The Council of the European Union reached a political agreement on October 9 to hand the European Securities and Markets Authority direct oversight of the bloc's largest crypto-asset service providers. The move addresses a well-known weakness in MiCA: firms licensed in one member state can passport across all 27 countries while remaining supervised mainly by their home regulator. Under the Council's draft, only a small handful of the roughly 360 providers currently registered in the EU would come under ESMA's direct watch.
A much smaller net than Brussels wanted
The European Commission originally proposed moving every crypto service provider under ESMA. The Council's compromise is considerably narrower. Officials estimate that just 10 to 15 firms would qualify for centralized supervision.
To fall under ESMA, a provider would need at least 15 million active EU users, or meet three of five additional significance criteria: more than 1 million active users, over €1 billion in crypto assets under custody, more than €4 billion in annual client transactions, plus measures covering customer base and financial interconnectedness. In practice, that captures the largest exchanges and custodians operating in Europe, not the long tail of smaller brokers and wallet services.
The agreement sets the Council's negotiating position. It doesn't change the law yet. The Council still has to negotiate the final text with the European Parliament, and the two institutions will have to agree on how far the centralization should go.
Malta, MiCA's passporting problem, and a July 2025 review
The push for tighter EU-level supervision follows a July 2025 review by ESMA of how the Malta Financial Services Authority authorized an unnamed crypto provider. The review found insufficient evidence that the licensing assessment adequately addressed governance, potential conflicts of interest, technology infrastructure, custody arrangements, and certain anti-money-laundering risks.
ESMA stopped short of saying every Maltese license was deficient. It credited the Maltese regulator with sector expertise and sufficient supervisory resources, and recommended improvements to its authorization process. Malta said it was implementing those recommendations but opposed moving supervision to ESMA, arguing in September 2025 that MiCA was too new to justify an additional regulatory layer. The Maltese government also warned that centralization could introduce bureaucracy and hurt competitiveness.
What ESMA would actually get to do
The draft gives ESMA real teeth over the firms it supervises directly. The authority could request information, conduct inspections, investigate breaches, and impose financial penalties. It could also restrict services or withdraw authorization where a firm fails to meet regulatory requirements.
For everyone else — the majority of crypto service providers in the EU — national regulators stay in charge. ESMA would rely on guidelines, peer reviews, coordinated investigations, and certain intervention powers to smooth out uneven enforcement across jurisdictions.
The Council also wants a full-time ESMA executive board, with a chair and five independent members, to handle operational and company-specific decisions. National regulators would keep participating in broader policy and supervisory coordination.
A two-year handover, and licences that stay valid
The transition is designed to take two years. Joint teams would transfer information, operational responsibilities, and expertise to ESMA during that period. Existing MiCA licenses held by companies brought under direct supervision would remain valid, so firms wouldn't automatically have to seek new authorization — a detail that could soften industry opposition to the plan.
What's still unresolved is how much of the Council's narrower approach survives talks with the European Parliament. The Parliament has not yet set out its position, and the negotiations will determine whether ESMA ends up supervising a dozen firms or a much larger slice of the market.
