Two sides of the same check
Who is authorised
ESMA's file of crypto-asset service providers, searchable with the MiCA licence checker.
Who is not
ESMA's non-compliant entities file and national regulator warning lists.
A firm that is not in the register is a warning sign even if it is not on any warning list, because lists cannot keep up with every new scam site.
ESMA's non-compliant entities file among regulator warning lists
ESMA's interim MiCA register includes a CSV file of non-compliant entities, reported by national regulators, which held 178 entries when downloaded.
Entries include the regulator, the name and website of the entity, and the reason, such as providing crypto-asset services without the required authorisation.
Example: the file lists MEXC Global, reported by the Dutch AFM with a decision dated 16 September 2025, for providing crypto-asset services in the Netherlands without the required MiCA licence.
National regulator warning lists
Many national financial regulators publish their own warnings about unauthorised firms and scam websites.
Find your regulator in the table on the page about MiCA regulators, and open its website yourself.
How to search regulator warning lists
- Search by website address, not just by name: scam sites change names often.
- Search by name variations, including spelling differences.
- Check lookalikes: the ESMA file includes sites named like real brands.
- Absence is not approval: not being on a list does not make a firm safe.
If a firm is on regulator warning lists
- Do not open an account or send money.
- If you already have, withdraw what you can and keep records.
- If you cannot withdraw, report it, as the guide to reporting a crypto scam explains.
Regulator warning lists: what an entry contains
| Field in ESMA's non-compliant file | What it tells you |
|---|---|
| Competent authority | Which regulator reported the entity |
| Home member state | The reporting country |
| Name and commercial name | How the entity presents itself |
| Website | The address to avoid |
| Reason | For example, providing services without authorisation |
| Decision date | When the regulator acted |
Fields from the NCASP.csv file of ESMA's interim MiCA register.
Regulator warning lists: lookalike sites
The non-compliant file includes entries whose names resemble known brands, such as "HTXcoin-az", reported by Italy's CONSOB.
Such sites rely on people recognising a familiar name without checking the exact address.
Comparing the website address character by character with the one in the authorised register is the most reliable defence.
Regulator warning lists: when a warning appears after you joined
- Stop depositing immediately.
- Try to withdraw what you can, starting with a small amount.
- Do not pay any "release fee" to withdraw.
- Keep records and report to the regulator and police if withdrawals fail.
Regulator warning lists and social media ads
Many unauthorised platforms recruit through social media ads and influencers.
An ad on a large platform is not a sign of approval, and checking the register takes less time than reading the ad.
Regulator warning lists: a five-minute routine
- Search the authorised register with the MiCA licence checker.
- Open ESMA's non-compliant file and search the name and website.
- Search your national regulator's warnings.
- Search the website address on its own, in case the name changed.
- If anything is unclear, do not pay.
Regulator warning lists: limits
- Scam sites appear faster than regulators can list them.
- Names change often, while the scheme stays the same.
- Lists in other countries may not be checked by your regulator.
That is why the authorised register is the stronger check: being authorised is the condition, and not being warned against is not enough.
Regulator warning lists and cloned firms
Some warnings concern clones: scammers who copy the name, address and registration number of a real authorised firm.
A clone can pass a quick register check, so always compare the website, email domain and phone number with those listed by the regulator.
Contact the real firm through the details in the register if you are unsure.
Regulator warning lists: examples of reasons
| Reason given | What it means |
|---|---|
| Providing crypto-asset services without authorisation | Operating without the required MiCA licence |
| Impersonating an authorised firm | A clone |
| Suspected fraud | The regulator believes the site may be a scam |
General categories; the wording in each entry comes from the reporting regulator.
Regulator warning lists: sharing what you find
If a friend or relative is using a platform you find on a warning list, tell them calmly and show them the entry.
People often trust a regulator's page more than a personal opinion, and seeing the official warning can make it easier for them to stop.
Regulator warning lists and this site
CoinTrustRadar.com lists only providers found in ESMA's authorised register, and its page on exchanges not authorised under MiCA shows well-known names missing from it, including one that appears in the non-compliant file.
Regulator warning lists: reading the authorised register alongside
The authorised register and the warning lists answer different questions, and using both gives a fuller picture.
| Result | Register | Warning list | Conclusion |
|---|---|---|---|
| A | Found, website matches | Not found | Authorised; continue with other checks |
| B | Found, website differs | Clone warning | Scam using a real name |
| C | Not found | Found | Do not use |
| D | Not found | Not found | Treat as unauthorised until clarified |
Regulator warning lists: why some scams are never listed
Many scam sites exist for only a few weeks before moving to a new address.
Others target people through private messages and never advertise publicly, so regulators may not hear about them until victims report.
This is another reason to rely on the authorised register first: a scam may escape a warning list, but it cannot appear in the register as an authorised firm with its own website.
Regulator warning lists: helping keep them current
Regulators depend partly on reports from the public.
If you are approached by an unauthorised platform, reporting it through your regulator's website helps others, even if you did not lose money.
Include the website address, how you were contacted and any names or numbers used.
Regulator warning lists: national examples of what to search for
- A "warnings" or "investor alerts" page on the regulator's site.
- A search box for unauthorised firms.
- News releases about action against unauthorised crypto services.
- Links to ESMA and to other national regulators' lists.
The exact names of these pages vary by country; the regulator's home page usually links to them.
Regulator warning lists: a habit worth keeping
Checking takes a few minutes, and it is worth repeating whenever someone suggests a new platform, a new token or a new way to earn.
Combined with the scam check, it filters out most investment fraud before any money moves.
Regulator warning lists: questions readers ask
How often is ESMA's non-compliant file updated? It is part of the interim register, which is updated over time as regulators report; this site shows the date of the copy it uses.
A platform is listed in another country, not mine. Should I worry? Yes; an unauthorised platform in one EU country is very unlikely to be authorised to serve you elsewhere.
Can a firm be removed from a warning list? Lists are maintained by regulators; if a firm later becomes authorised, it will appear in the authorised register.
Regulator warning lists: one-paragraph summary
Check the authorised register first, the warning lists second, and the website address character by character always; if a crypto firm cannot be found as authorised with the exact site you are using, do not send money, whatever its marketing says and however many people recommend it.
The MiCA licence checker makes the first step quick, and ESMA's own MiCA page links to the official files.
More on regulator warning lists and related safety tools
Safety works best as a set of habits, and each guide and tool below covers a different part of the picture around regulator warning lists.
Use them together: check the firm, check the offer, secure your account and know what to do if something goes wrong.
Frequently asked questions
What are regulator warning lists?
Lists published by regulators of firms or websites that are not authorised or that may be scams.
Does ESMA publish a crypto warning list?
Its interim MiCA register includes a file of non-compliant entities reported by national regulators.
If a firm is not on a warning list, is it safe?
No. Check that it is authorised in the register; warning lists cannot cover every new scam.
How do I find my national regulator's warnings?
Identify your regulator from the ESMA register and search its website for warnings or a consumer alerts section.
Is MEXC on ESMA's non-compliant list?
Yes, the file lists MEXC Global, reported by the Dutch AFM with a decision dated 16 September 2025.
Every figure on this page is checked against the ESMA register, the exchange's own terms and fee pages or another primary source, and the sources are listed above. Editorial policy · How we rate