On October 9, the Council of the European Union settled on its negotiating position for a new market integration and supervision package. The headline change: the European Securities and Markets Authority, ESMA, would get direct authority over the largest crypto exchanges operating across several EU countries at once.
The push comes from a familiar flaw in MiCA's passporting rule. A license issued in one member state lets an exchange serve all 27 countries — roughly 450 million people — while a single national regulator keeps watching it the whole time. In July 2025, ESMA reviewed how Malta had been granting licenses and found open questions about governance, tech infrastructure and anti-money-laundering controls that hadn't stopped approvals from going through. That review did real damage to the idea that every national regulator applies the same rigor.
Direct ESMA oversight won't touch most of the market, though. Regulators estimate only 10 to 15 of the roughly 360 providers registered under MiCA would meet the bar: either 15 million active EU users, or three of five lighter criteria — more than 1 million users, over €1 billion in crypto assets under custody, or annual client transactions above €4 billion. Everyone else stays with their home regulator, same as now.
For exchanges that do cross the threshold, ESMA gains real teeth: it can demand records, run inspections and investigations, levy fines, and restrict or pull authorization outright. A new standing executive board — a chair plus five members — will run the supervision, with a two-year handover period moving staff and files from national regulators. Existing licenses stay valid throughout.
The Council's version is noticeably softer than what the European Commission originally wanted, which was to hand ESMA every qualifying exchange with no tiers at all. Instead, the bloc ends up with a two-speed system, and the bulk of its crypto market stays under exactly the kind of national supervision that triggered the Malta episode in the first place. Parliament still has to agree its own position before trilogue talks lock in the final thresholds and timeline.
