Checking a MiCA licence: ESMA's CSVs against two trackers that repackage them

Before money moves into an EEA account, one question outranks every fee comparison: does the legal entity on your terms of service hold a MiCA authorisation, and for which services? The authoritative answer is a set of spreadsheets. This reviews those and two web tools built on them — not a survey of the field: we did not go looking for every tracker, and nothing here says only two exist.

The file

Two trackers, two numbers

Start with the disagreement; it is the review. CASP Tracker counts 331 licensed providers and stamps that count 2 September 2026. Outrun Advisory’s MiCAR dashboard counts 333 firms and dates its snapshot 21 August. Same register, two totals, and neither party is being careless.

CASP Tracker’s methodology page says that when ESMA re-lists the same legal entity under the same LEI after an authorisation is extended — the examples it gives are DekaBank and EUWAX; the file holds four such pairs — it merges those rows into one. A tracker that collapses re-listings runs below a raw row count by construction. The source is the same, too: both work from the 21 August 2026 ESMA file — 335 rows, 330 distinct LEIs — and CASP Tracker’s 22 August stamp is its own ingest date, not a newer register. Merge the four re-listings and you get 331; drop the two rows with an authorisation end date, as Outrun appears to, and you get 333. That points at method, not lag.

The country figures need unpacking: CASP Tracker’s 30 counts EU/EEA markets covered and its 26 counts national regulators; Outrun’s headline says 27 EEA countries, but its own body text says 26 with at least one CASP authorisation, matching the ESMA file’s home-member-state column.

And it is still the interim register. ESMA’s MiCA page says the CSV collection runs “until mid-2026”, when it is to be folded into ESMA’s IT systems — a handover the page’s own 21 August 2026 stamp has outlived.

What the trackers actually add

The ESMA CSV is not thin. Its header carries the legal entity name and LEI, the commercial name, home member state, competent authority, address and website, the authorisation notification and end dates, and the service codes with their country codes. A tool that claims the LEI as its own contribution is describing a column ESMA already publishes.

What CASP Tracker adds, per its methodology page, is national company register numbers and each regulator’s own MiCA reference number, researched country by country — identifiers the CSV does not carry — plus search in seven languages and cleaned datasets published to a repository whose commit history it calls a changelog of the ESMA registers. It also describes cleaning defects in encoding, country codes and website fields without ever altering a fact — the useful admission that the source of record is authoritative and untidy at once.

Outrun adds what the file does not carry — firm type, group structure, parent origin — and labels them; its country cut is a pivot of a column ESMA already publishes. The crypto-native versus traditional-finance split is, in the dashboard’s own words, an interpretive overlay by Jamie Brew, and MiCA defines no such split. Origin and parent-company data are flagged there as best-effort research.

What neither one is

Neither is official, and both say so plainly. CASP Tracker states it is not affiliated with ESMA, the European Commission or any national regulator, and calls itself a friendlier view of public data, not an official register. Both attach the warning that matters, Outrun’s wording the fuller: absence from its dataset does not confirm a firm has been refused authorisation — an application may be in progress, or the status may have changed after the snapshot date. A name you cannot find is a fact about one file on one date, not a finding about a company.

The reverse trap is quieter. A hit is not proof of current authorisation either. ESMA’s page states that where a competent authority withdraws an authorisation, the record stays in the publication with the date the withdrawal took effect, and the CSV carries an authorisation-end-date column for exactly that. Read the column, not the badge.

The two columns

Verdict

A tracker tells you where to look; the register tells you what was true the day it was published. And the string that has to match is the legal entity on your own paperwork, not the brand on the homepage — a group can hold an authorisation through one subsidiary and serve you through another, the same structural point we made about the FCA authorisation era on the other side of the Channel.

One last thing. A licence is a supervision regime, not a safety rating; an authorised venue can still halt withdrawals or fail. Nothing here is advice, the assets stay high-risk with or without a green tick, and the checking is yours before the transfer.