On Oct. 9, the Council of the European Union reached a political agreement to grant the European Securities and Markets Authority (ESMA) direct supervisory authority over the bloc's largest crypto-asset service providers.
Key Takeaways
- Centralized Oversight Threshold: ESMA will directly oversee firms with at least 15 million active EU users, or those meeting three of five criteria including over 1 million active users, €1 billion in assets under custody, and €4 billion in annual transaction volume.
- Targeted Scope: Officials estimate that only 10 to 15 of approximately 360 registered crypto providers will qualify for centralized EU supervision.
- Transition Period: The proposed structure includes a two-year transition during which joint supervisory teams will transfer responsibilities to ESMA.
Closing the MiCA Passporting Loophole
Under the original Markets in Crypto-Assets (MiCA) framework, a provider licensed in one member state could offer services across all 27 countries while remaining under the primary supervision of its home regulator. However, this passporting mechanism created friction regarding jurisdictional scrutiny. In July 2025, an ESMA review of the Malta Financial Services Authority questioned its approval of an unnamed crypto provider, citing unresolved issues with governance, conflicts of interest, technology infrastructure, custody, and anti-money laundering risks.
Although Malta defended its regulatory expertise in September 2025 and warned that centralizing oversight could add unnecessary bureaucracy, European officials prioritized closing supervisory gaps. This decision mirrors broader global trends toward structural oversight, similar to recent SEC proposals for private market access and international regulatory updates such as Thailand SEC guidelines.
Expanded Enforcement Powers for ESMA
Under the Council's draft proposal, ESMA will gain direct powers to request documentation, execute inspections, investigate violations, impose financial penalties, and restrict or revoke authorizations. Company-specific and operational decisions will be handled by a full-time ESMA executive board featuring a chair and five independent members, while national authorities continue participating in policy coordination.
Existing MiCA licenses held by firms transitioning to ESMA oversight will remain valid. The Council must now formalize its negotiating position before entering trilogue negotiations with the European Parliament to finalize the regulatory updates.
Why It Matters
This agreement represents a major shift toward unified European crypto regulation by removing reliance on single-country enforcement for the market's largest players. By restricting direct ESMA supervision to only 10 to 15 key institutions, the EU aims to mitigate systemic risk without swamping smaller Web3 startups with centralized administrative burdens. As the European Parliament prepares to negotiate the final text, major exchanges approaching the 15-million user or €4-billion transaction thresholds will need to prepare for direct compliance reporting to Brussels.
