The Council of the European Union reached a political agreement on Oct. 9 to give the European Securities and Markets Authority (ESMA) direct oversight of the bloc’s largest crypto asset service providers. The move is part of a broader effort to integrate European financial markets and close a gap in the Markets in Crypto Assets Regulation (MiCA).
Under MiCA, a crypto firm licensed in one member state can serve customers across all 27 countries. While this passporting model cuts costs for companies expanding in Europe, it also means one national regulator can make an approval decision affecting users far beyond its own market. For large firms, that can leave oversight spread thin.
Council backs central ESMA oversight
The Council’s plan would let ESMA supervise crypto providers with at least 15 million active users in the EU. Firms could also qualify if they meet three of five extra criteria, including more than 1 million active users, over €1 billion in crypto assets under custody, and more than €4 billion in annual client transactions. Other factors cover customer base, custody assets, transaction volumes, and financial interconnectedness. The idea is that scale and links to the financial system, not just where a company is incorporated, would decide who gets EU-level supervision. Still, officials estimate only 10 to 15 of roughly 360 providers would qualify, Reuters reported—much narrower than the European Commission’s original plan to move all crypto service providers under ESMA.
Malta review exposed passporting gap
The debate did not appear out of nowhere. A July 2025 ESMA review examined the Malta Financial Services Authority’s authorization of an unnamed crypto provider. ESMA asked why the company was approved while material issues remained unresolved. Reviewers found insufficient evidence that the licensing assessment properly covered governance, conflicts of interest, technology infrastructure, custody arrangements, and some anti-money-laundering risks. The review did not prove every Maltese license was weak; it even credited the regulator with sector expertise and sufficient supervisory resources, while recommending improvements to its authorization process. Malta later said it would implement the recommendations but opposed moving supervision to ESMA. In September 2025, the authority argued MiCA was too new for another regulatory layer and warned that centralization could add bureaucracy and hurt competitiveness.
Thresholds and transition remain unresolved
Under the draft, ESMA would gain powers to request information, conduct inspections, investigate breaches, and impose penalties. It could also restrict services or withdraw authorization if firms fail to meet requirements. Most crypto providers would stay with national regulators. ESMA would use guidelines, peer reviews, coordinated investigations, and some intervention powers to address uneven enforcement. The plan also calls for a full-time ESMA executive board with a chair and five independent members. A two-year transition would move information, operational duties, and expertise to ESMA. Existing MiCA licenses for directly supervised companies would remain valid, so they would not automatically need new authorization. The Council’s agreement is a negotiating position, not law. Talks with the European Parliament still have to settle final thresholds, ESMA’s resources, and how firms near the cutoff are treated.
