Introduction
"Licensed. Regulated. Registered with FinCEN." Trading and crypto platforms list their credentials in the footer, and most of them are true. The problem is what they leave out.
A registration records that a business exists, or that it has notified an authority. An authorisation means that a regulator has assessed the business and admitted it to a regulated activity. On a website, the two look the same. For a bank onboarding a platform as a customer, or a payment firm processing its flows, they describe very different risks.
We made a short video that works through the difference on a made-up platform, ExampleTrade. The chapters and the full transcript are on the video's own page.
Nine in ten crypto firms on the registers we track are registered, not licensed
Of the 2,665 active crypto-asset firms on the 22 regulator registers that the Elucidate Bank & Firm Directory tracks, 2,442 (91.6%) appear only on registers kept for anti-money-laundering (AML) supervision. The other 223 (8.4%) hold a prudential licence. The registers were retrieved between 24 September and 5 November 2026.
The split is almost entirely geographic. Of the registration-only firms, 2,430 are on Canada's Money Services Business Registry, kept by FINTRAC, where dealing in virtual currency is one of the activities that requires registration. The licensed firms are mostly in the EU, authorised under the Markets in Crypto-Assets Regulation (MiCA): Germany (30), the Netherlands (24), Cyprus (24) and France (21) lead the count, followed by Hong Kong (14).
Not every firm on FINTRAC's registry is a trading platform: the activity also covers virtual currency exchange and transfer services. And a crypto trading platform that serves Canadians must also be registered with the country's securities regulators, whose list of authorised platforms the directory does not track yet. But wherever the line is drawn, what FINTRAC's registry records is a registration.
What the registers say about themselves
Both North American registers are explicit about it. In FINTRAC's words, "registration with FINTRAC does not indicate that FINTRAC endorses or licenses the business. It indicates only that the business has satisfied the legal requirements to register." FinCEN, whose register of money services businesses held 31,737 entries on 5 November 2026, does not license or vet its registrants, and says that inclusion "is not a recommendation, certification of legitimacy, or endorsement" of the business by any government agency.
The same holds elsewhere. In the UK, the Financial Conduct Authority (FCA) says that its cryptoasset registration covers AML registration, supervision and enforcement only. A company number from Companies House or a US state shows that a company was incorporated; it is not a financial licence.
Nor does the word itself help. In securities law, "registered" can mean authorised: a broker-dealer registered with the SEC has been admitted to a regulated activity. A platform's website rarely says which kind of registration it means.
The result? A platform can truthfully cite a registration that no regulator ever assessed it for—and its customers and counterparties can easily read it as a licence.
Why the distinction matters now
In the EU, the question now has a deadline behind it. The last MiCA transitional periods ended on 1 July 2026, and as ESMA reminded the market, a crypto-asset service provider without a MiCA authorisation can no longer serve EU clients. A national registration obtained before MiCA, however genuine, no longer carries the business.
Meanwhile, the firms that imitate authorised ones keep adapting. The FCA warns of clone firms, which copy an authorised firm's name, register number and documents, then add their own website, email address or phone number. The SEC's PAUSE list includes regulators that do not exist. IOSCO's I-SCAN portal has brought securities regulators' warnings into one search since March 2025—a real step forward, but a warning list holds only what regulators have reviewed and published, and new websites appear faster than warnings.
Five checks before you rely on a credential
- Who is the legal entity? Not the brand: the company named in the footer or the client agreement, with its registration number and its regulator. A platform that does not name the entity behind it cannot be checked on a register.
- Does the authorisation cover this service, in this country? A payment licence does not cover investments, and an investment licence does not cover crypto-asset services. An authorisation in one country does not necessarily cover customers in another.
- Is the register entry a registration or an authorisation? Read what the entry is, not only that it exists.
- Is the platform on a warning list? Search the brand, the legal name and the web address. Absence is not evidence.
- Do the contact details match the register? A clone firm changes the website, the email address and the phone number, and little else.
Our guide to checking a trading or crypto platform names the registers and warning lists behind each check.
Identification is not assessment
Even a clean answer to all five checks is where due diligence starts, not where it ends. An authorisation means that a regulator admitted the firm and supervises it. It does not tell you how well the firm's controls work, who its customers are, or how much financial crime risk it brings into your network. And a firm missing from one register may be authorised by another authority, or under another name.
That gap has a cost. When a bank cannot easily see whether a platform is supervised—let alone how well—exiting the relationship is the simplest response. De-risking does not remove the risk. It relocates it.
The answer is not more manual checking. It is better data: identification that is quick and reliable, and an assessment that is measured rather than inferred from a credential.
Where Elucidate can help
The Elucidate Bank & Firm Directory puts the 22 registers we track into one free search, alongside Swift's directory of Business Identifier Codes (BICs). For each firm, it shows the register entries, their status and the date each register was retrieved, and labels every entry by level: a prudential licence, a small-firm registration or an AML registration only. The difference between registered and authorised is on the page.
For banks and payment firms that need to go further, from identifying a counterparty to assessing it, the Elucidate FinCrime Index (EFI) is an independent score of the financial crime risk of banks and payment firms—comparable to a credit risk rating, applied to financial crime.
A registration tells you that a firm exists. An authorisation tells you what it may do. Neither tells you how well it does it.
