European Union finance ministers have reached a crucial political agreement to overhaul the supervision of the bloc’s most significant cryptocurrency companies, transferring direct oversight responsibilities to a centralized European authority.
Meeting to advance a broader legislative package aimed at fully integrating European financial markets, the Council of the European Union finalized an agreement on Oct. 9 that designates the European Securities and Markets Authority (ESMA) as the primary direct supervisor for the largest crypto-asset service providers operating within the continent.
The proposed regulatory shift is designed to address a fundamental structural vulnerability in the landmark Markets in Crypto-Assets Regulation, commonly known as MiCA. Under the current MiCA framework, digital asset firms that secure a license in a single EU member state are granted a financial passport, allowing them to legally market and offer their services to customers across all 27 member nations. While this passporting system was intentionally created to streamline cross-border expansion and eliminate regulatory duplication for growing fintech enterprises, it leaves the ongoing supervision of these sprawling multi-jurisdictional operations primarily in the hands of their home-country national regulators.
However, the political compromise struck by EU ministers is considerably more restrained than the sweeping reforms originally envisioned by the European Commission, which had pushed for all crypto service providers across the bloc to fall under ESMA’s direct jurisdiction. According to current official estimates, the finalized criteria mean that only a tiny fraction of the market—roughly 10 to 15 companies out of an estimated 360 active providers across Europe—will ultimately cross the threshold required to trigger centralized supervision.
The October agreement establishes the official negotiating position of the Council rather than enacting immediate legal changes. Before the overhaul can become law, the Council must enter into formal negotiations with the European Parliament to iron out the final details of the framework.
National Licenses Expose Gaps in EU-Wide Oversight
The debate over centralized versus national supervision intensified following growing concerns about how the passporting system operates in practice. Designed to offer crypto firms a single, frictionless gateway into the vast European single market, MiCA allows a provider authorized in one jurisdiction to deliver approved financial services across borders without the burdensome requirement of establishing a physical corporate presence or securing a separate license in every country it serves.
While this mechanism successfully lowers administrative barriers for businesses, it places immense trust and responsibility on the specific national regulatory authority tasked with granting the initial authorization. Because a company’s actual operations, technological infrastructure, and customer base can scale rapidly and expand far beyond the borders of the issuing market, a localized regulatory failure or oversight gap can rapidly transform into a continent-wide risk.
These inherent vulnerabilities were brought into sharp focus following a July 2025 peer review conducted by ESMA, which scrutinized the Malta Financial Services Authority’s authorization process for an unnamed crypto-asset service provider. In its findings, ESMA openly questioned why the company had been cleared to operate while numerous material and structural issues remained entirely unresolved. Reviewers highlighted a lack of sufficient evidence demonstrating that the licensing assessment had properly addressed critical areas such as corporate governance, potential conflicts of interest, robust technology infrastructure, secure custody arrangements, and comprehensive anti-money laundering risk controls.
While the ESMA review did not conclude that every license issued by Malta was inherently flawed—and explicitly credited the Maltese regulatory body for possessing solid sector expertise and adequate supervisory resources—it strongly recommended sweeping improvements to the local authorization workflow.
In the wake of the review, Malta confirmed it was actively implementing the suggested recommendations. At the same time, however, the Mediterranean nation pushed back firmly against any transfer of supervisory power to Brussels. In September 2025 statements, Maltese authorities argued that MiCA was still too young and untested to justify layering an additional tier of bureaucracy on top of existing national frameworks, warning that centralization could stifle market competitiveness and slow down innovation.
This ongoing friction underscored a wider regulatory dilemma facing the European Union: a single national watchdog’s decision to authorize a crypto firm carries direct consequences for consumers and financial stability across the entire continent, even when other member states hold entirely different expectations regarding the appropriate depth of regulatory scrutiny.
Largest Crypto Providers Face New Thresholds and EU Enforcement
To bridge this regulatory gap without overwhelming the European agency with thousands of smaller firms, EU regulators designed a specific set of quantitative thresholds to isolate only the systemically important players.
Under the Council’s draft proposal, ESMA would assume direct supervisory authority over any crypto-asset service provider that commands at least 15 million active users within the European Union. Alternatively, firms could also fall under ESMA’s direct watch if they meet a combination of specific significance criteria covering their wider customer base, the total volume of customer assets they hold in custody, their aggregate transaction volumes, and their degree of financial interconnectedness with the traditional banking and financial system.
These qualitative and quantitative markers include having more than 1 million active users, holding in excess of €1 billion in crypto assets under custody, and processing more than €4 billion in annual client transactions. By anchoring the transfer of oversight to these operational metrics, the regulatory framework ensures that a provider’s overall systemic footprint and integration with the broader financial ecosystem—rather than simply its country of incorporation—will dictate whether it is overseen in Brussels or by its local national regulator.
Once brought under ESMA’s direct oversight, the agency would wield substantial enforcement powers. These would include the authority to issue formal information requests directly to supervised firms, conduct on-site inspections, launch investigations into suspected regulatory breaches, and levy significant financial penalties. Furthermore, the draft framework empowers ESMA to restrict specific business services or entirely revoke a company’s authorization if it fails to maintain compliance with evolving regulatory standards.
For the vast majority of crypto-asset service providers that do not meet these high significance thresholds, day-to-day supervision will remain firmly in the hands of national regulators. To prevent fragmented enforcement across different member states, ESMA would utilize a toolkit of harmonization measures, including binding guidelines, peer reviews, coordinated cross-border investigations, and targeted intervention powers.
To manage its expanded mandate, the overhaul also calls for the establishment of a full-time ESMA executive board, comprising a chair and five independent members tasked with handling operational oversight and company-specific decisions. Meanwhile, national regulators would maintain an active role through participation in broader policy formulation and ongoing supervisory coordination.
The Council envisions a structured two-year transition period during which joint supervisory teams would safely transfer operational responsibilities, institutional expertise, and vital compliance information to ESMA. Crucially, companies that are brought under direct EU supervision would not be forced to reapply for entirely new licenses, as their existing MiCA authorizations would remain fully valid throughout the transition.
As the legislative process moves forward, the primary focus shifts to the finalization of these quantitative thresholds, the allocation of adequate financial and human resources to ESMA, and the regulatory treatment of firms operating close to the defined boundaries. The Council must now formally adopt its negotiating position, setting the stage for complex negotiations with the European Parliament to determine the ultimate scope, timeline, and structure of Europe’s centralized crypto oversight.
