EU finance ministers agreed to give the European Securities and Markets Authority direct oversight of the bloc’s largest crypto-asset service providers under a proposed MiCA overhaul. The plan addresses a passporting gap that lets a firm licensed in one member state serve customers across all 27 EU countries. Only 10 to 15 of roughly 360 providers would initially qualify for centralized supervision.
Why it matters
MiCA’s passporting system reduces duplication for firms expanding across Europe, but it also leaves the home-country regulator responsible for an operation that may have customers, assets and technology systems across the bloc. A July 2025 ESMA review of a Maltese authorization highlighted the risk, citing unresolved questions around governance, conflicts of interest, technology, custody and anti-money-laundering controls.
The proposed framework would shift oversight based on scale and financial connections rather than a provider’s place of incorporation. Direct ESMA supervision would cover firms with at least 15 million active EU users, or those meeting three of five additional criteria. These include more than 1 million active users, over €1 billion in crypto assets under custody and more than €4 billion in annual client transactions.
Market impact
ESMA would gain powers to request information, conduct inspections, investigate breaches, impose penalties, restrict services and withdraw authorization. Most providers would remain under national regulators, while ESMA would use guidelines, peer reviews and coordinated investigations to address uneven enforcement.
The Council’s agreement is a negotiating position, not a change in law. The European Parliament must establish its own position before talks begin. A two-year transition is envisaged, with existing MiCA licenses remaining valid for firms moved under direct supervision. The final thresholds, ESMA’s resources and treatment of firms near the cutoff will determine the framework’s reach.
Frequently asked questions
-
How many crypto providers would face direct ESMA supervision?
The Council’s proposal would initially cover about 10 to 15 of roughly 360 crypto-asset service providers.
-
What user threshold could trigger ESMA oversight?
Direct supervision would apply to providers with at least 15 million active EU users, or to firms meeting three of five additional significance criteria.
-
What other criteria are included in the proposed framework?
The criteria cover customer numbers, crypto assets under custody, annual client transactions and financial interconnectedness. Examples include more than 1 million users, €1 billion in custody and €4 billion in annual transactions.
-
What powers would ESMA gain under the proposal?
ESMA could request information, conduct inspections, investigate breaches, impose penalties, restrict services and withdraw authorizations.
-
Has the new ESMA supervision system become law?
No. The Council has agreed on a negotiating position, but the European Parliament must establish its own position before interinstitutional talks can begin.
CryptoSlate