Denmark based CASP4.8/5Guide · Regulation & MiCA · Updated 21 July 2026 · 12 min read
How to choose a regulated crypto exchange in the EU
Crypto in the EU is no longer an unregulated market — and since 1 July 2026 it is not even a partially regulated one. The MiCA transitional period is over, and a provider without a CASP authorisation may no longer lawfully serve clients in the EU/EEA. This guide shows you how to verify any exchange in the official registers, what to check about fees and custody before you deposit — and when to walk away. It is educational — not legal or financial advice.
Don’t take our word for "regulated" — verify Penning in the Finanstilsynet register (FT-no. 10902) →
The short version
- Since 1 July 2026, every firm offering crypto services to EU/EEA clients must hold a CASP authorisation under MiCA — the transitional period has ended.
- Verification is free and takes about two minutes: look the legal entity up in ESMA’s public MiCA register or the national supervisor’s register before you deposit.
- "MiCA-licensed" is not binary. The authorisation lists which of ten services a platform may provide — check the scope, not just the stamp.
- The advertised trading fee is rarely the whole cost. Spread markups, card surcharges and withdrawal fees hide in the flow — compare the all-in price of a realistic order.
- A license regulates the provider, not the market: it does not protect you against price losses, and crypto is not covered by any deposit guarantee.
Since 1 July 2026, the license is the law
MiCA (the Markets in Crypto-Assets Regulation, (EU) 2023/1114) is the EU’s common rulebook for crypto-assets. Its rules for crypto-asset service providers — CASPs — have applied since 30 December 2024. Firms already operating before that date could continue for a while under national transitional arrangements while their applications were processed.
That grace period is over. The MiCA transitional period ended on 1 July 2026 across the EU/EEA, and in June 2026 ESMA publicly instructed providers without an authorisation to stop onboarding EU clients, stop marketing, and wind down their existing EU business in an orderly way. A platform that cannot point to a CASP authorisation may no longer lawfully serve clients in the EU/EEA.
Denmark applied the full 18-month transitional period, with one important condition: to use it, an existing provider had to file its application with Finanstilsynet by 30 December 2024. Penning was authorised on 15 January 2026 — you can check the date in the register yourself.
If your current exchange is not authorised
Under ESMA’s June 2026 statement, unauthorised providers must limit existing EU clients to selling, transferring or closing positions while they wind down — and must communicate their timeline. If your platform has no register entry, that conversation should already be happening. Check before you deposit — not after.
What a CASP license guarantees — and what it doesn’t
A CASP authorisation is not a marketing badge. To hold one, a provider has to meet MiCA’s ongoing requirements and answer to a national supervisor — in Denmark, Finanstilsynet. The requirements that matter most to you as a customer:
- Safekeeping of client assets — Client crypto must be kept separate from the firm’s own assets, and client money must sit with a credit institution in a separately identifiable account by the end of the next business day (MiCA Art. 70).
- Capital requirements — Minimum own funds of €50,000–€150,000 depending on the services offered, plus ongoing prudential requirements.
- Clear cost and risk disclosure — Fees and risks must be disclosed clearly and upfront — including in marketing.
- Governance and fitness — Management must meet fit-and-proper standards, with a documented conflicts-of-interest policy.
- Complaints handling — A formal, free complaints procedure — with a supervisor behind it if the answer doesn’t satisfy you.
- Ongoing supervision — Continuous supervision by the home-state regulator, coordinated at EU level by ESMA.
What the license does not do
Regulation covers the provider, not the market. Prices remain volatile, losses are yours, and crypto-assets are not covered by the Danish deposit guarantee (Garantiformuen) or any EU deposit-guarantee scheme. A license makes the counterparty safer — not the asset.
"MiCA-licensed" is not binary — read the service scope
A CASP authorisation enumerates which of MiCA’s ten defined crypto-asset services a firm may provide: custody, operating a trading platform, exchanging crypto for funds or for other crypto, executing orders, placing, reception and transmission of orders, advice, portfolio management, and transfer services. Two platforms that both say "MiCA-licensed" can hold very different permissions.
The register entry lists the exact services, and the scope is enforceable: a platform advertising a service its authorisation does not cover is a red flag in itself. Penning’s authorisation, for example, covers seven of the ten services — including portfolio management of crypto-assets (service (i)), which as of July 2026 no other Danish CASP holds.
How to verify any exchange in three steps
You never have to take a platform’s word for "regulated". Verification is free, public, and takes about two minutes.
- Find the legal entity — Not the brand name — the regulated company. It is usually in the website footer, the terms, or the platform’s regulation page. For Penning it is Penning Financial Services ApS.
- Search ESMA’s MiCA register — ESMA publishes the EU-wide register of authorised CASPs, updated weekly. Check that the entity appears, which national authority authorised it, on what date — and which services the authorisation covers.
- Cross-check the national register — The home supervisor’s register is the primary source. In Denmark that is Finanstilsynet’s company register, where Penning is listed under FT-no. 10902. A passported CASP also shows up in host-state lists — Penning appears in Norway’s Finanstilsynet registry and on the French AMF’s whitelist, for example.
Worked example: Penning’s register entry
Penning Financial Services ApS — authorised on 15 January 2026 by Finanstilsynet (Denmark), FT-no. 10902, for seven of MiCA’s ten crypto-asset services. Open the register entry below and check it in one click; the same lookup works for any exchange in the EU.
The eight-point checklist before you deposit
License first — then the practical checks. Before the first transfer, you should be able to tick all eight:
- Authorisation verified — You found the legal entity in ESMA’s or the national register yourself — not just a badge on the website.
- Supervisor named — The platform states which authority supervises it, and the register agrees.
- Scope covers what you’ll use — Trading, transfers, custody or portfolio management — the services you’ll actually use are in the authorisation.
- Custody model is explicit — Who holds your crypto — the exchange, a third-party custodian, or you? The model is stated plainly, not implied.
- Fiat safeguarding is explained — Client money with a regulated credit institution, separately identifiable — a MiCA requirement worth seeing in writing.
- The all-in cost is visible before you confirm — Fee plus spread plus deposit and withdrawal costs on a realistic order — not just a headline rate.
- A complaints channel exists — A formal procedure, a named contact, and a supervisor to escalate to.
- The marketing sounds like a regulated firm — No guaranteed returns, no countdown timers on deposits, risks stated as clearly as benefits.
Fees: the fee you see is rarely the fee you pay
Most comparisons stop at the advertised trading fee. The real cost of a €1,000 purchase varies far more than fee tables suggest, because much of it sits outside the headline number:
| Cost layer | What to look for |
|---|---|
| Trading fee | The advertised percentage per trade. Clear — but rarely the whole story. |
| Spread markup | A margin added to the price itself, common on "zero-fee" and instant-buy flows — often 0.5–1.5%, invisible unless you compare against the market price. |
| Deposit surcharge | Card deposits often cost 2–4% extra; bank transfers are usually free. |
| Withdrawal and network fees | Fixed withdrawal charges or marked-up network costs when you move crypto to your own wallet. |
| Forced conversion steps | Routing your order through an intermediate currency or token adds a second, quiet spread. |
The honest comparison is a worked example: price the same €1,000 order end-to-end — deposit, trade, delivery to your own wallet — on each platform you’re considering. MiCA requires clear cost disclosure, so a platform that cannot show you the all-in number before you confirm is telling you something.
One flat fee, shown before you confirm
Penning charges a flat 2% trading fee — no deposit fees, no monthly fees, and network costs passed through at cost. The full schedule is public.
Who actually holds your crypto?
The custody model is the second thing to check after the license. It decides what happens if the platform fails — and how much you depend on its balance sheet in the meantime.
| Model | How it works | What to check |
|---|---|---|
| Exchange custody | The platform holds client crypto in omnibus wallets, segregated from its own assets under MiCA’s requirements. | Segregation terms, custodian identity, insolvency treatment. |
| Third-party custodian | A separate, regulated custodian holds the assets on the platform’s behalf. | Who the custodian is and where it is regulated. |
| Brokerage with delivery | The platform brokers the trade and delivers crypto to your own wallet — it never holds client crypto. This is Penning’s model. | Delivery terms, network fees, wallet compatibility. |
| Self-custody after purchase | You buy on a platform, then withdraw to a wallet you control. | Withdrawal fees and limits; your own key security. |
Red flags that end the conversation
- No register entry in any EU/EEA member state — the claim "regulated" with nothing to verify.
- "License pending" or "MiCA application in progress" used as if it were an authorisation. Since 1 July 2026, pending is not licensed.
- An offshore entity still onboarding EU clients after the end of the transitional period.
- Guaranteed returns, "risk-free" yield, or pressure to deposit quickly.
- Costs that only appear at trade time — or a refusal to show the all-in price.
- No named supervisor, no complaints procedure, no legal entity on the website.
If in doubt, stop at the register
No register entry means no deposit — that rule alone filters out most bad outcomes. And if a platform you already use has no authorisation, it should be communicating a wind-down plan under ESMA’s June 2026 statement. If it isn’t, treat the silence as your answer.
Where Penning stands
Penning is one of Denmark's first CASP-licensed crypto platforms: Penning Financial Services ApS, authorised by Finanstilsynet on 15 January 2026 under FT-no. 10902, with seven of MiCA’s ten services in scope. Every claim about Penning in this guide is checkable in a public register — which is exactly the standard we suggest you hold any platform to.
- Non-custodial by design — Penning holds no client crypto. Assets are delivered directly to your own wallet; client DKK/EUR sits in segregated client accounts at a regulated Danish bank.
- One flat fee — 2% per trade, shown before you confirm — no deposit, custody or monthly fees, and network costs at cost.
- Supervised and passported — Under ongoing supervision by Finanstilsynet, passported across the EU/EEA — verifiable in Danish and host-state registers.
Trade on a platform you can verify
Open a free account in minutes — and check the license in Finanstilsynet’s register before you do. We’d genuinely rather you looked first.
Frequently asked questions
This guide is educational and not legal or financial advice. Regulation can change and is applied case by case. Always verify a provider’s current authorisation in ESMA’s or the relevant national supervisor’s official register. Crypto-assets are volatile and carry a risk of loss.
Next steps
Choose a platform you can verify
Open a free Penning account — MiCA-licensed, supervised by the Danish FSA and checkable in the public register before you deposit anything.