The European Union’s crypto-licensing pipeline is no longer being filled by crypto firms. Between August 12 and September 10, 2026, 14 of the 16 new entries on the European Securities and Markets Authority (ESMA) register of Crypto-Asset Service Providers (CASPs) were German co-operative banks — Volksbank, Raiffeisenbank and VR-Bank institutions — and every one of them registered for a single service in a single member state.
That is the finding from a parse of ESMA’s own machine-readable CASP register, downloaded on September 10, 2026. The file lists 346 entries across the European Economic Area (EEA). In August 2026, 15 of the month’s 17 new entries — 88.2% — were German co-operative banks, each holding one permission, “execution of orders for crypto-assets on behalf of clients”, and each passported into one state: Germany. This analysis sets out what the register contains, what that permission allows, why the rate collapsed after June, and why headline CASP counts overstate new crypto capacity.
Key facts
- 346 entries sit on the ESMA CASP register as at September 10, 2026 — but only 342 distinct Legal Entity Identifiers (LEIs); four LEIs appear twice.
- 16 entries are dated between August 12 and September 10, 2026; 14 are German co-operative banks, all registered for one service only — execution of orders on behalf of clients — with a one-state footprint.
- Germany is the largest home state with 89 of 346 entries. 35 of those 89 are co-operative banks, or 10.1% of the entire EEA register.
- 69 of 346 entries (19.9%) hold a single service with a single-state footprint; 131 (37.9%) are one-state entries of any kind.
- Monthly entries: 75 in June 2026, 31 in July, 17 in August, three by September 10.
- One entry, Volksbank Baumberge eG, is dated October 6, 2026 — nearly a month in the future.
Methodology, sources and the limits of this data
Every figure above comes from one primary source: the machine-readable CASP register file published by ESMA, downloaded and parsed on September 10, 2026. It carries 346 rows and 15 columns, including home member state, competent authority, legal name, LEI, services registered, and the states into which each entry is passported.
Three caveats matter, and all are properties of the register rather than of this analysis. First, it is not uniformly formatted. Most rows separate services with a pipe character; 24 do not. Entries supervised by the Cyprus Securities and Exchange Commission (CySEC) drop the letter prefixes entirely, one Dutch entry uses bracketed letters and line breaks, one German entry commas, one Cypriot entry slashes. Counting services therefore depends on the parser: a naive pipe split returns 70 single-service, single-state entries; a parser handling commas and slashes returns 69. This article uses the stricter figure.
Second, the date column is named ac_authorisationNotificationDate — authorisation or notification. The register does not separate firms that went through a full CASP authorisation from already-licensed credit institutions taking the Article 60 route under the Markets in Crypto-Assets Regulation (MiCA), where an authorised bank notifies its competent authority of the services it will provide instead of applying afresh. That distinction is invisible in the file, and it is the most important thing a reader of the headline count needs to know.
Third, one entry (KBC Bank NV, supervised by the National Bank of Belgium) has no date at all, and two carry an end date — Stratos Europe Ltd (April 24, 2026) and Decubate B.V. (March 26, 2026) — so the register counts exits alongside entries.
What the register shows for the last month
The 16 entries dated between August 12 and September 10, 2026:
| Date | Entity | Home state / authority | Services held | States passported |
|---|---|---|---|---|
| Aug 13, 2026 | Raiffeisenbank Schwaben Mitte eG | DE / BaFin | 1 | 1 |
| Aug 14, 2026 | Volksbank Euskirchen eG | DE / BaFin | 1 | 1 |
| Aug 18, 2026 | Ihre Volksbank eG Neckar Odenwald Main Tauber | DE / BaFin | 1 | 1 |
| Aug 18, 2026 | VR-Bank Mittelfranken Mitte eG | DE / BaFin | 1 | 1 |
| Aug 20, 2026 | VR Bank Ried-Überwald eG | DE / BaFin | 1 | 1 |
| Aug 20, 2026 | Volksbank Backnang eG | DE / BaFin | 1 | 1 |
| Aug 21, 2026 | Frankfurter Volksbank Rhein/Main eG | DE / BaFin | 1 | 1 |
| Aug 24, 2026 | GateHub Exchange d.o.o. | SI / ATVP | 4 | 30 |
| Aug 26, 2026 | VR Bank Ihre Heimatbank eG | DE / BaFin | 1 | 1 |
| Aug 27, 2026 | Raiffeisenbank Isar-Loisachtal eG | DE / BaFin | 1 | 1 |
| Aug 27, 2026 | Volksbank Alb eG | DE / BaFin | 1 | 1 |
| Aug 28, 2026 | Deutsche WertpapierService Bank AG (dwpbank) | DE / BaFin | 4 | 1 |
| Aug 31, 2026 | Volksbank Raiffeisenbank Dachau eG | DE / BaFin | 1 | 1 |
| Sep 2, 2026 | Volksbank Sauerland eG | DE / BaFin | 1 | 1 |
| Sep 7, 2026 | Volksbank Zollernalb eG | DE / BaFin | 1 | 1 |
| Sep 8, 2026 | VR Bank München Land eG | DE / BaFin | 1 | 1 |
Source: author’s parse of the ESMA CASP register file, downloaded September 10, 2026.
Only one of the two non-co-operative entries is a new entrant. dwpbank already appeared on December 4, 2025 under the same LEI with a single execution permission; the August 28, 2026 row broadens the same bank into custody, exchange and transfer, and remains German-only. That leaves GateHub Exchange d.o.o., authorised by Slovenia’s Securities Market Agency (ATVP) on August 24, 2026, as the only crypto-native firm to join with a cross-border footprint in the whole period — four services, 30 states.
What a single execution permission does and does not allow
A crypto-asset service permission under the EU framework is not a general licence to “do crypto”. It is an itemised list, and the register records which items each entity holds. “Execution of orders for crypto-assets on behalf of clients” lets a bank take a customer instruction to buy or sell and route it for execution. It does not permit holding the customer’s crypto-assets, operating a trading venue, exchanging crypto for funds on its own book, placing tokens, advising, or portfolio management. Those are separate permissions, lettered a, b, c, f, h and i in the register’s taxonomy. A bank holding only execution is a distribution channel, not a crypto business.
The register makes the architecture visible. DZ BANK AG, the central institution of the German co-operative sector, registered on December 23, 2025 for custody and execution, Germany-only. Boerse Stuttgart Digital Custody GmbH registered on January 17, 2025 for custody and transfer, passported into 30 states. DekaBank, the Sparkassen sector’s central institution, registered on December 1, 2025 for custody and execution. The local Volksbank sits at the customer-facing end with the one permission it needs — the rented-stack pattern Spanish banks have used with Cecabank and Bit2Me, reproduced across hundreds of independent co-operatives, each a separate legal entity needing its own entry.
The cadence is industrial, not entrepreneurial: two co-operatives in November 2025, five in December, a pause, one in May and one in June 2026, seven in July, 15 in August, three in September. That is a rollout schedule, not a wave of new firms competing for EEA crypto flow.
How four jurisdictions treat scope-limited crypto permissions
| Jurisdiction / Regulator | Effective date | Scope | Key requirement | Penalty / sanction |
|---|---|---|---|---|
| Germany (BaFin, under the EU crypto framework) | Framework fully applicable December 30, 2024 | 89 register entries, of which 35 co-operative banks | Permissions itemised service-by-service; authorised credit institutions may use the Article 60 notification route instead of a standalone authorisation | Coercive fine of €600,000 imposed on Ethena GmbH, April 4, 2025; winding-up order April 14, 2025 |
| Slovenia (ATVP) | GateHub Exchange authorised August 24, 2026 | Crypto-native firms; four services granted | Full authorisation with cross-border notification into 30 states | Withdrawal of authorisation; the register carries end-dates for two EEA entities |
| UK (FCA) | Financial promotions regime in force October 8, 2023; CP26/13 open in 2026 | Cryptoasset firms marketing to UK consumers | Registration under the Money Laundering Regulations 2017 plus approved financial promotions | Unregistered promotion is a criminal offence carrying up to two years’ imprisonment |
| US (SEC and CFTC) | SEC-CFTC memorandum of understanding on dual registrants, 2026 | Broker-dealers, exchanges, DCMs | Registration by activity under the Securities Exchange Act of 1934 and the Commodity Exchange Act | Civil money penalties and disgorgement; no single crypto permission schedule |
Sources: ESMA CASP register (parsed September 10, 2026); BaFin; ESMA Supervisory Briefing ESMA75-453128700-1263, January 31, 2025. Last updated: September 10, 2026.
The EU is the only one of the four publishing a machine-readable, service-by-service, state-by-state register of who may do what. That transparency is a supervisory achievement — and it is also what makes the headline number misleading, because listing individual co-operative banks alongside a Slovenian exchange with a 30-state passport invites readers to treat the entries as equivalent. They are not. The passporting column shows the gap: the mean entry is notified into 15.1 states, but the distribution is bimodal. Some 131 entries reach one state only; 97 reach 30 or more. Little sits between. As this publication has argued about registration regimes generally, the label says less than the schedule inside.
“A targeted and proportionate increase in EU-level supervision, focused on genuinely pan-European and systemic entities, can deliver clearer accountability, more consistent outcomes and more holistic oversight.”
— Verena Ross, Chair, European Securities and Markets Authority (Cyprus Business News, June 11, 2026)
Ross’s qualifier — “genuinely pan-European” — does a lot of work: well over a third of entries are not pan-European in any operational sense.
The June spike and the decay that followed
The register also records a rate. The transitional period for firms operating under national regimes ended on July 1, 2026, and the month before it produced by far the largest cohort in the register’s history.
| Month | New entries | Of which German co-operative banks | Co-op share |
|---|---|---|---|
| April 2026 | 12 | 0 | 0% |
| May 2026 | 18 | 1 | 5.6% |
| June 2026 | 75 | 1 | 1.3% |
| July 2026 | 31 | 7 | 22.6% |
| August 2026 | 17 | 15 | 88.2% |
| September 2026 (to Sep 10) | 3 | 3 | 100% |
Source: author’s parse of the ESMA CASP register file, September 10, 2026.
June 2026 delivered 75 entries across France (12), Cyprus (nine), Italy (seven), Malta (seven), Spain (five) and Liechtenstein (five); only nine were single-service, single-state. That was the deadline cohort, converting national registrations into passportable permissions before the cut-off. Since July 1 the register has added 51 entries, 25 of them — 49% — German co-operative banks. Strip out that rollout and the EEA has added roughly 26 crypto firms in 10 weeks — the real run-rate, sitting alongside the roughly 20% conversion rate recorded when the transition closed.
Enforcement context: what BaFin does when a firm falls short
The contrast between BaFin and ATVP is not merely one of volume. BaFin holds the EEA’s most-tested crypto enforcement record under the new framework, and the Ethena case shows how fast it moves. It imposed initial supervisory measures on Ethena GmbH, a Frankfurt-registered issuer of the USDe token, on March 21, 2025; the company did not fully comply. Ethena withdrew its application on April 3, 2025; BaFin imposed a €600,000 coercive fine on April 4 and ordered the business wound up on April 14, 2025.
In BaFin’s published words, “Ethena GmbH, which has its registered office in Frankfurt am Main, must reverse the issuance of its USDe tokens.” The regulator found “serious deficiencies in the business organisation” and infringements of the framework’s requirements, banned payments and sales to protect creditors, and made secondary-market trading impermissible. Ethena objected on April 22, 2025.
The Ethena action concerned token issuance, not service provision, so it is no direct precedent for an execution-only bank. But it establishes the posture of the authority supervising 89 of the register’s 346 entries, and shows that a withdrawn application does not end supervisory exposure. ESMA’s own cross-border peer review has named BaFin and CySEC rather than the firms they supervise — a reminder that the quality of a permission depends on the authority granting it, precisely the variable a 30-state passport exports to 29 other countries.
What this means for brokers, exchanges, CASPs and compliance teams
For brokers and FX/CFD firms: the German competitive picture has changed in a way headline counts obscure. Co-operative banks are becoming order-routing points for a small basket of major tokens inside apps their customers already hold. That is not competition for professional crypto flow; it is competition for the retail on-ramp. Firms whose German funnel depends on opening a customer’s first crypto account should assume it narrows.
For exchanges and crypto-native CASPs: the register is a targeting document. An entity with a single execution permission cannot custody, exchange on its own book or run a venue — so each of these banks is a potential counterparty rather than a rival. The 35 co-operative entries are, functionally, distribution reach someone else must service.
For fund managers and custodians: diligence cannot stop at “is this entity on the ESMA register”. Read the service column and the passporting column. An entity may be listed yet lack permission for the activity contemplated, and lack any right to provide it in the fund’s own member state.
For legal and compliance teams: verify the specific service letters, not merely the register entry, before onboarding; check the passporting column against every state where clients sit, since 131 entries cover one state only; and re-pull the register periodically, because it carries a forward-dated entry, an undated entry and two end-dated entries, so today’s snapshot will not match last month’s.
“It is concerning that the floodgates to the cryptocurrency market are now being opened by savings and cooperative banks.”
— Co-Pierre Georg, Professor, Frankfurt School of Finance & Management (Bloomberg, via Yahoo Finance, July 4, 2026)
The counter-argument deserves a hearing. Routing retail orders through supervised credit institutions, with custody at a central institution and permissions itemised on a public register, is a more controlled model than the offshore venues German retail investors used before. Georg’s concern is scale of access; the framework’s answer is that access is now scoped and enumerated. Both can be true.
What’s next
Three things to watch. First, the Markets Integration Package under discussion in Brussels would move CASP supervision to ESMA itself, a change Ross has linked to reducing fragmentation. If adopted, the authority granting a 30-state passport would no longer be a national regulator — addressing supervisory variance, but doing nothing about scope-limited entries.
Second, the co-operative rollout has further to run. Germany holds many more co-operative institutions than the 35 now on the register, and the pipeline is visible: Volksbank Baumberge eG already carries an October 6, 2026 date. If the August cadence holds, these banks will dominate monthly entry counts into 2027 and the EEA total will keep rising without much new capacity behind it.
Third, watch whether any co-operative broadens its permissions. dwpbank did exactly that on August 28, 2026, moving from one service to four in a second entry — the clearest template for how an incumbent expands. Whether local co-operatives follow, or stay execution-only, determines whether this bloc becomes a crypto business or remains a channel. Watch too for the continued removal of unauthorised platforms from the EU market.
TL;DR
ESMA’s CASP register held 346 entries across the EEA on September 10, 2026, but only 342 distinct LEIs. Of the 16 entries added since August 12, 14 were German co-operative banks — Volksbank, Raiffeisenbank and VR-Bank institutions — each holding a single permission, execution of orders on behalf of clients, and each passported into Germany alone. In August 2026 they were 88.2% of all new EEA entries. Only GateHub Exchange d.o.o., authorised in Slovenia on August 24, 2026 with four services and a 30-state passport, joined as a genuinely cross-border crypto firm. Roughly one register entry in five is single-service and single-state, so headline CASP counts materially overstate new crypto capacity in the European Union.
Frequently asked questions
How many CASPs are on the ESMA register?
The file downloaded on September 10, 2026 contains 346 entries across the European Economic Area. That is not 346 firms: only 342 distinct Legal Entity Identifiers appear, because four LEIs are listed twice. Three duplicates are German banks that added an entry when broadening permissions; one LEI is shared by two differently named French entities. A further entry carries no date, and two carry end dates.
Why are so many German co-operative banks appearing on the register?
Germany’s co-operative sector is rolling out retail crypto trading through a shared platform, with custody and infrastructure at central institutions such as DZ BANK AG. Each local Volksbank, Raiffeisenbank or VR-Bank is a separate legal entity, so each needs its own entry for the permission it uses. That produces many entries in quick succession without a single new crypto firm being created. Thirty-five are now listed.
What does “execution of orders for crypto-assets” actually permit?
It permits a firm to take a client’s instruction to buy or sell a crypto-asset and route it for execution. It does not permit custody, operating a trading platform, exchange for funds on the firm’s own book, placing, advice, or portfolio management. Each is separately lettered, and a firm holding only execution must source the rest from a licensed counterparty.
Does a register entry mean a firm can serve clients across the EU?
No. The register separately records which member states each entity is notified into. Some 131 of the 346 entries cover a single state, while 97 cover 30 or more; the 15.1-state mean is bimodal rather than typical. Diligence should check the passporting column for every state where clients sit, not merely confirm the entity is listed.
What was the enforcement action against Ethena GmbH?
BaFin imposed initial supervisory measures on the Frankfurt-registered USDe issuer on March 21, 2025. After Ethena withdrew its application on April 3, 2025, BaFin imposed a €600,000 coercive fine on April 4 and ordered the business wound up on April 14, requiring USDe issuance to be reversed and banning payments and sales. Ethena objected on April 22, 2025.
Why did new authorisations fall so sharply after June 2026?
June 2026 produced 75 entries as firms converted national registrations before the transitional period closed on July 1, 2026. Once the deadline passed the cohort disappeared: 31 in July, 17 in August, three by September 10. Because German co-operative banks supplied 25 of the 51 post-deadline entries, the underlying rate of new crypto firms joining is roughly half the headline figure.
This article is informational analysis only and does not constitute legal, regulatory, tax, or investment advice. Regulatory frameworks change frequently and interpretation depends on facts and circumstances; primary documents and official regulator guidance always supersede summaries. Firms should consult qualified legal counsel and their relevant supervisory authority before taking any action based on the analysis above.
Featured image: Berliner Volksbank, Kurfürstendamm, Berlin, by Bahnfrend, Wikimedia Commons, CC BY-SA 4.0.
Rick Steves
Rick Steves has seen business and economics through many lenses. He joined the financial services industry in 2009, and has been a financial journalist since 2011. He holds a degree in Business Administration and has experience producing real-time news, from both buy-side and sell-side, as well as for retail traders, brokers and service providers. Steves' work has appeared in a variety of online publications including FX Street, NewsBTC, FinanceFeeds, and The Industry Spread. Rick has great interest in the dynamics of the trading industry. The never-ending clash between technology, economics, regulation, and more importantly, the people.
