Platforms · Software · Providers · Markets
CONSOB supplied 179 of the 188 records in ESMA's register of crypto firms that national supervisors say serve clients without authorisation. Authorities in four other countries provided the remaining nine, so banks, payment firms and brokers screening against the file are drawing on submissions from only five of the 30 European Economic Area (EEA) states.
Italy's regulator drives submissions
ESMA maintains the register under the Markets in Crypto-Assets Regulation (MiCA), whose transition period for providers without a licence ended on July 1. CONSOB has been directing internet providers to block unauthorised financial websites since 2019. Its count stood at 1,861 sites on October 29, including 250 linked to crypto-assets, the regulator said.
FM Intelligence's analysis suggests a supervisor already accustomed to identifying large numbers of web domains may have a simpler route to forwarding those records to ESMA. The figures come from its review of ESMA's October 29 file.
National warning systems diverge
Germany has 119 authorised or notified providers on ESMA's register, more than any other member state, as it did when FM Intelligence reviewed the data in August. Most are banks and investment firms notified under MiCA. Yet Germany has submitted no record to the non-compliant list. BaFin published 245 consumer warnings in 2026 to November 3, of which 89 refer to crypto services, according to FM Intelligence's Fines & Warnings Tracker.
France's AMF said on October 19 that its blacklist had gained 64 crypto names since January. CySEC referred to MiCA's Article 59 in warnings on its website in September and again in October.
Neither authority appears in the ESMA file. Belgium's Financial Services and Markets Authority submitted six records; the Czech, Dutch and Slovak authorities submitted one apiece, leaving 25 EEA states without an entry.
Article 110 of MiCA describes the register as non-exhaustive and specifies what an entry must contain, but it gives national supervisors neither a filing obligation nor a deadline. Some German and French warnings concern combined investment and crypto offers that may be covered by national banking or securities rules. FM Intelligence therefore reads Germany's empty ESMA record as evidence of a separate reporting route, not proof that unlicensed crypto offers are absent.
What to watch next
For counterparty-screening operations, the register should be treated as one source of warnings, not a complete view of authorisation status. A negative search result cannot establish that a firm is authorised when national submissions are optional and the register is explicitly incomplete.
Teams responsible for screening should check which national notices are included in their current process, how records from different authorities are reconciled, and whether the fields in ESMA's entries are sufficient for matching counterparties. The source analysis says a detail in the 188 entries limits their screening value, but does not specify that detail in its account. Operators should also ask how they will identify gaps between the ESMA file and national warning channels, and who will review those gaps as new notices appear.
The analysis projects the register's size by June 30, 2027, when the European Commission is due to report on MiCA. EU finance ministers agreed on October 9 to restrict ESMA's direct oversight to the largest cross-border providers, scaling back the European Commission's proposal to place all crypto firms under the Paris-based authority. A BaFin executive director warned in September that firms select Europe's weakest supervisor before expanding across the bloc. The full FM Intelligence analysis, reported by Finance Magnates, also notes that ESMA has made no entry of its own.
