To check whether a crypto licence is real, look the legal entity up in the regulator's own register, not at the certificate you were sent. Then read the status, because several official lists contain firms that are not licensed: Hong Kong's applicant list, Singapore's exemption list, and the UK register, which covers firms that "are, or have been, authorised by us or the PRA".
Three official lists whose entries are not licences
This runs in two directions: you are checking a counterparty — an exchange partner, a payments provider, an adviser, a licensed company you are about to buy — or someone is checking you, when a bank opens an account or a client runs diligence. Same registers, same reading. Our own details sit on entity proof; the diligence checklist for buying a licensed entity is in is buying a ready-made licence worth it.
Four things to hold on to
- A name on an official list is not a licence. The Hong Kong SFC publishes a separate applicant list and states that everyone on it is not licensed, including the deemed-to-be-licensed platforms.
- Protection attaches to one legal entity, not to the group and not to the brand.
- Registers lag. ESMA republishes "on weekly intervals"; FINMA's data is refreshed "usually within two to five working days". Nothing found can simply mean not yet published.
- A register entry is not an endorsement. ESMA says the white papers it lists "have not been reviewed or approved by any competent authority in any Member State of the European Union", and the SFC says publication "does not guarantee the performance or creditworthiness of any SFC-licensed virtual asset trading platform".
Ask for five things before you open a single register
- The full legal name, not the brand
- The country of registration
- The regulator's name
- The licence or registration number
- The specific permitted activities
Miss one and the result proves nothing. Insist on the legal name, because ESMA warns that "they may operate under the same brand across multiple companies or countries" and tells readers to "Review your contract carefully to confirm which entity is actually providing your service". A brand is a marketing asset; a licence belongs to a company. Terms sit in the glossary. And do not click the lookup link the firm sends you.
Where each crypto licence is actually checked
The five registers differ in shape more than people expect. MiCA Articles 109 and 110 require ESMA to publish a central register of white papers, authorised crypto-asset service providers and non-compliant entities, populated by the national competent authorities and the EBA — and to meet the deadline it is still published as a collection of csv files rather than a searchable database.
Five registers: where to look, and what people misread
| Jurisdiction | Where to look | What people misread |
|---|---|---|
| EU | ESMA's interim MiCA register (five csv files) | Republished weekly; a withdrawn authorisation stays in the file with its effective date |
| Switzerland | FINMA's SRO member search, not the SRO's own website | People search the SRO's own site, and paste the full legal name the search asks you to strip |
| Hong Kong | The SFC's four lists: licensed, applicants, refused or withdrawn, closing down | Applicant and deemed-to-be-licensed are not licensed |
| Singapore | MAS's Financial Institutions Directory | The exemption list is a different list, and not a licensed list |
| UK | The FCA's Financial Services Register | It covers firms that used to be authorised, and unauthorised firms too |
Why a firm can be on the list and still not be licensed
Because a regulator publishes more than one list, and they mean different things in law. Hong Kong's applicant list exists, in the SFC's own words, so that any member of the public can check whether a platform has made "untrue or misleading misrepresentations regarding its licence application status" with the regulator.
All VATP applicants on this list are NOT licensed by the SFC, and may NOT be in compliance with the SFC's requirements. It should also be noted that the SFC has NOT formally licensed the deemed-to-be-licensed VATP applicants.Hong Kong SFC, List of virtual asset trading platform applicants
Singapore has the same trap in a different shape. Its exemption list covers firms operating under a temporary exemption while their applications are reviewed, and MAS states they are "neither licensed under the PS Act to provide the specific payment services, nor at any time supervised or regulated by MAS". For the licensed population, MAS points you to the Financial Institutions Directory. Two further Hong Kong lists matter before you buy an entity: applications "returned, refused or withdrawn" have a list of their own, and a platform told to close may act only "solely for the purpose of closing down their businesses".
Three things to read once you have found the entry
Read the entry for three things, in order. The entity: protection attaches to one authorised company, not its group or its brand. The scope: the permission must cover the service you are buying. The timing: read the status and the dates, because a withdrawn authorisation stays on the record.
MiCA protections only apply to the specific authorised legal entity in the EU - not to other companies of the same group, and not to non-EU entities.ESMA, Statement on the End of Transitional Periods under MiCA, 17 April 2026
The scope. A UK appointed representative trades on another firm's permission, and the FCA warns that if it steps outside what its principal allows, "you may not be protected by the Financial Ombudsman Service or the Financial Services Compensation Scheme (FSCS) if something goes wrong". An entry can be accurate and still not cover the service you are buying — and the same register carries firms impersonating genuine ones, "known as a clone firm".
The timing. In the EU, when an authorisation is withdrawn, "this record will remain in the publication with the information on the date in which this withdrawal was effective" — so appearing in the register is not proof of a current permission. Since 1 July 2026, serving EU crypto-asset clients without a MiCA licence has been a breach of EU law. Which services that captures is set out in after the MiCA transition.
The Swiss column is where people look in the wrong place
Swiss membership is confirmed at FINMA, not on the SRO's own site: its search page says you can look up "financial intermediaries that are members of a self-regulatory organisation" and that "You will also find here the SROs responsible for supervising these financial intermediaries".
The operating details are where a genuine member can return nothing. The search asks you to "Enter at least five consecutive characters" and to "not enter any abbreviations placed after the company name", so paste the stem, not the full legal form. "Only twenty search results are displayed." FINMA also says it "cannot guarantee the completeness or accuracy of the data", which is SRO-supplied and refreshed "usually within two to five working days". As at 28 September 2026 it recognised 12 self-regulatory organisations; VQF is on that list itself, registered in Zug. The route end to end is in the complete Swiss SRO application process.
Two questions no register answers
First, whether the firm is good: the SFC states that publishing its licensed list "does not guarantee the performance or creditworthiness of any SFC-licensed virtual asset trading platform" — a list that held 13 platforms on 29 September 2026. Second, whether the filing was checked: ESMA states the white papers in its register "have not been reviewed or approved by any competent authority in any Member State of the European Union", the issuer alone responsible.
A register proves identity and status, never quality. On the same principle, no application can be promised: approval, and how long a regulator takes, is the regulator's discretion.
The other direction: making yourself checkable
Put verifiable facts where a counterparty will look, identical everywhere: full legal name, registration number, registered address, membership or licence number, permitted activities. We hold ourselves to it. CryptoLicense is the licensing advisory brand of CL GLOBAL SDN BHD (1421939-T), in business since 2020, with 100+ companies served across 10+ jurisdictions.
The group also holds Crypto Licence Ltd (16303114) in the UK and Elmbridge Advisory Limited (78559566) in Hong Kong. The UK company's status on Companies House is Active, and anyone can check that number. The rest is on who is CryptoLicense; the routes are compared in licence selection. This reports what the regulators publish, and is not legal advice.
FAQ
A platform says it is deemed-to-be-licensed in Hong Kong. Is that a licence?
No. The SFC states that every platform on its applicant list is "NOT licensed by the SFC, and may NOT be in compliance with the SFC's requirements", and adds that it "has NOT formally licensed the deemed-to-be-licensed VATP applicants". Only the licensed list answers the question.
The firm appears on the FCA register. Does that mean it is authorised now?
Not by itself. The FCA describes the register as covering firms that "are, or have been, authorised by us or the PRA", and it also lists unauthorised firms and clone firms. Read the status, the permissions and the dates on the entry, not just the presence of the name.
Our counterparty says it holds a VQF licence. Where do I check?
Start by correcting the term: VQF is a self-regulatory organisation and grants membership, not a licence. Check it in FINMA's SRO member search, which also names the supervising SRO. Enter at least five consecutive characters and drop the abbreviation after the company name, or a real member can return no result.
Part of a guide series: the checkable entity record is on entity proof.