The European Commission's December 2025 Market Integration and Supervision Package proposes transferring direct supervisory authority over all crypto-asset service providers (CASPs) from national regulators to the Paris-based European Securities and Markets Authority (ESMA). The proposal has spli...
"I also advocate, along with the president of the AMF, for European supervision of crypto-asset issuers, carried out by ESMA." — François Villeroy de Galhau, Governor, Banque de France
The European Commission's December 2025 Market Integration and Supervision Package proposes transferring direct supervisory authority over all crypto-asset service providers (CASPs) from national regulators to the Paris-based European Securities and Markets Authority (ESMA). The proposal has split the 27-member bloc. France, Italy, and Austria support centralization. Malta, Luxembourg, and Ireland oppose it. The vote is expected this summer.
At stake: control over a rapidly growing licensing pipeline — 86 CASP licenses issued across 12 countries since January 2025 — and the regulatory fees and economic activity attached to them. Malta, which branded itself "Blockchain Island" in 2018 and now hosts MiCA-licensed operations for Crypto.com, Gemini, Bitpanda, OKX, and ZBX, stands to lose the most. The MFSA calls centralization "premature." France's AMF calls the current system a recipe for "forum shopping." The outcome will determine whether the EU builds a single crypto supervisor modeled on the SEC, or preserves the patchwork of 27 national regulators that MiCA was supposed to harmonize.
On December 4, 2025, the European Commission adopted a three-part legislative package — a Master Regulation, a Master Directive, and a Settlement Finality Regulation — touching approximately 18 existing legislative instruments. The crypto component is the most politically charged.
Under the proposal, a new Chapter 6 would be added to MiCA, transferring authorization, monitoring, supervision, and market abuse enforcement over all CASPs from national competent authorities (NCAs) to ESMA. The threshold for mandatory ESMA oversight: any entity generating more than 50% of total turnover from crypto-asset services over two consecutive years. Banks are exempt.
ESMA would also gain direct supervisory powers over significant trading venues, central counterparties, and central securities depositories. The crypto transfer is part of a broader restructuring that would replace ESMA's Management Board with an independent Executive Board and grant the authority power to issue "no action letters" and enforce cross-border administrative fines.
The DLT Pilot Regime would be expanded permanently, raising the maximum aggregated market value threshold to €100 billion and extending eligibility to CASPs as operators. The legislation requires trilogue negotiations with the European Parliament and Council, with implementation projected for 2027-2029.
The pro-centralization bloc formed publicly on September 15, 2025, when France's Autorité des Marchés Financiers (AMF), Austria's FMA, and Italy's CONSOB published a joint position paper. Their four demands: direct ESMA supervision of major CASPs; mandatory compliance checks for non-EU platforms accessed by European intermediaries; independent pre-authorization cybersecurity audits; and a centralized pan-European filing system for token offering white papers.
The paper cited "supervisory inconsistencies" that emerged in MiCA's first months of implementation, though it stopped short of naming specific jurisdictions. France's AMF separately warned against a "fast-food" approach to licensing — language widely interpreted as a reference to Malta's speed of processing CASP applications.
ESMA Chair Verena Ross has pushed for centralized oversight, arguing it would make European capital markets "more integrated and globally competitive." Banque de France Governor François Villeroy de Galhau called for ESMA to directly supervise crypto-asset issuers.
On the other side, Malta, Luxembourg, and Ireland formed an informal opposition bloc. Their argument: MiCA became fully applicable on December 30, 2024. Less than a year of data exists. Structural changes are premature.
The division maps onto a familiar EU fault line: larger member states with Paris- and Frankfurt-based institutions favor centralized architecture they would disproportionately influence; smaller states that have built financial services sectors — Malta in crypto, Luxembourg in funds, Ireland in tech — resist ceding the regulatory infrastructure that attracted those industries.
Malta passed the Virtual Financial Assets (VFA) Act in 2018, becoming one of the first jurisdictions globally to create a dedicated crypto regulatory framework. The strategy worked. By mid-2025, the MFSA had licensed five CASPs under MiCA: OKX, Crypto.com, Gemini, Bitpanda, and ZBX — placing it among the most active licensing jurisdictions in the EU.
Across the bloc, 14 exchanges held full MiCA authorization as of March 2026, including Binance (licensed in France), Kraken and Coinbase (Ireland), and Bitstamp (Luxembourg). Malta's five licenses represent roughly a third of the total.
The MFSA's official position, delivered via statement, called centralization "an additional layer of bureaucracy" that could "hinder efficiency at a time when the EU is trying to enhance competitiveness." An MFSA spokesperson told Cointelegraph it is "premature to introduce structural changes" when MiCA's market impact "remains under assessment."
MFSA CEO Kenneth Farrugia has framed Malta's licensing record as a feature, not a bug. Following ESMA's peer review of Malta's processes, Farrugia said the findings "should give confidence to firms considering Malta as a licensing jurisdiction."
Ian Gauci, a partner at GTG Advocates who helped architect Malta's original VFA Act, warned that splitting supervision across ESMA, national authorities, and the EU's new Anti-Money Laundering Authority (AMLA) could "fragment accountability and undermine supervisory expertise built by early-moving jurisdictions." He argued the dispute is about regulatory structure, not jurisdictional advantage.
Malta has also raised the flight risk. Officials warned that excessive centralization could push firms toward Dubai, the United States, and Asia, "where clear frameworks and innovation-friendly policies are already in place." The argument carries weight: Malta's crypto licensing pipeline generates an estimated $450 million annually, according to industry reports.
In July 2025, ESMA conducted a fast-track peer review of Malta's CASP authorization process, reportedly focused on OKX's license. The findings were mixed.
ESMA concluded that Malta "partially met expectations" on at least one authorization, citing unresolved concerns around governance, information and communications technology (ICT) standards, and anti-money laundering controls. The review did not recommend revoking any license.
The MFSA seized on the positive elements, noting that ESMA found Malta's overall supervisory standards adequate. The AMF seized on the negative elements, using the review as evidence that national supervisors apply MiCA unevenly.
OKX's European CEO, Erald Ghoos, pushed back publicly, stating the exchange has operated under Malta's supervision since 2021 and rejecting the notion that companies select smaller jurisdictions to avoid oversight. He characterized the centralization push as "a political decision" lacking evidence that current models are failing.
The peer review achieved a 20% improvement in AML/KYC standards across reviewed jurisdictions, according to ESMA data — an outcome both sides cite as supporting their position.
The centralization debate intersects with a broader compliance cost crisis in European crypto. According to PwC estimates, crypto firms allocate 20-30% of budgets to compliance. CoinLaw data shows 42% of crypto firms expect compliance costs to exceed €500,000 annually under MiCA. For startups, licensing alone costs an estimated €50,000 to €100,000.
Since MiCA enforcement began, more than €540 million in penalties have been issued to non-compliant firms. An estimated 25% of global crypto firms plan to withdraw from the EU entirely, citing elevated compliance costs, per industry surveys.
Adding ESMA as a centralized supervisor would introduce a new fee structure on top of existing national costs. The Commission proposal includes transitional provisions to avoid disruption, but industry participants expect net costs to rise.
From March 2026, Electronic Money Token custody and transfer services may require both MiCA authorization and separate payment services licenses, potentially doubling compliance costs for stablecoin-adjacent operations. The Crypto-Asset Reporting Framework (CARF) under DAC8, effective January 1, 2026, requires CASPs to collect and report detailed transaction data to tax authorities in over 40 countries.
Registered VASPs in the EU increased by 47% since MiCA took effect. Over 65% of EU crypto firms achieved compliance by early 2025. But the pipeline growth cuts both ways: more licensed entities means more supervision to finance.
July 1, 2026 marks the expiration of MiCA's grandfathering period — the transitional window allowing pre-existing CASPs to continue operating without full MiCA authorization. After that date, unlicensed operators must cease EU operations.
France's AMF has already issued public reminders that the deadline is firm. The timing creates political pressure: the ESMA centralization vote is expected the same summer. If passed before July 1, the transition from national to ESMA supervision could overlap with the grandfathering expiration, creating a dual compliance burden.
If passed after, national regulators will have completed a full cycle of MiCA licensing — potentially strengthening Malta's argument that the current system works and should not be restructured mid-implementation.
The trilogue process — negotiations between the Commission, Parliament, and Council — begins in 2026. Duration is projected at 12-24 months, with implementation between 2027 and 2029. The crypto supervision provisions could be accelerated or carved out from the broader capital markets package, depending on political dynamics.
A qualified majority in the Council requires 55% of member states representing 65% of the EU's population. France (68 million), Italy (59 million), and Germany (84 million) alone represent roughly 47% of the bloc's population. If Germany sides with France, the population threshold is effectively met. Smaller states' votes would become procedurally relevant but demographically outmatched.
Malta's population: 542,000 — 0.12% of the EU total.
The Malta-ESMA dispute is a proxy for a larger question the EU has dodged since MiCA's inception: whether a passport-based system with 27 national regulators can credibly supervise a borderless, 24/7 asset class. France argues it cannot. Malta argues the system has not been tested long enough to know.
The economic stakes are concentrated but consequential. Malta's crypto licensing pipeline, its five MiCA-authorized exchanges, and the broader financial services ecosystem that "Blockchain Island" built over seven years are directly threatened by centralization. For larger member states, the appeal is structural: a single supervisor eliminates the perceived arbitrage that smaller states exploit.
The data supports neither a definitive case for nor against centralization. MiCA has been fully applicable for less than 12 months. The 20% AML/KYC improvement found in ESMA's peer reviews suggests the existing framework is producing results. The "partially met expectations" finding on Malta's authorization process suggests gaps remain. Whether those gaps require a new institutional architecture or simply more time is the central question the trilogue will resolve.
What is clear: the decision will be made by population-weighted voting math that structurally disadvantages the small states with the most to lose.