EU finance ministers give ESMA direct supervision of largest crypto providers

• ESMA would directly supervise crypto providers with at least 15 million active EU users or meeting three of five other significance criteria including €1 billion in custody assets.
• The agreement transfers direct oversight of major crypto-asset service providers to ESMA, alongside central counterparties and trading venues, under a wider Market Integration and Supervision Package.
• A two-year transition period would allow joint teams to transfer information and expertise, while existing MiCA licenses remain valid and the majority of providers stay under national supervision.

• 10 to 15 crypto providers out of roughly 360 expected to move to centralized ESMA supervision.
• €1 billion threshold for crypto assets under custody, one of five significance criteria ESMA will use.
• October 9 date Council of the European Union reached political agreement on the package.

EU finance ministers reached a political agreement on October 9 to give ESMA direct responsibility for the bloc’s most significant crypto-asset service providers, addressing a structural weakness in the Markets in Crypto-Assets Regulation that allows firms licensed in one member state to serve customers across the entire 27-country bloc while remaining primarily supervised by their home-country regulator. The Council of the European Union’s accord forms part of a broader Market Integration and Supervision Package aimed at deepening and better integrating European capital markets. According to reporting on the agreement, the compromise is considerably narrower than the European Commission’s original proposal to move all crypto service providers under ESMA supervision.

Malta’s licensing gap exposed ESMA’s concerns about decentralized oversight

The regulatory gap became visible when ESMA conducted a peer review of the Malta Financial Services Authority’s authorization of an unnamed crypto provider in July 2025.

The review questioned whether the company had received approval while material issues remained unresolved, finding insufficient evidence that the licensing assessment adequately addressed governance, conflicts of interest, technology infrastructure, custody arrangements and anti-money-laundering risks.

ESMA did not conclude that every Maltese license was deficient; it credited the regulator with sector expertise and sufficient supervisory resources while recommending improvements to its authorization process.

Malta subsequently opposed transferring supervision to ESMA, arguing that MiCA was too new to justify an additional regulatory layer and warning that centralization could introduce bureaucracy and hamper competitiveness.

The dispute highlighted a fundamental tension: one regulator’s authorization decision can affect crypto customers across Europe, even when other national watchdogs view the required level of scrutiny differently. That asymmetry exposed a structural flaw in the passporting system, which reduces duplication for firms expanding across borders but concentrates approval risk in a single jurisdiction.

ESMA’s direct oversight will cover only the largest providers, leaving the majority under national supervision

Under the Council’s draft framework, ESMA would take direct oversight of crypto providers meeting one primary threshold or three of five additional criteria. The primary trigger is at least 15 million active EU users. The secondary criteria include more than 1 million active users, over €1 billion in crypto assets under custody, more than €4 billion in annual client transactions, and material financial interconnectedness. This approach means a provider’s overall scale and connections to the financial system, rather than its place of incorporation alone, would determine whether supervision moves to ESMA.

ESMA would gain powers to request information, conduct inspections, investigate breaches and impose financial penalties on directly supervised firms. The draft also gives the authority ability to restrict services or withdraw authorization where firms do not meet regulatory requirements.

Most crypto service providers would remain under national regulators, which would continue participating in broader supervisory coordination. ESMA would coordinate peer reviews, joint investigations and intervention strategies across jurisdictions to address uneven enforcement.

The agreement requires establishment of a full-time ESMA executive board, including a chair and five independent members, to handle operational and company-specific decisions.

Two-year transition preserves existing licenses while shifting oversight to ESMA

The Council envisages a two-year transition period in which joint teams would transfer information, operational responsibilities and expertise to ESMA. Existing MiCA licenses for companies brought under direct supervision would remain valid, avoiding the automatic need to seek new authorization.

This design acknowledges that abrupt termination and reissuance of licenses could disrupt market operations and impose compliance costs on firms.

The Council’s agreement now sets the Council’s negotiating position rather than changing the law immediately. The Irish Presidency confirmed that the agreement represents the culmination of months of work and is part of a broader initiative to deepen and better integrate European capital markets, helping innovative companies access finance and supporting business expansion. The Council must formally adopt its negotiating position before it can begin negotiations with the European Parliament, which will establish its own position and then reconcile the two chambers’ views.

The CCS read. We see ESMA’s expanded mandate as a net positive for institutional entrants to European crypto markets. A centralized supervisor with enforcement teeth reduces the regulatory arbitrage that has allowed weaker jurisdictional oversight to create systemic risk across borders. However, the 15 million user threshold and three-of-five criteria test mean most mid-market and regional providers escape direct ESMA scrutiny, leaving national enforcement fragmented. That creates a two-tier market: institutional-grade compliance for the largest platforms, uneven standards elsewhere.

The decisive questions now concern the final thresholds, ESMA’s available resources, and how the European Parliament amends the proposal. The Parliament must establish its own negotiating position before formal trilogue talks can begin. Once negotiations commence, they will determine how many crypto companies ultimately move from national to EU-level supervision and when the transfer can begin, likely the most material outcome for institutions planning pan-European product launches or consolidation activity.