DEV Community: VASP Tracker

Brazil now lists who applied for a crypto licence. Reading the two BCB lists in Python, and the CNPJ trap between them

VASP Tracker — Tue, 10 Nov 2026 02:13:47 +0000

Brazil's central bank (Banco Central do Brasil, BCB) now publishes two lists that crypto compliance teams have been waiting for:

Companies that applied for authorisation as virtual asset service providers (SPSAVs) under the transition rule in article 88 of Resolução BCB nº 520.
Institutions the BCB already authorises (banks, brokers, distributors) that told it they will offer virtual asset services under article 22 of the same resolution.

Both sit on the BCB's authorisation page. The page is rendered from two JSON endpoints, so you can read them directly. This post shows a short script, the four things that tripped me up, and why the lists matter this month.

All numbers come from the endpoints as I read them on 10 November 2026, around 10:05 Asia/Shanghai time (UTC+8). The lists will change, so re-run the code before you quote anything.

The endpoints

https://www.bcb.gov.br/api/servico/sitebcb/SPSVAs_autorizacao
https://www.bcb.gov.br/api/servico/sitebcb/ifs-autorizadas-ativos-virtuais

No key, no login. Each returns an object with a single conteudo array. These endpoints feed a public web page; they are not a documented open-data API. So cache the result, poll politely, and expect the shape to change without notice.

The script

import re
import unicodedata
from collections import Counter
import requests

BASE = "https://www.bcb.gov.br/api/servico/sitebcb/"

def fetch(endpoint: str) -> list[dict]:
    r = requests.get(BASE + endpoint, timeout=30)
    r.raise_for_status()
    return r.json()["conteudo"]

applicants = fetch("SPSVAs_autorizacao")              # art. 88 applications
incumbents = fetch("ifs-autorizadas-ativos-virtuais")  # art. 22 institutions

print(len(applicants), "applications |", len(incumbents), "art. 22 institutions")
print(Counter(a["Modalidade"] for a in applicants))
print(Counter(a["Fase"] for a in applicants))
print(Counter(i["TipoAtuacao"] for i in incumbents))

Output on 10 November:

120 applications | 24 art. 22 institutions
Counter({'Intermediária': 73, 'Corretora': 46, 'Custodiante': 1})
Counter({'Em exame': 119, 'Indeferido': 1})
Counter({'Intermediação': 16, 'Custódia/Intermediação': 8})

So 120 applications: 73 for the intermediary modality, 46 for broker and one for custodian. 119 are "em exame" (under examination) and one is "indeferido" (rejected). On the second list, 8 institutions are shown for custody and intermediation and 16 for intermediation only.

Four traps

1. The two lists format the company ID differently

Brazilian companies are identified by a CNPJ. The first eight digits (the raiz, or root) identify the company; the rest identify the branch. Both lists give only the root, but not in the same format:

print(Counter(len(a["CNPJ"]) for a in applicants))   # Counter({10: 120})  e.g. "39.695.312"
print(Counter(len(i["CNPJ"]) for i in incumbents))   # Counter({8: 24})    e.g. "60701190"

The applications list uses dots; the article 22 list uses bare digits. A naive join on the CNPJ field returns zero matches, and you will not get an error. Normalise to eight digits first:

def cnpj_root(value: str) -> str:
    digits = re.sub(r"\D", "", value)
    if len(digits) == 14:          # a full CNPJ, e.g. from your own KYC data
        digits = digits[:8]
    return digits.zfill(8)

The len == 14 branch matters because your own records probably hold full CNPJs (60.701.190/0001-04), not roots.

2. Leading zeros are real

The article 22 list includes roots that start with zero. One of them is 00000000, which is Banco do Brasil. The JSON keeps them as strings, so you are fine until you save to CSV and read it back:

import pandas as pd

pd.read_csv("roots.csv")["cnpj"].tolist()             # [0, 9516419]
pd.read_csv("roots.csv", dtype=str)["cnpj"].tolist()  # ['00000000', '09516419']

Always pass dtype=str for ID columns, and keep the zfill(8) in cnpj_root as a second line of defence.

3. Names have stray whitespace

Four of the 120 company names contain a double space or a trailing tab, for example 'WEBULL Sociedade Prestadora de Serviços de Ativos Virtuais Ltda.\t'. If you compare names, collapse whitespace first:

def clean_name(value: str) -> str:
    return re.sub(r"\s+", " ", value).strip()

4. You can't tell an SPSAV by its name

Article 15 of Resolution 520 requires an SPSAV to carry the expression "Sociedade Prestadora de Serviços de Ativos Virtuais" in its company name, and most applicants already do. But matching on the phrase gives different answers depending on how strict you are:

def fold(value: str) -> str:
    s = unicodedata.normalize("NFKD", clean_name(value)).casefold()
    return "".join(c for c in s if not unicodedata.combining(c))

phrase = "Sociedade Prestadora de Serviços de Ativos Virtuais"
exact  = sum(phrase in a["Title"] for a in applicants)
folded = sum(fold(phrase) in fold(a["Title"]) for a in applicants)
print(exact, folded)   # 99 104

The five names that only the folded match finds are two written in capitals, two without the cedilla ("Servicos") and one with the double space from trap 3. The other 16 applicants are listed under names without the phrase at all ("... Serviços Digitais Ltda.", "... Securitizadora S.A." and similar). Do not use the phrase as a filter. Treat the list as the source of truth, keyed by CNPJ root.

A lookup you can put in front of onboarding

index = {}
for a in applicants:
    index[cnpj_root(a["CNPJ"])] = ("art. 88 application", a["Modalidade"], a["Fase"], clean_name(a["Title"]))
for i in incumbents:
    index[cnpj_root(i["CNPJ"])] = ("art. 22 institution", i["TipoAtuacao"], None, clean_name(i["Title"]))

def lookup(cnpj: str):
    return index.get(cnpj_root(cnpj), "not on either list")

print(len(index))                       # 144: no root appears on both lists
print(lookup("60.701.190/0001-04"))     # ('art. 22 institution', 'Custódia/Intermediação', None, 'ITAÚ UNIBANCO S.A.')

A few rules for using the result:

"Em exame" is not a licence. It means an application is on file and the process has not been concluded. Resolution 520 treats the two differently: an on-time applicant may keep operating "until the conclusion of its authorisation process" (art. 88, para. 6), which is not the same as being authorised.
"Indeferido" needs a human. The list gives no reasons.
"Not on either list" is not proof of anything on its own. Check the spelling of the CNPJ, re-fetch, and look at other BCB sources before drawing a conclusion.
Store the snapshot with a timestamp. If a decision is ever questioned, you want to show what the list said on the day you checked.

Why this matters in November

Two dates in Resolution 520 make these lists practical tools rather than trivia:

Article 91, as reworded by Resolução BCB nº 589, has applied since 6 November 2026. BCB-authorised institutions may not carry out or enable virtual asset operations whose counterparties are virtual asset service providers not authorised by the BCB, except in forms the regulation expressly allows. In its Vote 108/2026, the BCB said it moved this date from 30 October so it could publish an official list of institutions in transition.
Article 88, paragraph 7: providers that did not apply by the 30 October deadline must stop providing virtual asset services within 30 days after it. By our count that is 29 November 2026. Under paragraph 6, providers that applied on time may keep operating until their process is concluded, but may not switch modality in the meantime.

If you build payment, banking or exchange tooling for Brazil, the CNPJ lookup above is the cheapest control you can add before 29 November. For the wider timeline, VASP Tracker keeps a Brazil page that follows the same BCB sources, also in Portuguese.

Official texts: Resolução BCB nº 520, Resolução BCB nº 589, Voto 108/2026.

This is not legal advice. The BCB's own pages and the resolutions are the authoritative sources; check them before relying on anything here. VASP Tracker is an independent tracker, not an official source, and is not affiliated with any regulator.

Reading Argentina's crypto register in Python: 81 firms, a lying dimension tag and a new monthly clock

VASP Tracker — Tue, 03 Nov 2026 02:20:11 +0000

Argentina's securities regulator, the Comision Nacional de Valores (CNV), keeps a public register of virtual asset service providers. Locally they are called PSAVs (Proveedores de Servicios de Activos Virtuales). The register is the only public record of who is allowed to offer crypto services in the country, and from 1 November 2026 it also tells you who owes the CNV a monthly report.

This post walks through a small Python script that reads the register, and the traps I hit on the way. All numbers below come from the file I downloaded on 3 November 2026 (Asia/Shanghai time). The register changes, so re-run the script before you quote anything.

Where the data lives

The CNV's PSAV page links to an Excel export:

https://www.cnv.gov.ar/SitioWeb/Reportes/ListadoRegistrosPsav

No key and no login. The server names the file with a timestamp (mine was listado_Registros_PSAV_02112026231045.xlsx), so save it under a fixed name:

curl -sL -o psav.xlsx "https://www.cnv.gov.ar/SitioWeb/Reportes/ListadoRegistrosPsav"

The script

import re
from collections import Counter
from urllib.parse import urlparse
import openpyxl

wb = openpyxl.load_workbook("psav.xlsx")  # NOT read_only=True, see trap 1

def rows(sheet):
    ws = wb[sheet]
    it = ws.iter_rows(values_only=True)
    next(it)                               # row 1: title banner
    header = [h for h in next(it) if h]    # row 2: the real header
    for r in it:
        if any(r):
            yield dict(zip(header, r[:len(header)]))

firms = list(rows("Juridicas"))   # legal persons
people = list(rows("Humanas"))    # natural persons
print("legal persons:", len(firms), "| natural persons:", len(people))

nums = [f["Nro. Matricula"] for f in firms]
print("registration numbers:", min(nums), "to", max(nums), "| unique:", len(set(nums)))

by_year = Counter(f["Fecha Alta"].year for f in firms)
print("by year:", dict(sorted(by_year.items())))
latest = max(firms, key=lambda f: f["Fecha Alta"])
print("latest entry:", latest["Fecha Alta"].date(), "no.", latest["Nro. Matricula"])

def activities(f):
    return [a.strip().rstrip(".") for a in str(f["Actividad"]).split(" / ") if a.strip()]

acts = Counter(a for f in firms for a in activities(f))
for name, n in acts.most_common():
    print(f"{n:>3}  {name[:60]}")
print("activities per firm:", dict(sorted(Counter(len(activities(f)) for f in firms).items())))

def host(cell):
    s = re.sub(r"^(https?://)+", "", str(cell or "").strip(), flags=re.I)
    h = urlparse("https://" + s).hostname or ""
    return h.lower() if "." in h else None   # "En construccion" -> None

hosts = [host(f["Sitio Web"]) for f in firms]
print("no usable website:", hosts.count(None))
print(".ar website:", sum(1 for h in hosts if h and h.endswith(".ar")), "of", len(firms))

Output on 3 November 2026:

legal persons: 81 | natural persons: 0
registration numbers: 2 to 174 | unique: 81
by year: {2023: 1, 2024: 47, 2025: 21, 2026: 12}
latest entry: 2026-10-22 no. 174
 74  Intercambio entre activos virtuales y monedas de curso legal
 72  Transferencia de activos virtuales
 67  Intercambio entre una (1) o mas formas de activos virtuales
 57  Custodia y/o administracion de activos virtuales o instrumen
 37  Participacion y provision de servicios financieros relaciona
activities per firm: {1: 8, 2: 8, 3: 11, 4: 20, 5: 34}
no usable website: 6
.ar website: 74 of 81

(Accents stripped in this listing; the file has them.)

Five traps in the file

1. read_only=True silently drops most rows. openpyxl's read-only mode trusts the sheet's stored dimension tag, and in this export it is wrong. In read-only mode the "Juridicas" sheet reports max_row 3. Loaded normally, it has 83 rows: a title, a header and 81 firms. If your count is suspiciously tiny, this is why.

2. The header is on row 2, not row 1. Row 1 is a centred title ("Listado de Registros PSAV - Personas Juridicas"). Using row 1 as a header gives you one named column and a pile of Nones. The two sheets also have different columns: "Humanas" has no Nombre Comercial. Read the header per sheet.

3. Registration numbers are not a count. Nro. Matricula runs from 2 to 174, but there are 81 rows. The file does not say why numbers are missing, so do not use the highest number as "how many firms have registered". Count rows.

4. Activities are one string. Each firm's Actividad cell joins its activities with " / ". In this export the fifth activity always comes last and carries the cell's closing full stop ("...venta de un activo virtual."). Split on " / ", strip, and drop the trailing dot, so each label matches the same activity written anywhere else, including in the legal text. The five labels correspond to the five activities in the legal definition of a PSAV.

5. The website column is free text. 41 entries have no scheme (www.example.com.ar), one has the scheme twice (https://https://...), and six are placeholders like "En construccion" or "En proceso". A naive urlparse(cell).netloc returns an empty string for most of them, and my first .ar count came out at 39 instead of 74.

Why this matters now: the monthly clock

On 14 October 2026 the CNV adopted General Resolution 1172/2026, which rewrites the PSAV chapter of its rules. Under the new Article 40(b), registered PSAVs must file, within 15 calendar days after the end of each month, their number of clients, monthly traded volume in US dollars, their ten most-traded virtual assets and the assets they hold in custody. The filing uses form PSAV_014, and the resolution says this monthly information applies from 1 November 2026. A registered PSAV that has not started operating must say so on form PSAV_015 instead. VASP Tracker covered the details in its news item on the monthly reporting duty.

That makes the register the denominator for compliance. 81 legal persons on the list means 81 firms that either file monthly or declare that they have not started. 57 of them list custody as an activity, so the custody block of the report is not a niche case.

Two more details from the resolution are useful if you build tools on top of the register:

The legend. Registered PSAVs must show "Inscripto bajo el N... en el Registro de PSAV de la CNV (Republica Argentina)" on their website, app and social media. The number in that legend is the Nro. Matricula in the file, so a platform's claim can be checked against the register by number, not by fuzzy name matching.
What stays private. Custody wallet addresses reported to the CNV are explicitly "not public". Do not expect the export to grow a wallet column.

A simple check you can run

def check_claim(number: int, name_fragment: str) -> str:
    match = next((f for f in firms if f["Nro. Matricula"] == number), None)
    if match is None:
        return f"No. {number} is not on the register"
    names = f'{match["Razon Social"]} {match.get("Nombre Comercial") or ""}'.lower()
    if name_fragment.lower() in names:
        return f'OK: {match["Razon Social"]}, registered {match["Fecha Alta"].date()}'
    return f'No. {number} belongs to {match["Razon Social"]}, not "{name_fragment}"'

Run it against a fresh download every time. A number that was valid last month can disappear.

If you would rather not maintain a parser, VASP Tracker's Argentina register page follows the same CNV file.

This is not legal advice. The CNV register and the text of General Resolution 1172/2026 on InfoLEG are the official sources; check them before relying on any number here.

VASP Tracker is an independent tracker. It is not an official source and is not affiliated with any regulator.

Daniel Bradley, VASP Tracker

Tracking GENIUS Act rulemaking with the Federal Register API (and why a naive search lies to you)

VASP Tracker — Tue, 27 Oct 2026 02:14:26 +0000

The US stablecoin law, the GENIUS Act, was signed on 18 July 2025. Since then the federal banking agencies and Treasury have been publishing proposed rules, notices and, now, final rules. Every one of them lands in the Federal Register, which has a free, keyless JSON API.

This post walks through a short script that builds a clean list of those documents, and through the two traps I hit on the way: a search term that matches far too much, and a "document type" field that does not mean what you think.

The endpoint

GET https://www.federalregister.gov/api/v1/documents.json

Useful parameters:

conditions[term] for full-text search
fields[] (repeatable) to choose which fields come back
per_page (up to 100) and order
the response's next_page_url for pagination

No API key and no auth. Be polite with request rates anyway.

Version 1: search for "GENIUS"

import requests

API = "https://www.federalregister.gov/api/v1/documents.json"
ENACTED = "2025-07-18"  # GENIUS Act signed into law

def fetch(term):
    params = {
        "conditions[term]": term,
        "per_page": 100,
        "order": "oldest",
        "fields[]": ["document_number", "publication_date", "type",
                     "action", "title", "effective_on", "citation"],
    }
    url, docs = API, []
    while url:
        r = requests.get(url, params=params, timeout=30)
        r.raise_for_status()
        page = r.json()
        docs += page.get("results", [])
        # next_page_url already carries the query string
        url, params = page.get("next_page_url"), None
    return docs

raw = fetch("GENIUS")
print(len(raw))

When I ran this on 27 October 2026 it returned 116 documents. Most of them have nothing to do with stablecoins. The full-text search matches the word anywhere, so you get State Department notices about exhibitions of "culturally significant objects" with "genius" in the exhibition title, and Interior Department notices about the Theodore Roosevelt Genius Prize.

Version 2: filter on title and date

The cheap fix worked well. Keep a document only if it was published on or after the enactment date and its title mentions "stablecoin" or "genius":

def relevant(doc):
    t = doc["title"].lower()
    return (doc["publication_date"] >= ENACTED
            and ("stablecoin" in t or "genius" in t))

docs = [d for d in raw if relevant(d)]

from collections import Counter
print(len(docs), Counter(d["type"] for d in docs))

Output on 27 October 2026:

23 Counter({'Proposed Rule': 16, 'Notice': 5, 'Rule': 2})

Twenty-three documents. That matches the list VASP Tracker keeps on its US stablecoin rulemaking page. I treat that agreement as a sanity check, not proof. If you need completeness, also query by agency and by docket.

Trap 2: "Proposed Rule" doesn't always mean a proposal

The type field is the Federal Register's category, not a description of what the document does. One example is FDIC document 2026-02665, published 11 February 2026. Its type is "Proposed Rule", but it is an extension of a comment period on an earlier proposal.

So if you want to know what a document actually does, read the action field:

for d in docs:
    if d["type"] == "Rule":
        print(d["publication_date"], d["document_number"], d["citation"],
              d["action"], "| effective:", d["effective_on"])

2026-09-30 2026-19966 91 FR 61688 Interim final rule; request for comments. | effective: 2026-09-30
2026-10-23 2026-21706 91 FR 67000 Final rule. | effective: 2027-01-18

The first is a Treasury interim final rule on forms and procedures for the review of state certifications by the Stablecoin Certification Review Committee. Comments close 30 November 2026. The second is the OCC's final rule implementing the Act for issuers under OCC jurisdiction. Its dates section says it "is effective on January 18, 2027."

The "earlier of" rule, in code

Why does a final rule matter so much? Section 20 of the Act says it takes effect on the earlier of:

18 months after enactment, or
120 days after the primary Federal payment stablecoin regulators issue any final regulations implementing the Act.

That second trigger is why people kept watching for final rules. The arithmetic is easy to check:

from datetime import date, timedelta

enacted = date(2025, 7, 18)
eighteen_months = date(2027, 1, 18)          # 18 calendar months later
occ_final = date(2026, 10, 23)               # Federal Register publication
via_rule = occ_final + timedelta(days=120)   # 2027-02-20

print(min(eighteen_months, via_rule))        # 2027-01-18

Even if you count from the OCC's announcement on 21 October 2026, the 120-day date is 18 February 2027. Both are later than 18 January 2027, so the 18-month limb wins. That is consistent with the OCC's own news release (NR 2026-92), which says "the final rule and the GENIUS Act take effect on January 18, 2027". Treasury's interim final rule also expects the Act to take effect on that date.

Two caveats before you hard-code that date into anything:

A date in a press release is not a licence. The OCC says applications are not open yet and that it will announce them separately. Its AML/sanctions rules for issuers are coming separately too, coordinated with Treasury.
Another clock runs longer. Section 3(b)(1) makes it unlawful for a digital asset service provider to offer or sell a payment stablecoin to a person in the United States unless a permitted issuer issued it, starting three years after enactment. By my calculation that is 18 July 2028.

VASP Tracker has a longer write-up of the effective-date question if you want the legal background rather than the code.

Making it a daily job

Store document_number as the primary key. It is stable.
Diff each run against yesterday's set and alert on new rows where type == "Rule". Also alert on any action containing "final".
Keep the raw JSON. effective_on can be null on rules that set their dates in the text.
Don't trust the term search alone. Log what your filter rejects and skim it now and then, because a document titled "Payment stablecoins..." from a new agency is exactly what you don't want to drop.

The whole thing is about 40 lines and runs in under a second. That makes it one of the cheapest regulatory monitors you can build.

Not legal advice. This post describes public records and code; check the primary sources before relying on any date.

VASP Tracker is an independent tracker. It is not an official source and is not affiliated with any regulator.

Parsing ESMA's MiCA CASP Register in Python: Six Data Gotchas (and a Deadline Calendar to Go With It)

VASP Tracker — Wed, 21 Oct 2026 19:39:29 +0000

Since the last MiCA transitional periods ended on 1 July 2026, "is this firm authorised in the EU?" has a single first place to look: ESMA's interim MiCA register. It isn't a database with an API. It's a set of CSV files that ESMA re-publishes on its MiCA page, weekly according to ESMA. That makes it easy to download and surprisingly easy to misread.

This post walks through a small, dependency-free Python script that:

pulls a machine-readable calendar of upcoming crypto licensing deadlines, and
loads ESMA's authorised-CASP file and cleans up the quirks I hit doing it.

Everything below was run on 22 October 2026 against the file ESMA lists as last updated on 19 October 2026. Your counts will differ when ESMA refreshes the file. That's the point of scripting it.

Step 1: A Deadline Calendar as Data

At VASP Tracker we publish our jurisdiction and deadline data as open data (CC BY 4.0). The JSON file has two arrays: jurisdictions (one row per jurisdiction, with its regulator, status and official register URL) and events (one row per dated event).

The fields you'll care about in events:

field	meaning
`date`	ISO date of the event
`event_type`	e.g. `application_deadline`, `transition_end`, `ban`, `regime_start`, `in_force`
`key_date`	`true` for the dates that change what firms may do
`our_calculation`	`true` when the date isn't printed in the source but derived from it (e.g. "one year from commencement")
`source_urls`	pipe-separated links to the law, gazette or regulator notice

The our_calculation flag matters. If you build alerts on these dates, show calculated dates differently from dates the regulator actually printed.

Step 2: The Script

Standard library only, Python 3.9+.

import csv, io, json, urllib.request
from collections import Counter
from datetime import date, datetime

def get(url: str) -> bytes:
    req = urllib.request.Request(url, headers={"User-Agent": "licence-deadline-check/0.1"})
    with urllib.request.urlopen(req, timeout=60) as r:
        return r.read()

# --- 1. The deadline calendar -------------------------------------------
cal = json.loads(get("https://vasptracker.com/data/global/deadlines.json"))
today = date.today().isoformat()

upcoming = sorted(
    (e for e in cal["events"] if e["key_date"] and e["date"] >= today),
    key=lambda e: e["date"],
)
for e in upcoming:
    calc = "  (calculated)" if e["our_calculation"] else ""
    print(f'{e["date"]}  {e["jurisdiction"]:<15} {e["event_type"]}{calc}')
    print(f'            source: {e["source_urls"].split(" | ")[0]}')

print(Counter(j["register_format"] for j in cal["jurisdictions"]))

# --- 2. ESMA's interim MiCA register (authorised CASPs) ------------------
raw = get("https://www.esma.europa.eu/sites/default/files/2024-12/CASPS.csv")
rows = list(csv.DictReader(io.StringIO(raw.decode("utf-8-sig"))))  # strip the BOM

def d(s: str):
    """ESMA dates are dd/mm/yyyy. A few cells hold values like '06-May'
    (no year), so return None instead of guessing."""
    s = (s or "").strip()
    try:
        return datetime.strptime(s, "%d/%m/%Y").date()
    except ValueError:
        return None

casps = []
for r in rows:
    r = {k: (v or "").strip() for k, v in r.items()}           # 'NL ' -> 'NL'
    r["services"] = [x.strip() for x in r["ac_serviceCode"].split("|") if x.strip()]
    r["passports"] = [x.strip() for x in r["ac_serviceCode_cou"].split("|") if x.strip()]
    r["authorised_on"] = d(r["ac_authorisationNotificationDate"])
    r["ended_on"] = d(r["ac_authorisationEndDate"])
    casps.append(r)

active = [r for r in casps if not r["ended_on"] or r["ended_on"] > date.today()]
print(len(rows), "rows,", len({r["ae_lei"] for r in casps}), "distinct LEIs,", len(active), "without a past end date")
print(Counter(r["ae_homeMemberState"] for r in active).most_common(5))
print("latest record update:", max(d(r["ac_lastupdate"]) for r in casps if r["ac_lastupdate"]))
print("unparseable authorisation dates:",
      sum(1 for r in casps if r["ac_authorisationNotificationDate"] and not r["authorised_on"]))
print(Counter(r["ac_legal_basis"] for r in casps))

Output (22 Oct 2026)

The calendar part prints the next key dates with their primary source:

2026-10-30  Brazil          application_deadline
2026-11-04  Kenya           transition_end  (calculated)
2026-11-06  Brazil          ban
2027-01-18  United States   effective_date
2027-02-28  United Kingdom  application_deadline
2027-04-09  Australia       in_force
2027-07-01  Russia          transition_end
2027-07-22  Japan           effective_date  (calculated)
2027-10-25  United Kingdom  regime_start

(Source lines omitted here for space.) The register_format counter shows why "just scrape the registers" is harder than it sounds. Across the 76 jurisdictions in the file, 31 official registers are CSV, 26 are HTML pages, 7 are PDFs, one is CSV plus an API (Brazil's Central Bank), one is HTML plus an API (the UK FCA), and 10 have no register we could find.

The ESMA part printed:

379 rows, 376 distinct LEIs, 377 without a past end date
[('DE', 109), ('FR', 36), ('NL', 28), ('CY', 24), ('MT', 23)]
latest record update: 2026-10-15
unparseable authorisation dates: 10
Counter({'': 180, 'Article 60 - Notification': 117, 'Article 63 - CASP authorisation': 66, 'Article 63': 10, 'Article 60': 6})

The Six Gotchas

1. There's a UTF-8 BOM. The file starts with EF BB BF. Decode with utf-8-sig, or your first column will be called \ufeffae_competentAuthority and every row["ae_competentAuthority"] lookup will raise KeyError.

2. Values have trailing whitespace. All 29 Dutch rows have ae_homeMemberState set to "NL ", not "NL". Group by country without stripping and the Netherlands quietly splits in two. Strip every cell.

3. Dates are dd/mm/yyyy strings, and a few aren't dates at all. Calling max() on the raw ac_lastupdate strings returned 31/08/2026. The real latest update after parsing was 15 October 2026. Ten ac_authorisationNotificationDate cells hold values like 06-May, with no year (it looks like a spreadsheet auto-format). Parse explicitly and treat failures as unknown, not as today.

4. One row is not one firm. 379 rows, 376 distinct LEIs. The duplicates I found are firms with more than one entry (separate notifications with different dates and services). If you want "number of firms", count distinct ae_lei. If you want "number of authorisation events", count rows. Decide which one you mean.

5. Multi-value fields use inconsistent separators. ac_serviceCode lists the MiCA services (a. custody â€¦ j. transfer services). 205 rows separate them with " | " and 64 with a bare "|". Split on | and strip, never on " | ". ac_serviceCode_cou (the passporting countries) uses | too.

6. The legal-basis column is half empty and not normalised. 180 rows have no ac_legal_basis. The rest mix Article 63 - CASP authorisation with Article 63, and Article 60 - Notification with Article 60. The difference is real: Article 63 is the standard CASP authorisation, while Article 60 lets certain already-regulated financial entities (credit institutions and investment firms, for example) provide crypto-asset services after notifying their regulator. Normalise on the article number, and keep "unknown" as its own bucket rather than guessing.

Bonus: ESMA says withdrawn authorisations stay in the file, with the date the withdrawal took effect. Only 2 rows had an ac_authorisationEndDate when I ran this. Filter on it anyway, or you'll count a withdrawn firm as live.

What This Doesn't Tell You

The ESMA file is interim and second-hand. ESMA compiles it from what national competent authorities send. ESMA itself warns that information already in a national register may not show up immediately. For a decision that matters, check the national register of the home member state too.
Absence isn't proof of anything. A missing firm may be authorised under another legal entity name (always search by LEI and by legal name, not by brand), or the record may simply not have arrived yet.
Calculated dates are calculations. Treat our_calculation: true events as "derived from the source", and link users to the source.

If you'd rather not maintain the cleaning code yourself, our EU open-data page has a dated snapshot of ESMA's CASP file (selected columns) plus a per-firm table with ISO dates, LEIs, service codes and passporting states, and per-member-state transition data, under the same CC BY 4.0 licence. Corrections are welcome at press@vasptracker.com.

VASP Tracker is an independent project and is not affiliated with ESMA or any national regulator. Nothing here is legal advice. Always confirm a firm's status with the competent authority.

Sources

ESMA, Markets in Crypto-Assets Regulation (MiCA) page: Interim MiCA Register (update frequency, field description, treatment of withdrawn records): https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/markets-crypto-assets-regulation-mica
ESMA, interim MiCA register, authorised CASPs file (CASPS.csv), accessed 22 Oct 2026: https://www.esma.europa.eu/sites/default/files/2024-12/CASPS.csv
ESMA, Public Statement on the end of MiCA transitional periods (June 2026): https://www.esma.europa.eu/sites/default/files/2026-06/ESMA75-113276571-1710_Public_Statement_MiCA_transitional_period_ends.pdf
Regulation (EU) 2023/1114 (MiCA), Arts. 60, 63 and 143(3): https://eur-lex.europa.eu/eli/reg/2023/1114/oj
VASP Tracker open data, deadlines.json (CC BY 4.0): https://vasptracker.com/data/global/deadlines.json
VASP Tracker, EU open data: https://vasptracker.com/en/eu/data/