The European Securities and Markets Authority filed its formal response to the European Commission's MiCA review consultation on September 30, 2026, requesting six categories of expanded power over the EU's 359 licensed crypto-asset service providers. The submission landed on the consultation's f...
"Because of current lengthy procedures, when the freezing of suspicious crypto assets linked to criminal activities is requested, it is often too late and the assets have disappeared." — European Securities and Markets Authority, MiCA Review Response (ESMA75-113276571-1721), September 30, 2026
The European Securities and Markets Authority filed its formal response to the European Commission's MiCA review consultation on September 30, 2026, requesting six categories of expanded power over the EU's 359 licensed crypto-asset service providers. The submission landed on the consultation's final day — the deadline was extended from August 31 after the Commission received insufficient initial responses — alongside earlier filings from the European Banking Authority (September 24) and the European Central Bank-led ESCB (September 22).
Three EU regulatory bodies now agree: MiCA, nine months into full enforcement, requires structural amendment. ESMA wants authority to freeze crypto assets, shut down fraudulent websites, and issue binding token classification opinions. The EBA wants crypto lending brought under regulation, including DeFi protocol access facilitation. The ECB wants stablecoin reserve deposit floors replaced with maturity-based liquidity requirements. The Commission must now synthesize 86 questions' worth of responses into a legislative report due June 30, 2027 — with actual amendments unlikely before 2028.
The economic stakes are measurable. As of September 1, 2026, only 39 electronic money tokens have been issued under MiCA. Zero asset-referenced tokens have been authorized. At least 16 member states have crypto lending and borrowing intermediation operating in their jurisdictions with no harmonized rules. EUR-denominated stablecoin trading volumes hit €362 billion annually, growing 31% year-over-year, inside a regulatory perimeter that ESMA itself now calls incomplete.
The European Commission launched its targeted MiCA review consultation in June 2026, posing 86 questions across four thematic areas: stablecoins, DeFi, staking, and tokenized securities. Article 140 of MiCA requires the Commission to submit a review report to the European Parliament and Council by June 30, 2027. The original response deadline of August 31 was extended by one month after the Commission determined it needed broader input.
Three EU authorities filed formal responses in the final nine days:
| Authority | Filing Date | Primary Focus | |-----------|-------------|---------------| | ECB / ESCB (27 national central banks) | September 22, 2026 | Stablecoin reserve restructuring | | EBA | September 24, 2026 | Crypto lending regulation, DeFi access | | ESMA | September 30, 2026 | Enforcement powers, DeFi licensing, token classification |
The coordinated nature of the submissions is notable. Each body targets a distinct gap in the current framework, and none contradicts the others. The combined effect is a regulatory blueprint for what the industry has begun calling "MiCA 2.0."
At the time of filing, 359 crypto-asset service providers hold MiCA licenses across the European Economic Area — up from 325 on August 12 — out of approximately 1,200 firms that previously operated under national VASP registrations. Germany leads with 95 authorized CASPs. Greece joined the register on September 24 with four domestic providers.
ESMA's response (reference ESMA75-113276571-1721) identifies enforcement speed as the framework's central weakness. The authority states that existing procedures are too slow to intercept criminal proceeds before they are moved.
The specific powers requested:
Asset Freezing: ESMA wants national competent authorities — and ESMA itself in cross-border cases — to order CASPs to freeze crypto assets when there are reasonable grounds to suspect links to criminal activity, market abuse, or terrorist financing. The request ties freezing authority to specific proceedings, not arbitrary balance holds.
Website Shutdowns: ESMA requests operational authority to detect, block, and deactivate fraudulent websites operated by unauthorized crypto firms targeting EU investors. Current tools require judicial orders in most jurisdictions, creating delays that allow scam operators to extract funds and relocate.
Third-Country Enforcement: ESMA flags a persistent gap: crypto firms based outside the EU actively solicit European investors without holding MiCA authorization. The "reverse solicitation" exemption — designed for situations where EU investors initiate contact — has become a loophole. ESMA wants national regulators armed with specific powers to combat cross-border solicitation, including the ability to restrict advertising channels into the EU.
These requests represent a substantive expansion of ESMA's operational mandate. Currently, ESMA functions primarily as a coordination and standard-setting body. Direct enforcement — including asset freezing — would align its crypto authority closer to the model used by the U.S. Securities and Exchange Commission, which can obtain emergency asset freezes through federal courts.
ESMA proposes creating an entirely new regulated crypto-asset service under MiCA: firms that provide user access to decentralized finance protocols.
The proposal targets a specific business model. Multiple licensed CASPs currently offer interfaces, aggregation tools, or integration layers that connect retail and institutional users to DeFi lending, borrowing, and trading protocols. These firms operate within MiCA's existing CASP framework but provide access to products — DeFi protocol interactions — that MiCA does not directly regulate.
ESMA recommends the Commission establish clearer criteria for when an activity qualifies as "genuinely decentralized" versus when it involves sufficient centralized intermediation to trigger licensing requirements. The boundary test would determine whether a protocol's governance, operation, and upgrade mechanisms are distributed enough to fall outside MiCA's scope.
For firms that fail the decentralization test — those that operate web interfaces, custody user keys, or route transactions through centralized infrastructure — ESMA envisions a new licensable service category with tailored requirements.
The implications extend beyond EU borders. If MiCA 2.0 establishes a DeFi access provider license, it could create a template that other jurisdictions adopt, similar to how MiCA 1.0 influenced frameworks in the UK, UAE, and several Asian markets.
ESMA proposes amending MiCA to explicitly prohibit licensed CASPs from offering any licensable service in relation to asset-referenced tokens (ARTs) or electronic money tokens (EMTs) that do not comply with MiCA's requirements. The language creates what ESMA describes as a "binary supervisory test" — either a stablecoin meets MiCA requirements or no regulated firm can touch it.
This formalizes and extends the de facto USDT exclusion. Tether's USDT, representing approximately $183.7 billion in circulating supply and 60.6% of the global stablecoin market, was delisted from all major MiCA-authorized exchanges after Tether declined to seek EMT authorization. ESMA's proposal would ensure this outcome is encoded in law rather than dependent on individual exchange compliance decisions.
The binary test would also capture smaller non-compliant stablecoins. As of September 1, 2026, only 39 EMTs have been issued under MiCA. Zero ARTs have been authorized. The number of non-compliant stablecoins circulating in the broader market — accessible through DeFi protocols and non-EU exchanges — runs into the hundreds.
ESMA's proposal specifically targets a gray area: licensed firms that handle non-compliant tokens without formally listing them. Services like collateral acceptance, conversion, and custody would all fall under the ban if the underlying stablecoin lacks MiCA authorization.
The European Banking Authority's September 24 submission focuses on two areas MiCA deliberately left unregulated: crypto lending and multi-issuer stablecoin schemes.
Crypto Lending: The EBA recommends extending MiCA's CASP service list to include intermediating borrowing and lending of crypto assets. At least 16 EU member states currently have crypto lending and borrowing activity operating within their jurisdictions. Proposed safeguards include:
The EBA extends this framework to CASPs that facilitate access to DeFi lending protocols — the same business model ESMA targets with its gateway license proposal.
Multi-Issuer Stablecoins: The EBA identifies third-country multi-issuer stablecoin schemes as posing "significant to very significant risk." These structures — where multiple entities contribute to a single stablecoin's issuance and reserve management — fall outside MiCA's single-issuer authorization framework. The EBA recommends specific regulatory provisions for these arrangements, including enhanced oversight of reserve management across jurisdictions.
The European System of Central Banks — comprising the ECB and all 27 national central banks — submitted its response on September 22, proposing the most structurally significant change: eliminating MiCA's stablecoin reserve deposit requirements.
MiCA currently requires EMT issuers to hold at least 30% of reserves as bank deposits, rising to 60% for issuers classified as "significant." The ECB now argues this creates systemic risk. Large stablecoin deposits create a direct link between issuers and credit institutions, exposing banks to instability from stablecoin demand fluctuations. A mass redemption event would trigger simultaneous deposit withdrawals across multiple banks.
The proposed replacement: liquidity thresholds tied to reserve assets maturing within one to five working days. This shifts the regulatory focus from deposit placement to redemption capacity.
The ECB also proposed extending MiCA's interest payment prohibition — which currently bars stablecoin issuers from paying interest to holders — to lending and staking products. This would prevent CASPs from using stablecoins as yield-bearing instruments in ways that circumvent the existing ban.
ESMA's submission targets crypto marketing practices that currently operate outside MiCA's perimeter. The regulation primarily governs marketing by authorized CASPs, leaving third-party promoters — including social media influencers — largely unregulated.
The proposals include:
These proposals align MiCA's marketing framework closer to the EU's existing rules for financial instrument advertising under MiFID II, which require prominent risk warnings, fee disclosures, and clear identification of promotional content.
One of ESMA's most consequential proposals addresses a structural ambiguity in MiCA: token classification. The regulation creates three primary categories — utility tokens, asset-referenced tokens, and electronic money tokens — but the boundaries between them remain contested, particularly for hybrid tokens that exhibit characteristics of multiple categories.
ESMA requests authority to issue binding opinions on token classification that apply across all 27 EU member states. Currently, classification disputes are resolved at the national level, creating the potential for a single token to receive different regulatory treatment in different jurisdictions.
The binding opinion mechanism would function as follows: when a classification dispute arises, ESMA would analyze the token's characteristics and issue a determination that all national competent authorities must follow. This centralizes a critical gatekeeping function at the EU level.
For the industry, the effect is double-edged. A single classification authority eliminates the regulatory arbitrage that allows issuers to forum-shop across member states. It also concentrates classification power in a body that has demonstrated a preference for broad regulatory scope.
No binding implementation date exists for any of the proposals. The Commission must evaluate all consultation responses — the total number of submissions has not been published — and produce a report by June 30, 2027. Legislative amendments would then require European Parliament and Council approval through the ordinary legislative procedure.
Realistic timeline:
| Milestone | Expected Date | |-----------|---------------| | Consultation closes | September 30, 2026 | | Commission review report | June 30, 2027 | | Legislative proposal (earliest) | Q4 2027 | | Parliament/Council negotiation | 2028 | | MiCA 2.0 application (earliest) | 2029-2030 |
The economic impact of inaction is quantifiable in regulatory asymmetry. The EU's crypto market generated €362 billion in EUR-denominated annual trading volume with 31% year-over-year growth, according to Kaiko's State of the European Crypto Market 2026 report. The 359 licensed CASPs operate inside a perimeter that ESMA, the EBA, and the ECB all agree is incomplete — particularly around lending, DeFi access, and non-compliant stablecoin exposure.
The cost of compliance expansion is less quantifiable. Each new licensable service (DeFi gateway, lending intermediation) adds authorization requirements, capital buffers, and reporting obligations. For the 359 existing CASPs, MiCA 2.0 could require license extensions or supplementary authorizations. For the roughly 840 firms that failed to convert from VASP registrations to MiCA licenses, additional requirements further raise the bar to re-entry.
The September 30 consultation deadline marks the end of the listening phase and the beginning of the legislative drafting phase for MiCA 2.0. The coordinated nature of ESMA, EBA, and ECB submissions suggests the three authorities have pre-aligned on the direction of reform, even where their specific proposals target different market segments.
The core tension is speed versus scope. ESMA's enforcement requests — asset freezing, website shutdowns — address immediate operational gaps where criminal actors exploit procedural delays. The DeFi gateway license and crypto lending framework address structural gaps that will take years to close through legislation.
For the 359 licensed CASPs, the message is unambiguous: MiCA compliance as it exists today is a floor, not a ceiling. The regulatory perimeter will expand. The question is whether the EU's legislative machinery can move fast enough to make that expansion relevant before the market evolves past it.