Where the data comes from
The basis is the register ESMA maintains under Art. 109 MiCAR and publishes as a CSV. The German entries are taken from it, meaning those for which BaFin is the competent authority. At the time of retrieval the register held 346 authorisations from across the EEA, including Iceland, Liechtenstein and Norway; 89 of them are German. Those 89 authorisations belong to 86 firms: three hold two entries each, differing in date and in services, which suggests a service added later is filed as a new row rather than as an edit to the existing one.
What was normalised, and why
The services appear in the ESMA register as free text, and that text is not uniform. One German entry, that of Bankhaus Scheich Wertpapierspezialist AG, carries its letters shifted by one position throughout: placing appears there as e. rather than f., advice as g. rather than h., portfolio management as h. rather than i., exchange for other crypto-assets as c. rather than d. It is the only entry in the whole register with that shift, but one is enough to make any analysis keyed on the letters unusable.
On top of that come formatting faults: two entries separate their services with a capital I instead of the pipe, one with a comma, two end on a stray period or semicolon, and one spells "crypto assets" without the hyphen. Each harmless on its own, together enough to break any naive split of the field.
For this page the letters are therefore ignored. Each service is recognised by its text and re-lettered a to j according to the list in Art. 3(1)(16) MiCAR. That list has been checked letter by letter against the regulation as printed in the Official Journal (OJ L 150, 9.6.2023, p. 64), not against a secondary rendering, and each of the ten letters matches exactly one service, so the mapping is unambiguous. Anyone wanting to reproduce or dispute it will find the rules in the open in the generating script; the result is available as CSV and JSON, and the raw file sits unchanged at ESMA.
Left untouched: legal name, address, LEI, website, countries and authorisation date. For the three firms with two entries, the services of both rows are merged and the earlier of the two dates is kept as the first authorisation.
How to read the columns
The "Countries" column counts the states in which the firm may provide its services, and always includes Germany itself. A 1 therefore means domestic only, not "one passport". 70 of the 86 firms are authorised domestically only.
The "Authorised" column reproduces the date the register carries as the authorisation notification date. One entry, Volksbank Baumberge eG, carries a date lying in the future there. We reproduce the register as it stands and do not correct it.
What the register does not show
Two limits belong with this. First, the list is a snapshot: authorisations keep being granted, at an uneven pace, and the total has grown since MiCAR began to apply. Second, and more important for tax questions, the set of providers authorised under MiCAR is not the same as the set obliged to report under DAC8. Directive (EU) 2023/2226 covers, alongside providers authorised under Art. 63 MiCAR, crypto-asset operators without a MiCAR authorisation that are resident, incorporated, managed or regularly doing business in a Member State; together the two are its reporting providers. This list is therefore a floor, not a total of reporting entities.
Why we maintain this
Stablewerk builds tools for the tax treatment of crypto-assets in German books, including the path to DAC8 reporting. The firms listed here are a large part of that duty's addressees, which is why we maintain the register anyway. Keeping it public and machine-readable costs us little and spares everyone else the same clean-up.
The underlying data is not ours. It comes from ESMA and is reproduced under ESMA's terms of use, which permit reproduction provided the source is acknowledged. If you reuse it, please credit ESMA as the source and this page as the preparation, and observe ESMA's own conditions.
Found an error, or a missing authorisation? Write to us and we will check and correct it.
Source: ESMA register of crypto-asset service providers (Art. 109 MiCAR). Register as of 08/09/2026, retrieved and prepared on 09/09/2026. Competent authority for the German entries: Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin). This document has been drafted using material downloaded from ESMA's website. ESMA does not endorse this publication and accepts no liability for it. The binding authorisation status of a firm is the one held in the registers of ESMA and BaFin alone. This page is not legal or tax advice.