The Council's proposal would move only the largest cross-border crypto providers to direct ESMA supervision. The law is not final, and estimates of how many firms could qualify are not a legal list.
A provider licensed in one EU country can serve customers across the bloc, leaving much of its oversight with the regulator that approved it. The Council of the European Union has backed a negotiating position that would give the European Securities and Markets Authority (ESMA) direct responsibility for the bloc's most significant cross-border crypto-asset service providers.
The proposal would change part of MiCA's passporting model, not transfer the whole industry to Brussels. The final law has not been adopted. The European Parliament must first establish its position, after which interinstitutional negotiations can begin.
ESMA's interim register listed 370 crypto-asset service provider entries across 27 EU and EEA countries as of October 7. That register count does not mean all listed firms would come under direct ESMA supervision.
A narrow transfer
Under the Council's approach, only the most significant cross-border providers would move to ESMA. National authorities would continue to supervise most companies. The proposed test for significance would consider a firm's scale and links to the wider financial system, including customer reach, assets in custody and transaction activity. The public text cited in recent reporting did not disclose specific thresholds. That leaves estimates of how many firms could qualify short of a definitive legal list.
Published estimates put the potential number at roughly 10 to 15 providers, out of a market numbering several hundred. That is an estimate, not a confirmed list of firms. The interim register's 370 entries, updated on October 7, count MiCA-related registrations across the EU and EEA. They do not show how many providers would transfer to ESMA.
For firms brought under ESMA, the draft would let the agency request information and inspect operations. It could investigate breaches and impose financial penalties. ESMA could also restrict services or withdraw authorization when a firm fails to meet regulatory requirements. Existing MiCA licenses would remain valid during the transfer, so affected firms would not automatically have to apply again.
On October 8, ESMA separately said authorized crypto-asset service providers must stop offering EU clients services involving ARTs and EMTs that do not comply with MiCA. Clients' existing positions must be addressed by January 8, 2027, under national regulators' supervision; this stablecoin measure is distinct from the proposed transfer of major providers to direct ESMA oversight.
Passporting's weak point
MiCA passporting lets an authorized provider offer approved services across the EU without securing a separate license in every member state. That eases cross-border expansion, but it also leaves much of the supervisory burden with the regulator in the licensing country, even when the business serves customers throughout the bloc. ESMA's MiCA overview describes the EU framework for crypto-asset markets.
The gap can widen when a company's operations, client assets and technology outgrow the country that first assessed it. In a July 2025 review of the Malta Financial Services Authority's authorization of an unnamed provider, ESMA questioned whether the assessment had adequately addressed governance and conflicts of interest. It also raised concerns about technology and custody, along with some anti-money-laundering risks.
The review did not find that every Maltese license was deficient. It recognized the regulator's sector expertise and supervisory resources, while recommending changes to its authorization process. Malta said it was implementing the recommendations. In September 2025, it opposed transferring oversight to ESMA, arguing that MiCA was too new for another regulatory layer and warning that centralization could add bureaucracy and hurt competitiveness.
The effects of national licensing decisions are already tangible for platforms. A separate Bitcoin.de licensing dispute involved a denied MiCA application and a resulting trading freeze. The cases are not identical, but the dispute shows how a license issued in one country can affect users elsewhere in the single market.
Shared rules and resources
ESMA would also use guidelines and peer reviews to address uneven enforcement among national regulators, including for providers that remain under local supervision. The draft adds coordinated investigations and certain intervention powers. It would establish a full-time ESMA executive board, made up of a chair and five independent members, to make operational and company-specific decisions. National regulators would retain a role in broader policy and supervisory coordination. The proposed transfer of significant trading venues, central securities depositories and central counterparties follows the same selective approach.
A two-year transition is envisaged. Joint teams of national and European supervisors would transfer information and responsibilities to ESMA, along with their expertise. The timetable and the transfer remain proposals. The European Parliament must establish its position before negotiations on a final text can begin.
Whether ESMA can manage the additional workload will depend on its staffing and resources, as well as its coordination with national regulators. The thresholds will decide which providers fall just below the line, where day-to-day oversight stays local even if their customers are spread across Europe.
Passporting grants market access across countries after authorization in one member state; it does not mean every national regulator separately approved the firm. The proposal would leave the existing national-supervision model in place for most providers.
