact the platform through a channel you already know is genuine.