EU Plans Central Oversight for Largest Crypto Firms

EU finance ministers reached a political agreement on Oct. 9 to give the European Securities and Markets Authority direct oversight of the European Union’s largest crypto-asset service providers. The proposal would narrow a gap in the Markets in Crypto-Assets Regulation, known as MiCA, which allows firms licensed in one member state to serve customers across all 27 EU countries.

The agreement sets the Council of the EU’s negotiating position. It does not change the law. The Council must formally adopt its position and negotiate the proposal with the European Parliament before the new supervision system can take effect.

Under the Council’s draft, ESMA would supervise providers with at least 15 million active users in the EU. It would also supervise providers that meet at least three of five other criteria covering user numbers, assets held for clients, transaction volumes and links to the financial system.

The criteria include more than 1 million active users, over €1 billion in crypto assets under custody and more than €4 billion in annual client transactions. The remaining criteria concern a provider’s connections to the financial system and the scale of its operations.

About 10 to 15 of the roughly 360 crypto-asset service providers operating under MiCA are expected to meet the thresholds. Most providers would remain under the supervision of the regulator in the member state where they obtained their licenses.

MiCA allows a provider authorized in one EU country to offer approved services across the bloc without creating a separate regulated entity in each market. The system reduces duplicate licensing requirements, while the regulator in the provider’s home country remains primarily responsible for supervision.

The limits of that arrangement emerged in a July 2025 review by ESMA of an authorization issued by the Malta Financial Services Authority to an unnamed crypto provider. ESMA found that the licensing assessment had not sufficiently addressed governance, conflicts of interest, technology systems, custody arrangements and some anti-money-laundering risks.

The review did not find that all Maltese licenses were deficient. It recognized the Maltese regulator’s sector expertise and supervisory resources and recommended changes to its authorization process.

Malta later said it was implementing ESMA’s recommendations. In September 2025, the Maltese regulator opposed transferring crypto supervision to ESMA, arguing that MiCA was too new to require another supervisory layer. It warned that centralization could increase bureaucracy and reduce competitiveness.

Under the Council’s proposal, ESMA could request information from firms under its direct supervision, conduct inspections, investigate possible breaches and impose financial penalties. It could restrict services or withdraw a provider’s authorization if regulatory requirements were not met.

National regulators would continue supervising most providers and would cooperate on EU-wide policy and enforcement. ESMA would receive additional powers, including issuing guidelines, conducting peer reviews and coordinating investigations into differences in supervision between member states.

The proposal would create a full-time ESMA executive board with a chair and five independent members to oversee operational and company-specific decisions. A two-year transition period would allow national and EU authorities to transfer information, responsibilities and expertise.

Existing MiCA licenses would remain valid for providers transferred to ESMA supervision. Those firms would not automatically need to apply for new authorization. The final thresholds, the number of firms transferred and the start date will depend on negotiations between the Council and the European Parliament.