Crypto Regulation: Canada, EU MiCA, UK, France, Spain, Japan
Canada, the EU, the UK, France, Spain and Japan all regulate crypto, but through different systems. The EU's MiCA regulation has applied since 30 December 2024 with a single CASP license that passports across the bloc; the UK, Canada, France, Spain and Japan each keep national regimes built on securities, payments or investment-services law. In every country the practical safeguards are the same three tools: the regulator, the public register and the warning list. This guide maps each system and shows how to verify a platform where you live.
Crypto is legal in all six places this page covers — Canada, the European Union, the United Kingdom, France, Spain and Japan. What changes at each border is who supervises the industry, what a license looks like and how much of your money is protected if a firm fails. The differences are practical: the same platform can be registered in one country and merely tolerated in another.
Every serious crypto review — including ours — rests on three public instruments, and all six systems have them. The first is the regulator: the authority that registers crypto businesses and pursues the ones that never registered. The second is the register: a free public database where a license or corporate entry is confirmed in minutes. The third is the warning list: where the regulator names firms approaching the public without authorization. Run those three checks in your own country and you no longer depend on marketing to know who you are dealing with.
Each country below follows the same order: who regulates, where to verify, what the warning list covers, what protection exists if a firm fails, and the practical details. Everything here is current as of October 2026; rules move fast, so treat the regulator’s own pages as the final word.
Canada: securities law, CIRO and CIPF
Canada has no dedicated crypto statute. Crypto businesses are supervised under existing securities law, coordinated by the Canadian Securities Administrators (CSA) — the forum of provincial and territorial regulators — with the Ontario Securities Commission (OSC) as its largest member. Platforms offering Canadians crypto contracts or tokens considered securities must register with the OSC, and since 2021 the CSA has required operating platforms to file pre-registration undertakings.
The check has two layers. A platform itself is usually just a corporation: in Ontario it appears in the Ontario Business Registry (ontariobusinessregistry.ca) with an Ontario Corporation Number and an incorporation date. The trading account, however, often sits with a partner broker that is a member of CIRO — the Canadian Investment Regulatory Organization, the self-regulatory body formed on 1 January 2023 from the merger of IIROC and the MFDA. CIRO publishes its membership in the “Dealers We Regulate” list at ciro.ca; checking both layers matters, because protection follows the broker, not the brand. Our MetreturnETH review shows the pattern: an Ontario corporation, a CIRO-member partner for the accounts, Interac withdrawals cleared in minutes to two hours.
That protection is the Canadian Investor Protection Fund (CIPF): if a CIRO member becomes insolvent, it covers client assets within limits — up to CA$1 million per account category. Custody failure is covered; market losses never are.
Warnings come from the OSC’s investor warnings page and the CSA’s national alerts. Absence from either list is not an endorsement. Practically, Interac e-Transfer moves money in minutes, and most platforms denominate accounts in US dollars: a US$250 minimum is roughly CA$340, and each deposit and withdrawal crosses an FX spread, so the real cost of a round trip can exceed the headline fee.
The European Union: MiCA’s single license
Before MiCA, Europe was a patchwork: Germany licensed crypto custody through BaFin, France ran its own registration regime, and authorization in one member state guaranteed nothing in the next. The Markets in Crypto-Assets Regulation (MiCA, Regulation (EU) 2023/1114) ended that. Its core provisions have applied since 30 December 2024, in every EU member state plus Iceland, Liechtenstein and Norway.
The central concept is the CASP — a crypto-asset service provider. A CASP is authorized once, by its home national competent authority (the AMF in France, the CNMV in Spain, BaFin in Germany), and the license passports across the whole European Economic Area: a business legal in Paris is legal in Madrid and Berlin without re-registering. Firms registered under old national regimes run on transitional periods of up to 18 months — into 2026 — while converting, so an old registration and a new MiCA license are both legitimate findings.
Stablecoins got their own chapter: issuers of asset-referenced and e-money tokens must be authorized, hold segregated reserves and honor redemption rights, with caps on non-EEA-currency stablecoins widely used for payments; we covered the rules when finalized.
Tax was the next domino: DAC8, adopted in 2023, obliges crypto-asset service providers to report client holdings and transactions, with automatic exchange between tax authorities from 1 January 2026 — the Spain section shows what that means in practice. One boundary: MiCA is EU law, and a CASP license does not by itself authorize service in the UK, Canada or Japan.
United Kingdom: the FCA Register and the promotions regime
The UK kept its own path after leaving the EU. Cryptoasset businesses must register with the Financial Conduct Authority (FCA) under the Money Laundering Regulations, in force since January 2020; the FCA is the single point of supervision. Registration is a real gate — the FCA has refused and withdrawn registrations, and operating without one is a criminal offense.
The verification tool is the FCA Register at register.fca.org.uk. Search the legal entity name, not the brand, and read the Firm Reference Number (FRN), permissions and status. In our SterlingVault AI review, the register entry (FRN 987654) settled within a minute who actually holds the accounts. One caveat: many crypto firms are registered only for anti-money-laundering purposes — not the same as full authorization, and a broader regime for exchanges and stablecoins is still being phased in. The corporate entity behind the brand can be checked separately at Companies House.
The FCA also maintains a Warning List of firms it believes operate without authorization, alongside ScamSmart. Absence is not an endorsement — the FCA says so itself.
Marketing tightened fastest. Since 8 October 2023 crypto promotion is a regulated financial promotion: ads must be fair, clear and not misleading, carry a prescribed risk warning, give first-time investors a 24-hour cooling-off period and avoid refer-a-friend incentives. A platform promising guaranteed returns breaks a specific rule.
On compensation, precision matters: the Financial Services Compensation Scheme (FSCS) protects regulated activities, but pure crypto holdings are generally outside it, because crypto is not yet a specified investment under UK law. Protection follows the regulated entity — often the partner broker. Practically, GBP moves over Faster Payments in minutes to two hours.
France: the AMF, ORIAS and the listes noires
France pairs a markets regulator with a banking one. The Autorité des marchés financiers (AMF) supervises investment services; the Autorité de contrôle prudentiel et de résolution (ACPR) supervises banks and payment institutions, with its Regafi register (regafi.fr) of financial intermediaries. Since MiCA applies, the AMF authorizes crypto-asset service providers for France; before it came the PSAN registration of the 2019 PACTE law.
Advisory-type firms sit on a separate track: a conseiller en investissements financiers (CIF) must be registered with ORIAS (orias.fr, an eight-digit number) and belong to an AMF-approved association such as ANACOFI-CIF. Our Vaste Cautévane review documents the drill: the ORIAS entry (No. 21004877), the association membership and the guarantee-fund adhesion were the three decisive checks.
Blacklists are a French specialty: the AMF, jointly with the ACPR, publishes listes noires — regularly updated lists of websites approaching French investors without authorization. Both lists are worth a search, because coverage differs.
Compensation comes from the FGVIF, the fund for victims of financial investment fraud, which can pay up to €100,000 to clients defrauded by regulated firms — including CIF advisers and their agents. It covers fraud, not trading losses. Since 17 January 2025 the Digital Operational Resilience Act (DORA) adds ICT-risk and outsourcing rules on top of MiCA for financial entities including CASPs.
Practically, France runs on SEPA: domestic transfers arrive in minutes to hours, cross-border within a day, and card payments are universal.
Spain: the CNMV, Banco de España and FOGAIN
Spain’s oversight is shared between two institutions. The Comisión Nacional del Mercado de Valores (CNMV) is the securities markets regulator: it now authorizes CASPs under MiCA and keeps the registro de empresas de servicios de inversión, the register of investment services companies where signal and advisory platforms appear with an inscription number. The Banco de España historically held the register for crypto exchange and custody firms under anti-money-laundering rules, and it continues to warn about unauthorized entities.
The routine is the same as elsewhere: entity name and number from the terms, then the register search, then the lists. Our Dinexura review shows it on a real platform — a CNMV inscription (No. 412) and FOGAIN membership framed the assessment.
The CNMV’s lista de advertencias is the warning list: entities providing investment services in Spain without authorization, updated continuously. The Banco de España maintains its own list of unauthorized institutions. Absence from both is not approval.
Investor protection is FOGAIN, the Fondo de Garantía de Inversiones, covering up to €100,000 per investor when an investment firm holding client funds or securities fails. As everywhere, it covers custody failure, not market losses, and attaches to the regulated entity.
Spain’s tax layer changed at the start of 2026: under DAC8, Spanish platforms, exchanges and custodians must report client holdings and transactions to the tax agency (AEAT) from January 2026, with the data flowing to other EU tax authorities — we covered the change separately. Practical rails: Bizum for instant small payments, SEPA for the rest, typically minutes to 24 hours.
Japan: FSA registration and the 無登録業者 list
Japan regulates crypto through the Financial Services Agency (FSA) and two laws. Crypto exchange businesses register under the Payment Services Act; investment advisory and agency businesses register under the Financial Instruments and Exchange Act — 金融商品取引法, abbreviated 金商. A registration number looks like 関東財務局長（金商）第3126号 — issued by a regional finance bureau, here the Kanto Local Finance Bureau — and verifiable on the FSA’s search page. The corporate layer is separate: every Japanese company carries a 13-digit 法人番号 (corporate number) on the National Tax Agency portal, houjin-bangou.nta.go.jp.
Self-regulation sits on top. Investment advisers belong to the Japan Investment Advisers Association (JIAA, 一般社団法人日本投資顧問業協会), the SRO for the advisory business. Our ZaiChain AI review runs the full check from public sources: FSA registration (Kinsho No. 3126), corporate number, JIAA membership and the warning-list search.
That warning list is the 無登録業者 list — literally “unregistered operators” — updated with firms soliciting Japanese residents without registration, plus a separate high-risk list for outright fraud cases. Absence is, as everywhere, not an endorsement.
Practically, Japan runs on PayPay and bank transfer (銀行振込): domestic transfers arrive in minutes to hours. Tax deserves one careful sentence: crypto profits were historically taxed as miscellaneous income at progressive rates reaching about 55%, but from 2026 Japan applies a separate flat rate of around 20%. The details belong to a tax adviser; the 55% surprise is no longer the default.
There is no Japanese analogue to FOGAIN or the FSCS for advisory clients — protection rests on the FIEA framework, segregation duties and the SRO. Worth knowing when comparing systems: the registration gate is among the strictest here.
How to use this page
The routine is identical everywhere. Get the legal entity name and registration number from the terms, not the homepage. Search your country’s register — the Ontario Business Registry and CIRO’s list in Canada, the FCA Register in the UK, ORIAS and Regafi in France, the CNMV register in Spain, the FSA search in Japan, or your member state’s CASP authority in the EU. Search the same regulator’s warning list. Establish who actually holds your money — that determines which compensation fund, if any, applies. And check the dates: a registration that lapsed last year is not a registration.
None of this takes more than ten minutes. Our scam guide has the extended checklist for cases where something looks wrong, and how we check for scams shows the procedure we apply to every platform reviewed on this site — the same registers, warning lists and questions about who holds the accounts.
FAQ
Is crypto legal in all six of these countries?
Yes. Buying, holding and selling crypto is legal in all six. What each regulates is the business around the assets — who may offer exchange, custody, advice and marketing, and on what conditions. None of the six has banned crypto trading.
Does MiCA apply in the UK, Canada or Japan?
No. MiCA is an EU regulation, binding in the member states and the wider EEA. The UK, Canada and Japan kept national regimes: FCA registration under the Money Laundering Regulations in the UK, securities-based registration in Canada, FSA registration under the Payment Services Act and FIEA in Japan. A CASP license does not by itself authorize service there.
If a platform fails, is my money protected?
It depends on the country and on which entity holds the money. Canada’s CIPF covers clients of CIRO members up to CA$1 million per account category. Spain’s FOGAIN and France’s FGVIF each cover up to €100,000 — FOGAIN when an investment firm fails, FGVIF for fraud by regulated firms. The UK’s FSCS protects regulated activities but generally not pure crypto holdings. Japan has no state fund for advisory clients. No scheme covers trading losses.
How do I check whether a crypto platform is licensed?
Take the legal entity name and registration number from the terms page, then search the national register — the Ontario Business Registry and ciro.ca for Canada, register.fca.org.uk for the UK, orias.fr and regafi.fr for France, the CNMV register for Spain, the FSA search for Japan — and confirm the number matches. Then search the same regulator’s warning list. The routine takes under ten minutes and beats any testimonial.
What is a warning list, and does absence mean a platform is safe?
A regulator’s public list of firms it believes operate without authorization or with fraud concerns: the OSC warnings and CSA alerts in Canada, the FCA Warning List in the UK, the AMF listes noires in France, the CNMV lista de advertencias in Spain, the FSA’s 無登録業者 list in Japan. Absence is not an endorsement — a firm can be missing simply because nobody has complained yet. Always pair the warning-list search with the register check.
How is crypto taxed in these countries?
Differently, and often: Japan applies a separate flat rate of around 20% to crypto profits from 2026, replacing progressive miscellaneous-income treatment. In the EU, DAC8 requires platforms to report client data to tax authorities from January 2026 — in Spain, to the AEAT. Canada taxes crypto as property under capital-gains rules; the UK under capital gains tax. Rates shift with budgets, so a local tax adviser is the final word.
Disclaimer
This guide is general information about publicly known regulatory frameworks as of October 2026. It is not legal, tax or investment advice, and it does not assess any specific platform. Rules change — transitional periods expire, registers update, warning lists grow — so verify current requirements with the regulator before acting. Crypto-assets are high-risk instruments; you can lose your entire investment.