In a significant development for the European Union’s burgeoning cryptocurrency landscape, finance ministers from the 27 member states have reached a political agreement to centralize the direct supervision of the bloc’s largest crypto-asset service providers (CASPs) under the European Securities and Markets Authority (ESMA). This landmark decision, finalized on October 9, represents a pivotal refinement of the Markets in Crypto-Assets Regulation (MiCA), aiming to address critical gaps in EU-wide oversight and bolster investor protection. The agreement sets the stage for crucial negotiations with the European Parliament, which will ultimately shape the future regulatory architecture for crypto firms operating within the EU.

The impetus for this regulatory recalibration stems from inherent limitations within the original MiCA framework, particularly its "passporting" system. While designed to foster a unified European market by allowing firms licensed in one member state to operate across the entire bloc, this model placed a heavy reliance on the supervisory capabilities of individual national authorities. Concerns were amplified following a critical ESMA review in July 2025, which scrutinized the authorization and supervision of an unnamed crypto provider in Malta. The review revealed potential inadequacies in the Maltese regulator’s assessment process, raising questions about whether sufficient due diligence was conducted regarding governance, conflicts of interest, technological infrastructure, asset custody, and anti-money laundering (AML) protocols.

Addressing the Oversight Gap: The Genesis of the Council’s Proposal

The ESMA review highlighted a fundamental vulnerability: a single national license, granted by a regulator with potentially varying standards or resources, could grant a crypto firm access to the entire EU market, irrespective of the robustness of its initial authorization. This scenario creates a regulatory arbitrage opportunity and poses risks to consumers and market integrity across the Union. The Maltese case, while not definitively labeling all national licenses as deficient, served as a concrete example of how differing interpretations of supervisory requirements could lead to inconsistent oversight.

In response to these mounting concerns, the Council of the European Union has proposed a tiered approach to crypto supervision. Under the Council’s draft proposal, ESMA would assume direct oversight responsibilities for CASPs deemed to be of significant scale and interconnectedness within the EU. This designation would be triggered if a crypto provider meets a threshold of at least 15 million active EU users, or if it satisfies three out of five additional criteria. These criteria are designed to capture the true systemic importance of a firm and include factors such as a substantial customer base (over 1 million active users), significant assets under custody (exceeding €1 billion), and high annual client transaction volumes (more than €4 billion).

This nuanced approach aims to strike a balance, ensuring that the most impactful crypto players are subject to direct, centralized supervision by a dedicated EU authority, while allowing the majority of smaller or less interconnected firms to remain under the purview of their national regulators. The rationale is that the largest entities, due to their sheer scale and reach, possess the potential to impact the broader financial system and a significant portion of EU consumers, thus warranting a higher level of scrutiny from a supranational body.

The Evolution of MiCA: A Chronological Perspective

The journey towards this centralized oversight began with the conceptualization and eventual adoption of MiCA, a landmark regulation designed to bring legal certainty and a harmonized regulatory framework to the EU’s crypto market.

  • Early 2020s: Discussions and drafting of MiCA commence, driven by the rapid growth of the crypto sector and the increasing need for consumer protection and financial stability.
  • June 2022: The European Parliament and Council reach a political agreement on the MiCA text.
  • June 2023: MiCA is formally adopted by the European Parliament.
  • July 2023: MiCA is formally adopted by the Council of the European Union.
  • Late 2023 – Early 2024: Member states begin transposing MiCA into national law.
  • Mid-2024: Certain provisions of MiCA begin to apply.
  • July 2025: ESMA publishes a review highlighting potential weaknesses in national supervision of CASPs, particularly concerning authorization processes. This review serves as a catalyst for further regulatory adjustments.
  • October 9, 2026: EU finance ministers (the Council) agree on a proposal to grant ESMA direct supervisory powers over the largest crypto firms, refining the MiCA framework.
  • Future: The Council’s proposal will now be subject to negotiations with the European Parliament to reach a final legislative text.

This timeline underscores the dynamic nature of regulatory development in the fast-evolving crypto space. What was conceived as a comprehensive framework is now undergoing refinement to address emerging challenges and ensure its long-term effectiveness.

EU targets MiCA loophole that lets crypto exchanges serve 27 countries with one license

Data and Figures: Quantifying the Impact

The proposed criteria for centralized supervision offer a glimpse into the scale of entities that would fall under ESMA’s direct purview. While the exact number of firms is estimated to be between 10 and 15 out of approximately 360 providers operating in the EU, these select entities represent a disproportionately large share of the market’s activity. The thresholds for user numbers, assets under custody, and transaction volumes are significant:

  • Active EU Users: A minimum of 15 million users for direct ESMA supervision, with a lower threshold of 1 million users contributing to the overall significance assessment. This indicates a focus on firms with widespread consumer engagement across the Union.
  • Crypto Assets Under Custody: Exceeding €1 billion. This metric highlights the importance of firms that manage substantial amounts of digital assets on behalf of their clients, a key area for investor protection.
  • Annual Client Transactions: More than €4 billion. This substantial volume signifies firms with high trading activity, suggesting a significant role in the liquidity and functioning of the crypto market.

These figures collectively aim to identify crypto providers whose operational scale and financial footprint could have systemic implications, thereby justifying a more centralized and robust supervisory approach. The inclusion of financial interconnectedness as a criterion further acknowledges the potential for contagion effects within the broader financial system.

Official Responses and Stakeholder Reactions

The agreement reached by the Council of the EU reflects a compromise among member states, some of whom, like Malta, have expressed reservations about a centralized supervisory model. Malta, in particular, argued in September 2025 that MiCA was still too nascent to warrant an additional regulatory layer and cautioned that centralization could introduce bureaucracy and hinder competitiveness. The Maltese Financial Services Authority (MFSA) stated that it was implementing ESMA’s recommendations while maintaining its stance against a wholesale transfer of supervision.

However, the broader sentiment among many EU financial authorities and lawmakers appears to lean towards strengthening ESMA’s role in ensuring consistent application of rules. The July 2025 ESMA review, by raising specific concerns about authorization practices, provided concrete evidence to support the need for enhanced EU-level oversight.

While official statements from the European Commission have generally supported strengthening ESMA’s mandate, the forthcoming negotiations with the European Parliament will be crucial. Lawmakers in the Parliament have historically been strong proponents of robust consumer protection and market integrity, and their input will be vital in shaping the final legislation. Industry stakeholders, while welcoming the clarity MiCA brings, are likely to closely monitor the finalization of these supervisory adjustments, particularly regarding the precise thresholds and the potential compliance burden for firms operating near the edge of the defined criteria.

Broader Impact and Implications for the Crypto Ecosystem

The proposed shift towards centralized supervision for major crypto firms under ESMA is poised to have several significant implications:

  • Enhanced Investor Protection: By subjecting the largest and most influential crypto players to direct EU-level scrutiny, the move aims to significantly bolster investor protection. ESMA’s direct enforcement powers, including the ability to request information, conduct inspections, and impose financial penalties, will provide a stronger deterrent against misconduct and a more effective mechanism for addressing breaches.
  • Level Playing Field: Centralized supervision for significant entities can help create a more level playing field across the EU. It aims to prevent a race to the bottom in regulatory standards, where firms might seek authorization in jurisdictions with lighter oversight.
  • Market Integrity and Stability: By ensuring robust supervision of systemically important firms, the EU seeks to safeguard the integrity and stability of its financial markets. The interconnectedness of major crypto platforms with traditional finance makes this aspect particularly crucial.
  • Streamlined Enforcement: For firms directly supervised by ESMA, there will be a single point of contact for regulatory matters, potentially streamlining compliance efforts. However, it also means these firms will face the highest standards of scrutiny.
  • Continued National Oversight: It is important to note that the majority of crypto service providers will continue to be supervised at the national level. The Council’s proposal includes mechanisms for ESMA to promote convergence and address uneven enforcement through guidelines, peer reviews, and coordinated investigations, ensuring that even nationally supervised firms adhere to high standards.
  • Operational Challenges for ESMA: Granting ESMA direct supervisory powers will necessitate a significant expansion of its resources, expertise, and operational capacity. The agency will need to build teams capable of handling complex on-site inspections, investigations, and enforcement actions across a diverse range of crypto business models.
  • Future Regulatory Evolution: This agreement represents a significant step in the ongoing evolution of crypto regulation. As the industry continues to innovate and grow, further adjustments to the regulatory framework may be necessary, potentially including adjustments to the thresholds for direct supervision or the scope of ESMA’s powers.

The agreement reached by EU finance ministers is a testament to the EU’s commitment to fostering a regulated and secure digital asset market. While the journey from political agreement to legally binding legislation involves further negotiation, the direction of travel is clear: a more centralized and robust supervisory framework for the most significant players in the European crypto landscape, aimed at safeguarding investors and ensuring the stability of the financial system. The coming months will be critical as the Council and the European Parliament engage in discussions to finalize these crucial regulatory enhancements.