The Markets in Crypto-Assets Regulation was sold as the end of Europe’s crypto patchwork: one rulebook, one licence, twenty-seven markets. What it did not do was create one supervisor. A firm authorised in any member state can passport its services across the whole Union, but the regulator that vets and polices it is the national competent authority where it chose to incorporate. That design decision is now the single most contested question in European crypto policy, and 2026 is the year it gets answered.
The problem the passport created is familiar from every other corner of EU financial services. If a licence granted in one country works everywhere, firms shop for the country that grants it most easily. Supervisory standards become a competitive variable, and the authority with the lightest touch effectively sets the floor for the whole market. In crypto the concentration has been stark. When the European Central Bank reviewed the state of play, it counted 94 providers authorised under MiCA as of November 2025, of which 62 already intended to operate in seven or more member states and 47 planned activity across the entire Union. These are not local businesses that happen to have a website. They are cross-border operators supervised, on paper, by a single national desk.
ESMA said as much when it looked at how one such authorisation was handled. In July 2025 it published a peer review of the Malta Financial Services Authority’s decision to license a crypto-asset service provider, and found the process fell short of what the regulation expects, from the depth of the assessment to the resources behind it. ESMA did not name the firm, and the MFSA disputed the framing, but the message to the rest of the Union was unambiguous: the weakest link in a passporting system is a supervisory problem for everyone, not just for the country that granted the licence.
The Commission’s answer arrived on 4 December 2025 in the Market Integration and Supervision Package, a sprawling reform of how the EU oversees its capital markets. Its crypto provision is blunt. It would move all CASPs out of national supervision and place them under the direct authority of ESMA, run through a new executive board of full-time independent members, with the transfer phasing in over the first one to two years after the law takes effect. Credit institutions offering crypto services would stay with their banking supervisors unless crypto became their main business. For everyone else, the home-state regulator would no longer be the front line.
In April 2026 the reform gained its most important backer. In Opinion CON/2026/13, dated 9 April, the European Central Bank said it fully supported the package and pressed the case that crypto firms are inherently cross-border and therefore belong under EU-level supervision rather than national oversight. The ECB asked for a non-voting seat on ESMA’s new board for crypto and market-infrastructure matters, and warned that the plan only works if ESMA is given the staff and funding to do the job, with a phased handover to avoid disruption.
That is where the consensus ends. When finance ministers set out the Council’s position on 8 June 2026, they balked at handing ESMA every CASP and argued that only significant firms should move to central supervision, leaving the rest with their national authorities. The European Parliament’s lead negotiator on the file, Markus Ferber, landed in the same place in the ECON committee’s June draft reports, proposing to keep smaller providers under national oversight and reserve ESMA for the significant ones. The Commission and the ECB want the whole market. The two bodies that have to pass the law want a tier.
So the real fight is not whether to centralise but how to define significant. The criteria are still being negotiated, and they are expected to turn on cross-border reach, asset volumes and transaction activity. The stakes sit entirely in that definition. Draw it wide and the passport’s race to the bottom genuinely closes, because the firms large enough to arbitrage supervision are exactly the ones ESMA would take. Draw it narrow and a mid-sized provider can still incorporate in the most accommodating jurisdiction, passport across the Union, and stay just below the threshold that would bring Paris to its door. A significance test set too high would preserve the very arbitrage the reform is meant to end.
ESMA is not waiting for the outcome to start acting like a supervisor. On 8 July 2026 it launched a common supervisory action coordinating national authorities on the digital operational resilience of CASP custody, the kind of cross-border exercise the agency runs when it wants consistent standards without waiting for new powers. The legislation will grind through trilogue for months, and even once adopted the transfer of supervision phases in gradually. But the direction is set. Europe built a market with one passport and no shared police force, and it has decided that the gap is no longer tenable. The only question left is how many firms fall on ESMA’s side of the line.
Discussion
Sign in to join the discussion.
No comments yet. Be the first to share your thoughts.