MiCA after the transitional period: checking a provider in the registers.

What ended on June 30, 2026

Lesson 3.7.5 explains MiCA (Regulation (EU) 2023/1114): what it regulates, its services, the capital of providers and the transitional regime of Article 143(3), which allowed those already operating under national law to continue until July 1, 2026 or until they were granted or refused authorization. Spain chose the maximum period. The course syllabus says the period ended on July 1; the CNMV makes it precise in its communication of June 15, 202611Note 1 · CNMV, “Comunicado sobre el fin del periodo transitorio del Reglamento MiCA” (communication on the end of the MiCA Regulation transitional period, in Spanish), June 15, 2026, cnmv.es, and Regulation (EU) 2023/1114, Article 143(3), EUR-Lex. (unofficial translation):

The transitional period of application of Regulation (EU) 2023/1114 […] ends on June 30, 2026 for those crypto-asset service providers that have benefited from that period. This means that, from that date, only providers that have obtained the necessary authorization may operate in Spain.

June 30 was the last day of the transition and July 1 the first of full application. The communication adds three practical points (the quotations are unofficial translations). Providers that were not going to obtain authorization had to have “an effective migration plan for their clients” allowing them to move the crypto-assets held in custody to other addresses and the funds to cash accounts, or to accept the transfer to another authorized provider. That plan sets “a reasonable withdrawal period” and, when it ends, whatever has not been withdrawn may be transferred to authorized entities. And the CNMV recommends that investors check in the ESMA and CNMV registers whether their provider is authorized and, if not, “require it to provide the migration plan and the options offered”.

ESMA published a statement for the whole Union on June 2322Note 2 · ESMA, “ESMA calls on unauthorised crypto-asset service providers to wind down orderly, while also safeguarding clients' interests, as MiCA transitional period ends”, ESMA75-113276571-1710, June 23, 2026, esma.europa.eu.. Unauthorized providers must “immediately stop onboarding new EU clients”, drop marketing and solicitation, limit their services to what is needed to sell, transfer or close positions, keep custody only for as long as “strictly necessary” for the exit and tell clients of a deadline after which residual positions would be closed automatically. It reminds clients that they do not have MiCA's protections and invites them to move their crypto-assets to an authorized CASP or to a self-custody wallet. Non-EU firms cannot provide services to EU clients or solicit them, except at the client's own exclusive initiative.

flowchart TB
  P[My provider] --> R{In the register?}
  R -- yes --> S{Service and ES?}
  S -- yes --> OK[Trade and monitor]
  S -- no --> M[Migration plan]
  R -- no --> M
  M --> T[Authorized CASP]
  M --> W[Self-custody wallet]

Two registers that do not say the same thing

The CNMV maintains a search page for crypto-asset service providers: it is an alphabetical list of names, with no dates, services or regime, that expressly refers to ESMA's official register33Note 3 · CNMV, “Proveedores de servicios de criptoactivos” (crypto-asset service providers), official register search, cnmv.es, accessed October 23, 2026.. The ESMA register, for its part, is still interim: five CSV files that ESMA says it publishes “on weekly intervals” until they are integrated into its systems44Note 4 · ESMA, MiCA page, interim register section, esma.europa.eu, and CASPS.csv and NCASP.csv, downloaded on October 23, 2026; LEI status from the GLEIF API, queried the same day.. The provider file (CASPS.csv) has one row per entity and authorization, with the authority, the home Member State, the legal name and LEI, the commercial name, the website, the date of authorization or notification and of withdrawal, the services and the passport Member States; NCASP.csv lists entities that provide services without complying with the regulation. Lesson 3.7.5 explains how to read and clean them.

The version downloaded on October 23, 2026 (most recent update date of its rows: October 20) has 387 entries from 384 distinct LEIs. Sixteen have Spain as home Member State: 6 credit institutions that notified under Article 60 and 10 authorized as CASPs under Article 63. The figure at the top accumulates them by date: on July 1 there were 12, four of them authorized in the last two weeks of June, and four more have been added since. What matters most to a client in Spain, however, is another column: 211 entries have Spain in their passport, most of them authorized in other Member States. And NCASP.csv gathers 178 non-compliant entities, 169 of them reported by Italy.

The register also has errors. Its LEIs are the best field for cross-checking sources, but not all of them can be used as they are:

Diagnosing a LEI before cross-checking

A LEI (ISO 17442) has 20 alphanumeric characters and two final check digits that satisfy the ISO 7064 MOD 97-10 standard, as lesson 3.7.5 explains. In the real register, 371 of 387 entries satisfy it as is, 7 satisfy it after removing spaces, tabs or a trailing period, and 9 do not satisfy it in any way: seven have 20 characters but fail the check, one has 19 and another 21. A cross-check that does not normalize loses the first 7 for no reason; one that “corrects” blindly can invent a LEI. The following function diagnoses instead of correcting, with fictitious LEIs that reproduce those defects:

import hashlib
import io
import re
from difflib import SequenceMatcher
from urllib.parse import urlparse

import pandas as pd

def control_ok(lei):
    return int("".join(str(int(c, 36)) for c in lei)) % 97 == 1

def con_control(base18):
    n = int("".join(str(int(c, 36)) for c in base18 + "00"))
    return base18 + f"{98 - n % 97:02d}"

def diagnostico(bruto):
    """Returns (status, normalized LEI). Corrects nothing."""
    if not isinstance(bruto, str) or not bruto.strip():
        return "empty", None
    lei = bruto.strip().rstrip(".").upper()
    if len(lei) != 20:
        return f"length {len(lei)}", lei
    if not re.fullmatch(r"[0-9A-Z]{18}[0-9]{2}", lei):
        return "characters", lei
    if not control_ok(lei):
        return "check digits", lei
    return ("valid" if lei == bruto else "valid after cleaning"), lei

BRISA = con_control("529900BRISADIGITO0")
casos = [BRISA, f" {BRISA}", f"\t{BRISA}", f"{BRISA}.", BRISA[:-1],
         BRISA + "7", BRISA.replace("O", "0"), None]
for c in casos:
    print(f"{c!r:<26} {diagnostico(c)[0]}")

'529900BRISADIGITO075'     valid
' 529900BRISADIGITO075'    valid after cleaning
'\t529900BRISADIGITO075'   valid after cleaning
'529900BRISADIGITO075.'    valid after cleaning
'529900BRISADIGITO07'      length 19
'529900BRISADIGITO0757'    length 21
'529900BRISADIGIT0075'     check digits
None                       empty

The LEI with the O changed to a zero has the right length and only allowed characters, but fails the check: it is the kind of typo that cannot be seen at a glance. Can it be repaired? Trying the usual substitutions (O and 0, I and

1. yields candidates that pass the check, but with a two-digit check, any change has about a one in 97 chance of passing it by chance:

CONFUSIONES = {"O": "0", "0": "O", "I": "1", "1": "I"}

def candidatos(lei):
    salida = set()
    for i, c in enumerate(lei[:18]):
        if c in CONFUSIONES:
            prueba = lei[:i] + CONFUSIONES[c] + lei[i + 1:]
            if control_ok(prueba):
                salida.add(prueba)
    return sorted(salida)

errata = BRISA.replace("O", "0")
print(errata, "->", candidatos(errata))
print("is the true one there?", BRISA in candidatos(errata))

529900BRISADIGIT0075 -> ['529900BRISADIG1T0075', '529900BRISADIGITO075']
is the true one there? True

There are two candidates: the true one, with the O restored, and another that changes the I of “DIGIT” to a 1 and passes the check by chance. Without another source there is no way to know which one is right. A candidate that passes the check is only a clue to be confirmed in GLEIF, the foundation that publishes the LEI database with a public API. The query is not run here because it needs a network:

import json
import urllib.request

def estado_gleif(leis):
    url = ("https://api.gleif.org/api/v1/lei-records?page[size]=100"
           "&filter[lei]=" + ",".join(leis))
    with urllib.request.urlopen(url, timeout=30) as r:
        datos = json.load(r)["data"]
    return {d["attributes"]["lei"]: (
                d["attributes"]["entity"]["legalName"]["name"],
                d["attributes"]["registration"]["status"])
            for d in datos}

With the register's 375 distinct valid LEIs, queried on October 23, 2026, GLEIF returns 371 with a current registration (ISSUED), 3 lapsed (LAPSED, not renewed) and 1 retired (RETIRED, with the entity inactive). A lapsed LEI does not mean the authorization has ended, but it is an inconsistency worth explaining; one retired in GLEIF and current in the ESMA register calls for a query to the authority.

Checking the provider you trade with

The most frequent mistake is not trading with an entity that appears in no register, but trading with another entity of a brand that does appear. The CNMV warns about it on its MiCA page: you have to confirm which legal entity provides the service, because MiCA's protections only apply to the entity authorized in the EU, not to other group companies or to non-EU entities55Note 5 · CNMV, “MiCA: Nueva regulación de criptoactivos” (MiCA: new crypto-asset regulation, in Spanish), cnmv.es, accessed October 23, 2026.. That is why the check starts from the details of the contract and the web address in use, not from the commercial name. A fictitious extract in the register's format and another from the list of non-compliant entities:

CEFIRO = con_control("5299009CEFIRO0CRYP")
DUNA = con_control("9695009DUNA0EXCHAN")
CASPS = f"""ae_homeMemberState,ae_lei_name,ae_lei,ae_commercial_name,\
ae_website,ae_website_platform,ac_authorisationEndDate,\
ac_serviceCode,ac_serviceCode_cou
MT,Brisa Digital Europe Ltd,{BRISA},Brisa,https://www.brisa.example,\
https://app.brisa.example,,a. custody | b. operation of a trading \
platform | c. exchange for funds,AT|DE|ES|FR|IT
DE,Cefiro Krypto GmbH,{CEFIRO},Cefiro,https://cefiro.example,,,\
e. execution of orders | g. reception and transmission,DE|AT
FR,Duna Exchange SAS,{DUNA},Duna,https://duna.example,,15/09/2026,\
a. custody | c. exchange for funds,FR|ES|PT
"""
NCASP = """ae_commercial_name,ae_website
Brisa Cripto Pro,https://brisa-cripto.example
Icaro Trade,https://icaro.example
"""
reg = pd.read_csv(io.StringIO(CASPS), dtype=str)
ncasp = pd.read_csv(io.StringIO(NCASP), dtype=str)
reg[["ae_commercial_name", "ae_website", "ac_authorisationEndDate"]]

  ae_commercial_name                 ae_website ac_authorisationEndDate
0              Brisa  https://www.brisa.example                     NaN
1             Cefiro     https://cefiro.example                     NaN
2               Duna       https://duna.example              15/09/2026

The checking function puts the questions in order: the contract's LEI is in the register and its legal name matches the signing entity, the domain in use is one of those registered, the authorization has no withdrawal date, the services cover what you are going to do, Spain is in the passport (or is the home Member State) and the domain is not on the non-compliant list:

def dominio(url):
    host = urlparse(url if "//" in url else "//" + url).hostname or ""
    return ".".join(host.removeprefix("www.").split(".")[-2:])

def parecido(a, b):
    return SequenceMatcher(None, a.lower(), b.lower()).ratio()

def comprobar(contrato, necesito, dia="2026-10-23", pais="ES"):
    fila = reg[reg["ae_lei"].map(lambda x: diagnostico(x)[1])
               == diagnostico(contrato["lei"])[1]]
    r = {"LEI in register": not fila.empty}
    if not fila.empty:
        f = fila.iloc[0]
        r["contract entity"] = (
            parecido(f["ae_lei_name"], contrato["entidad"]) > 0.9)
        webs = {dominio(w) for w in (f["ae_website"],
                f["ae_website_platform"]) if isinstance(w, str)}
        r["registered domain"] = dominio(contrato["web"]) in webs
        fin = pd.to_datetime(f["ac_authorisationEndDate"],
                             format="%d/%m/%Y")
        r["not withdrawn"] = pd.isna(fin) or fin > pd.Timestamp(dia)
        letras = set(re.findall(r"\b([a-j])\.", f["ac_serviceCode"]))
        r["services " + necesito] = set(necesito) <= letras
        r[f"passport {pais}"] = (
            pais == f["ae_homeMemberState"]
            or pais in f["ac_serviceCode_cou"].split("|"))
    r["not non-compliant"] = dominio(contrato["web"]) not in {
        dominio(w) for w in ncasp["ae_website"]}
    return r

contratos = {
    "Brisa, correct contract": dict(
        entidad="Brisa Digital Europe Ltd", lei=f" {BRISA}",
        web="https://app.brisa.example"),
    "Brisa, group company": dict(
        entidad="Brisa Global Ltd", lei=f" {BRISA}",
        web="https://brisa-cripto.example"),
    "Cefiro": dict(entidad="Cefiro Krypto GmbH", lei=CEFIRO,
                   web="cefiro.example"),
    "Duna": dict(entidad="Duna Exchange SAS", lei=DUNA,
                 web="https://duna.example"),
}
for nombre, c in contratos.items():
    fallos = [k for k, ok in comprobar(c, "abc").items() if not ok]
    print(f"{nombre:<26} {'OK' if not fallos else 'NO'} {fallos}")

Brisa, correct contract    OK []
Brisa, group company       NO ['contract entity', 'registered domain', 'not non-compliant']
Cefiro                     NO ['services abc', 'passport ES']
Duna                       NO ['not withdrawn', 'services abc']

The correct contract passes everything, even though the LEI comes with a leading space: normalization avoids a false negative. The second uses the same brand and the same copied LEI, but it is signed by another company, on a domain that is not in the register and that belongs to an entity on the non-compliant list: it is the pattern of a clone or of a group entity outside MiCA. Cefiro is authorized, but for execution and transmission of orders and only with a passport to Germany and Austria. Duna has custody, exchange and a passport to Spain, but does not operate a trading platform (b) and, above all, its authorization was withdrawn on September 15.

The services to ask for depend on the use. To trade by API on an exchange that holds the funds in custody, the trading platform (b) and custody (a); to buy and sell against euros, exchange for funds (c); for a broker that routes orders elsewhere, execution or reception and transmission (e, g). Perpetuals and other derivatives are not MiCA services (lesson 3.7.5).

Monitoring changes in the register

A check on the opening date says nothing about the following week. Since ESMA publishes weekly versions, the practical approach is to store each version with its date and its hash, and to compare those of the providers in use:

flowchart LR
  D[Weekly download] --> H[Hash and archive]
  H --> C[Differences]
  C --> A[Own alerts]

Two fictitious versions of the extract, one week apart:

def instantanea(texto, fecha):
    df = pd.read_csv(io.StringIO(texto), dtype=str)
    df["lei"] = df["ae_lei"].map(lambda x: diagnostico(x)[1])
    sha = hashlib.sha256(texto.encode()).hexdigest()[:12]
    return {"fecha": fecha, "sha256": sha, "df": df.set_index("lei")}

semana_42 = CASPS.replace(",15/09/2026,", ",,")    # without the withdrawal
semana_43 = (CASPS.replace("AT|DE|ES|FR|IT", "AT|DE|FR|IT")
             .replace("e. execution of orders |",
                      "c. exchange for funds | e. execution of "
                      "orders |"))
a = instantanea(semana_42, "2026-10-12")
b = instantanea(semana_43, "2026-10-19")

def cambios(a, b, campos=("ac_authorisationEndDate", "ac_serviceCode",
                          "ac_serviceCode_cou")):
    filas = []
    for lei in sorted(set(a["df"].index) | set(b["df"].index)):
        if lei not in b["df"].index:
            filas.append((lei, "removed from register", "", ""))
            continue
        if lei not in a["df"].index:
            filas.append((lei, "added to register", "", ""))
            continue
        for c in campos:
            x, y = a["df"].at[lei, c], b["df"].at[lei, c]
            if str(x) != str(y):
                filas.append((lei, c, x, y))
    return pd.DataFrame(filas, columns=["lei", "campo", "antes",
                                        "ahora"])

print(a["fecha"], a["sha256"], "|", b["fecha"], b["sha256"])
for f in cambios(a, b).itertuples():
    print(f"{f.lei} {f.campo}\n  before: {f.antes}\n  now: {f.ahora}")

2026-10-12 a2d1f50d3791 | 2026-10-19 5056eb308cb5
5299009CEFIRO0CRYP44 ac_serviceCode
  before: e. execution of orders | g. reception and transmission
  now: c. exchange for funds | e. execution of orders | g. reception and transmission
529900BRISADIGITO075 ac_serviceCode_cou
  before: AT|DE|ES|FR|IT
  now: AT|DE|FR|IT
9695009DUNA0EXCHAN38 ac_authorisationEndDate
  before: nan
  now: 15/09/2026

In one week, Brisa has lost Spain from its passport, Cefiro has added exchange for funds and Duna has a withdrawal date. The hashes make it possible to prove later which version was checked and when. For a system that trades through several providers, the next step is to filter the changes by your own LEIs and raise an alert when they affect what is in use:

MIOS = {BRISA: ("abc", "ES"), DUNA: ("ac", "ES")}

def avisos(a, b, mios=MIOS):
    salida = []
    for lei, (servicios, pais) in mios.items():
        f = b["df"].loc[lei]
        if isinstance(f["ac_authorisationEndDate"], str):
            salida.append((lei, "authorization withdrawn on "
                           + f["ac_authorisationEndDate"]))
        if pais not in f["ac_serviceCode_cou"].split("|") \
                and pais != f["ae_homeMemberState"]:
            salida.append((lei, f"no passport for {pais}"))
    return salida

for lei, texto in avisos(a, b):
    print(reg.set_index("ae_lei").at[lei, "ae_commercial_name"],
          "->", texto)

Brisa -> no passport for ES
Duna -> authorization withdrawn on 15/09/2026

Both of your own providers raise an alert: one can no longer provide services in Spain with that authorization and the other has lost it. What to do next is not decided by the code: read the provider's communication, ask it for the migration plan (as the CNMV recommends) and move the assets in time. A weekly scheduled task with this comparison fits into lesson 4.5.4.

Red flags that do not show in the register

A register says who is authorized; it does not say who is impersonating an authorized entity or how a provider behaves. The CNMV guide on chiringuitos financieros (its term for unauthorized firms) and ESMA's guidelines on reverse solicitation give the clues66Note 6 · CNMV, “Chiringuitos financieros” (guide to unauthorized investment firms, in Spanish), sections V to VII and final tips, cnmv.es.77Note 7 · ESMA, “Final Report on the guidelines on reverse solicitation under the Markets in Crypto Assets Regulation (MiCA)”, ESMA35-1872330276-1899, December 17, 2024, guidelines 1 to 3 and annex, esma.europa.eu.:

The CNMV also points out that not appearing on its warning list does not mean being authorized: the irregular activity may not have been detected yet⁶. The only positive check is the register one, with the contracting entity.

Exercises

1. In week 44, Cefiro extends its passport to Spain and Brisa gets it back. Create that version from semana_43, compare it with it and compute the alerts for a system that uses Brisa (abc) and Cefiro (ce) in Spain.

semana_44 = (semana_43.replace("AT|DE|FR|IT", "AT|DE|ES|FR|IT")
             .replace(",DE|AT\n", ",DE|AT|ES\n"))
c = instantanea(semana_44, "2026-10-26")
print(cambios(b, c).to_string(index=False))
print(avisos(b, c, {BRISA: ("abc", "ES"), CEFIRO: ("ce", "ES")}))

                 lei              campo       antes          ahora
5299009CEFIRO0CRYP44 ac_serviceCode_cou       DE|AT       DE|AT|ES
529900BRISADIGITO075 ac_serviceCode_cou AT|DE|FR|IT AT|DE|ES|FR|IT
[]

2. Generate 1,000 valid fictitious LEIs, introduce a random typo in each one (any character changed to another) and count in how many cases the candidatos function proposes some LEI and in how many it proposes the true one.

import numpy as np

rng = np.random.default_rng(44)
ALFA = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"
con_propuesta = con_verdadero = 0
for _ in range(1000):
    base = "".join(rng.choice(list(ALFA), 18))
    verdadero = con_control(base)
    i = int(rng.integers(18))
    nuevo = rng.choice([x for x in ALFA if x != verdadero[i]])
    errata = verdadero[:i] + nuevo + verdadero[i + 1:]
    props = candidatos(errata)
    con_propuesta += bool(props)
    con_verdadero += verdadero in props
print(con_propuesta, con_verdadero)

22 4

3. An exchange based outside the EU writes to you on Telegram in Spanish, offers you a 20% bonus on the first deposit and says it can serve you because you contacted it first. List what you would check and why.