EU targets MiCA loophole that lets crypto exchanges serve 27 countries with one license
EU finance ministers agreed to shift oversight of major crypto companies to a central watchdog, reshaping supervision under MiCA.
The Council of the European Union reached a political agreement on Oct. 9 to give the European Securities and Markets Authority (ESMA) direct responsibility for the bloc's most significant crypto-asset service providers, as part of a wider package to integrate European financial markets.
The proposed overhaul addresses a weakness in the Markets in Crypto-Assets Regulation (MiCA), which allows firms licensed in one member state to serve customers across the 27-country bloc while remaining primarily supervised by their home-country regulator.
The compromise, however, is considerably narrower than the European Commission's original plan to move all crypto service providers under ESMA. Officials estimate that only 10 to 15 of roughly 360 providers would qualify for centralized supervision, Reuters reported.
The agreement sets the Council's negotiating position rather than changing the law immediately. The Council must still negotiate the proposal with the European Parliament.
National licenses expose gap in EU-wide oversight
MiCA's passporting system was designed to provide crypto firms with a single route into the European market. Under the regulation, a provider authorized in one member state can offer approved services elsewhere in the EU without establishing a physical presence in every country it serves.
That arrangement reduces duplication for firms expanding across borders, but it also places considerable responsibility on the national authority issuing the initial approval. This is because a company's operations, client assets, and technology systems can grow well beyond the market where it was licensed.
The consequences emerged in a July 2025 ESMA review of the Malta Financial Services Authority's authorization of an unnamed crypto provider.
ESMA questioned why the company received approval while material issues remained unresolved. Its reviewers found insufficient evidence that the licensing assessment adequately addressed governance, potential conflicts of interest, technology infrastructure, custody arrangements and certain anti-money-laundering risks.
The review did not establish that every Maltese license was deficient. It also credited the Maltese regulator with sector expertise and sufficient supervisory resources, while recommending improvements to its authorization process.
Malta subsequently said it was implementing the recommendations but opposed transferring supervision to ESMA, arguing in September 2025 that MiCA was too new to justify an additional regulatory layer. The authority warned that centralization could introduce bureaucracy and hamper competitiveness.
The dispute highlighted a broader tension: one regulator's authorization decision can affect crypto customers across Europe, even when other national watchdogs view the required level of scrutiny differently.
Largest crypto providers face new thresholds and EU enforcement
In response, EU regulators are proposing a new framework to address these issues.
Under the Council's draft, ESMA would take direct oversight of crypto providers with at least 15 million active EU users, or those meeting three of five additional significance criteria covering their customer base, custody assets, transaction volumes and financial interconnectedness.
Those criteria include more than 1 million active users, over €1 billion in crypto assets under custody and more than €4 billion in annual client transactions.
Together, these factors mean a provider's overall scale and connections to the financial system, rather than its place of incorporation alone, would determine whether supervision moves to ESMA.
The agency would gain powers to request information from directly supervised firms, conduct inspections, investigate breaches, and impose financial penalties. The draft also envisages the authority to restrict services or withdraw authorization where firms do not meet regulatory requirements.
While most crypto service providers would remain under national regulators, ESMA would use guidelines, peer reviews, coordinated investigations, and certain intervention powers to address uneven enforcement across jurisdictions.
The overhaul would also create a full-time ESMA executive board, including a chair and five independent members, to handle operational and company-specific decisions. National regulators would continue participating in broader policy and supervisory coordination.
The Council envisages a two-year transition in which joint teams transfer information, operational responsibilities and expertise to ESMA. Existing MiCA licenses for companies brought under direct supervision would remain valid, avoiding the automatic need to seek new authorization.
The proposed structure would bring greater supervisory scrutiny to a small group of large firms while leaving the majority of the market within the current national model. The decisive questions now concern the final thresholds, ESMA's available resources, and how providers near the boundary are treated.
The Council must formally adopt its negotiating position before talks can begin once the European Parliament establishes its own. Those negotiations will determine how many crypto companies ultimately move from national to EU-level supervision and when the transfer can begin.
The post EU targets MiCA loophole that lets crypto exchanges serve 27 countries with one license appeared first on CryptoSlate.
