The European Securities and Markets Authority on September 23 designated artificial intelligence and tokenization as a Union Strategic Supervisory Priority, effective 2027. The program, titled "Innovation With Investor Safeguards," directs national regulators across 27 member states to catalog, e...
"The digital innovation USSP aims to ensure supervisors have the expertise and capacity to oversee the use of new technologies." — ESMA Official Statement, September 23, 2026
The European Securities and Markets Authority on September 23 designated artificial intelligence and tokenization as a Union Strategic Supervisory Priority, effective 2027. The program, titled "Innovation With Investor Safeguards," directs national regulators across 27 member states to catalog, examine, and stress-test how financial firms deploy AI and tokenized products in client-facing operations.
The decision follows ESMA's own survey of 728 firms across 19 EU countries, which surfaced 847 AI use cases. Of those, 87% remained internal; only 3% touched investment services. That ratio is about to shift. Seventy percent of surveyed firms said they would increase AI-related spending between 2025 and 2027, and tokenized equities in Europe have grown from €0.3 billion to €1.9 billion in the last 18 months. ESMA is building the supervisory apparatus before the numbers force the issue.
The USSP replaces ESMA's concluded ESG disclosures priority, which ran from 2023 to 2026, and will operate alongside the existing cyber and operational resilience priority launched in 2025. It arrives as the European Commission proposes expanding the DLT Pilot Regime's cap from €6 billion to €100 billion — a 16x increase that a coalition of 28 industry participants, including Nasdaq and Börse Stuttgart, argues is still too low.
ESMA's Union Strategic Supervisory Priority is the authority's primary mechanism for coordinating national regulators on shared targets. The agency selects up to two USSPs every three years. The new digital innovation USSP will follow a three-step process in 2027:
Step 1 — Mapping. National Competent Authorities will catalog where supervised firms deploy AI and tokenization in client-facing products and processes. This goes beyond back-office automation to include investment advice, portfolio management, customer relationship tools, and tokenized securities offerings.
Step 2 — Examination. Regulators will select a subset of most-affected firms for deeper compliance checks, assessing governance structures, data reliability, and customer outcomes.
Step 3 — Convergence. ESMA and NCAs will develop common supervisory approaches across member states, creating a unified rulebook for how AI and tokenization are overseen in EU financial markets.
ESMA stated the program will "remain flexible as new technological developments emerge," including monitoring advanced models such as frontier AI. The initiative was announced the same day ESMA Chair Verena Ross spoke at the International Conference on Finance in Warsaw, where digital innovation was a central theme.
The USSP rests on concrete data. In Q3 2025, ESMA and several NCAs surveyed firms on AI adoption. The results, published in a February 2026 report titled "AI Adoption and Trends in Securities Markets: EU Evidence," provide the statistical foundation for the new priority.
Adoption rates by firm size:
Use case distribution (847 cases from 395 firms):
Infrastructure concentration:
Generative AI access:
Board-level AI understanding:
These figures sketch a sector where AI is widely deployed but poorly governed and heavily concentrated among a handful of cloud providers. ESMA flagged the provider concentration as a systemic risk: if 41% of firms depend on one vendor, an outage or policy change at that vendor becomes a market-wide event.
The global market capitalization for tokenized assets on public blockchains reached €38 billion by February 2026, up from €7.4 billion at the start of 2024 — a roughly 5x increase in two years, according to ECB data published in April 2026. Against an estimated €241 trillion in global assets at end-2025, tokenization's penetration sits at approximately 0.016%.
In Europe specifically:
The ECB noted "limited evidence of secondary market trading" for tokenized assets in Europe, a finding that aligns with ESMA's concern about liquidity fragmentation — where tokenized assets trade in thin, disconnected pools rather than deep, unified markets. This matters because shallow liquidity impairs price discovery and fair-value execution.
European CSDs including Euroclear (D-FMI), Clearstream (D7), and others have announced major tokenization infrastructure initiatives. The European Investment Bank and World Bank have both issued tokenized bonds, with settlements conducted through the Eurosystem's exploratory work.
The DLT Pilot Regime, launched in 2023, was designed as a regulatory sandbox for tokenized financial instruments. It allowed market participants to test trading and settlement of tokenized shares, bonds, and UCITS under targeted exemptions from MiFID II and CSDR.
Participation has been modest. Known participants include approximately 12 entities: Axiology, 21X, CSD Prague, Lise, Securitize, three Spanish token exchanges (STX, OpenBrick, Token City), and Börse Stuttgart's Seturion platform, among others.
The original regime imposed a €6 billion aggregate cap on tokenized securities and set six-year license terms. In December 2025, the European Commission proposed expanding the regime significantly:
On September 8, 2026, Adan and 27 partners from traditional finance and the tokenized-asset industry called for more aggressive changes. The coalition argued that €100 billion is insufficient, requesting caps between €150 billion and €1.5 trillion, or elimination of thresholds entirely. Signatories included Nasdaq and Börse Stuttgart.
The European Parliament and Council must negotiate the final framework. The mid-2027 review of the DLT Pilot Regime is expected to inform the outcome.
ESMA's factsheet accompanying the USSP announcement identifies four primary risk categories:
Algorithmic bias and opacity. AI outputs that are "biased, unclear or misleading," as ESMA stated. With 74% of surveyed firms allowing employee access to public GenAI tools and only 32% maintaining formal policies, the governance gap is measurable.
Consumer comprehension gaps. Tokenized products that investors may struggle to understand, particularly when traditional securities are repackaged in unfamiliar wrappers on unfamiliar infrastructure.
Supervisory skill deficits. Regulators themselves may lack the technical capacity to evaluate AI systems and tokenization architectures. ESMA's three-step process explicitly includes assessing "supervisory resource and skill requirements."
Provider concentration. Dependence on a small number of third-party technology providers. The survey data quantifies this: Microsoft and OpenAI together account for 67% of AI provider fees across surveyed firms.
ESMA first raised concerns about AI risks in securities markets in May 2024, flagging algorithmic bias, data-quality issues, opaque decision-making, and excessive technology reliance. The September 2026 USSP converts those warnings into a binding supervisory program.
The USSP arrives at a specific moment in MiCA's lifecycle. The transition period for crypto businesses under MiCA concluded in July 2026. Over 40 Crypto Asset Service Provider licenses have been issued across EU member states, with the Netherlands and Germany leading in approvals.
ESMA's existing cyber and operational resilience USSP, focused on Digital Operational Resilience Act (DORA) compliance, will expand in 2027 to include smaller firms and crypto-asset service providers licensed under MiCA. This means MiCA-licensed firms will face two parallel supervisory programs: one on cyber resilience and one on digital innovation.
The European Commission is separately evaluating MiCA revisions that could extend the regulation's scope to cover tokenization of traditional financial instruments — closing the gap between MiCA's crypto-native scope and MiFID II's traditional securities framework.
The EU's approach contrasts with the U.S. regulatory trajectory in September 2026. Where the EU is building coordinated supervisory capacity across 27 member states before market scale arrives, U.S. regulators are competing for jurisdiction after Congress failed to pass comprehensive legislation.
The CFTC filed its crypto asset rulemaking (RIN 3038-AF80) with the White House Office of Information and Regulatory Affairs on September 17, two days after the Senate rejected the CLARITY Act 49-50. The SEC has separately issued 11 FAQs clarifying staking under the Howey test, proposed Regulation CA for crypto offerings, and delayed its crypto ETF-options decision to November 11.
The EU operates from a single framework — MiCA, the DLT Pilot Regime, and now the USSP — while the U.S. divides jurisdiction across the SEC, CFTC, OCC, and state regulators without a unified statute.
For firms operating across both jurisdictions, the compliance burden is asymmetric: EU regulation is comprehensive but predictable; U.S. regulation is fragmented but potentially more permissive on specific asset classes.
ESMA's new USSP is a preemptive build, not a reactive cleanup. The authority is constructing supervisory infrastructure for AI and tokenization while both technologies remain in early adoption across European securities firms. The 87/10/3 split in AI use cases — overwhelmingly internal, barely touching investment services — suggests the current risk is manageable. The question is whether supervisory capacity scales fast enough when that ratio shifts.
The tokenization market is small by any measure: €1.9 billion in European tokenized equities against a continental asset base measured in the hundreds of trillions. But the growth rate — 5x in two years globally — and the institutional infrastructure being built by Euroclear, Clearstream, and others indicate the market is being prepared for volume that does not yet exist.
Whether the DLT Pilot Regime cap lands at €100 billion or €1.5 trillion will signal how quickly Europe intends to move. For now, ESMA has chosen to supervise first and scale second.