MiCA in Denmark: rules, supervision and CASP licenses

Finanstilsynet is Denmark's national competent authority under MiCA. The regulation's rules for crypto-asset service providers took effect across the EU on 30 December 2024, and Denmark applied the full 18-month transitional period with an early application deadline: providers already operating had to apply to Finanstilsynet by 30 December 2024 to keep serving Danish customers while their applications were assessed. That transitional period ended on 1 July 2026 — since then, offering crypto trading, custody or exchange services to Danish customers without CASP authorisation is simply not permitted, and ESMA's public statement of 23 June 2026 instructed providers without authorisation to stop onboarding EU clients and wind down.

Penning holds one of Denmark's first CASP authorisations under MiCA (FTID 10902) — a fact you should not take this page's word for. Look it up in the register; that is precisely what the register is for.

Search Finanstilsynet's company register (virksomhedsregister.finanstilsynet.dk) for the provider's name, or check ESMA's EU-wide register of authorised CASPs. The entry shows what the firm is actually authorised to do — custody, exchange, execution, portfolio management — which matters, because a licence covers specific services, not everything a website happens to offer.

If a provider serving Danish customers appears in neither register, the rest of your due diligence is moot. No entry means no authorisation.

Before MiCA, Danish crypto firms operated under anti-money-laundering registration alone — a thin regime that said nothing about custody, capital or conduct. CASP authorisation adds the substance: client assets must be held segregated from the firm's own, capital requirements apply, fees and risks must be disclosed clearly, and a formal complaints procedure is mandatory.

What MiCA does not change: crypto remains a volatile asset class, and holdings are not covered by the Danish deposit guarantee (Garantiformuen). Regulation makes the provider accountable — it does not make the asset safe.