EU targets MiCA loophole that lets crypto exchanges serve 27 countries with one license

European Union finance ministers have agreed to shift oversight of major digital asset companies to a centralized watchdog, altering how supervision operates under the MiCA framework.

The Council of the European Union finalized a political accord on Oct. 9 to grant the European Securities and Markets Authority (ESMA) direct authority over the bloc’s most prominent crypto-asset service providers as part of a broader initiative to integrate European financial markets.

This proposed modification targets a vulnerability in the Markets in Crypto-Assets Regulation (MiCA), which permits companies licensed in a single member state to service clients throughout the entire 27-nation bloc while primarily answering to their home-country regulator.

However, this compromise is considerably more restricted than the European Commission’s original proposal to place all crypto service providers under ESMA’s purview. Reuters reported that officials project only 10 to 15 out of approximately 360 providers will meet the criteria for centralized supervision.

Rather than altering the law immediately, the agreement establishes the Council’s negotiating position, which must still be negotiated with the European Parliament.

National licenses expose gap in EU-wide oversight

The passporting system under MiCA was created to offer digital asset firms a single gateway into the European market. Providers authorized in one member state can deliver approved services in other EU nations without needing a physical office in every country they operate in.

While this framework cuts down on redundant efforts for businesses expanding across borders, it places heavy reliance on the national agency that grants the initial approval. Consequently, a company’s business activities, client funds, and technological systems can expand far beyond the borders of the licensing jurisdiction.

These implications came to light in a July 2025 ESMA review regarding the Malta Financial Services Authority’s authorization of an undisclosed crypto provider.

ESMA questioned the rationale behind granting approval while major concerns remained unresolved. Reviewers discovered insufficient proof that the licensing evaluation properly handled governance, potential conflicts of interest, technology infrastructure, custody setups, and specific anti-money-laundering risks.

The evaluation did not conclude that every Maltese license was flawed. It acknowledged the Maltese regulator’s sector expertise and adequate supervisory capacity, while advising enhancements to its authorization procedures.

In response, Malta stated it was adopting the recommendations but pushed back against shifting oversight to ESMA, arguing in September 2025 that MiCA was too recent to warrant an extra regulatory layer. The regulator cautioned that centralization might spark bureaucracy and damage competitiveness.

This disagreement underscored a wider tension: an authorization decision made by a single regulator impacts crypto consumers across Europe, even when other national watchdogs hold differing views on required levels of scrutiny.

Largest crypto providers face new thresholds and EU enforcement

To resolve these challenges, EU regulators have put forward a new supervisory model.

Under the Council’s proposal, ESMA would assume direct supervision of crypto businesses boasting at least 15 million active EU users, or those satisfying three out of five additional significance metrics concerning their customer base, custody assets, transaction volumes, and financial interconnectedness.

These benchmarks feature having more than 1 million active users, holding over €1 billion in crypto assets under custody, and processing upwards of €4 billion in annual client transactions.

Consequently, a provider’s overall magnitude and ties to the financial system—rather than just its country of incorporation—will dictate whether its oversight shifts to ESMA.

The agency would acquire the authority to demand data from directly overseen firms, execute inspections, probe violations, and levy financial penalties. The draft also outlines powers enabling the watchdog to restrict services or revoke authorizations if companies fail to satisfy regulatory conditions.

Although the majority of crypto service providers would stay under national regulators, ESMA would leverage guidelines, peer evaluations, synchronized investigations, and distinct intervention authorities to combat uneven enforcement across territories.

Furthermore, the overhaul establishes a permanent ESMA executive board—featuring a chairperson and five independent members—to manage operational and firm-specific determinations. National watchdogs would maintain their involvement in broader policy formulation and supervisory alignment.

The Council envisions a two-year transition period during which joint teams would hand over information, operational duties, and expertise to ESMA. Current MiCA authorizations held by companies transitioned to direct oversight would stay valid, preventing the automatic requirement to reapply for licenses.

This prospective structure introduces heightened regulatory oversight for a select group of major enterprises while retaining the current national framework for most of the market. The critical questions moving forward involve the final thresholds, the resources allocated to ESMA, and the regulatory treatment of providers positioned near the cutoff lines.

Before formal discussions can commence following the European Parliament’s establishment of its own position, the Council must formally adopt its negotiating stance. Those subsequent discussions will clarify the final count of crypto entities transitioning from national to EU-level oversight and establish the timeline for the migration.

?Frequently Asked Questions

01What is the primary goal of the EU’s proposed MiCA overhaul?

The proposed framework aims to close a loophole by shifting direct oversight of the bloc’s largest and most systemically important crypto companies from national regulators to a central European watchdog, ESMA.

02Will all crypto exchanges in the EU be supervised by ESMA?

No. Estimates indicate that only 10 to 15 out of roughly 360 crypto service providers will meet the strict size and significance criteria required for direct ESMA supervision. The vast majority will remain under national oversight.

03What criteria make a crypto provider subject to direct ESMA oversight?

A provider must have at least 15 million active EU users, or meet three out of five additional thresholds, which include having over 1 million active users, holding more than €1 billion in custody assets, and processing over €4 billion in annual client transactions.

04Are existing crypto licenses invalidated by this proposed change?

No. Existing MiCA licenses held by companies transitioned to direct ESMA oversight will remain valid, avoiding the need for these firms to seek new authorizations automatically.