EU ministers hand ESMA direct oversight of 10 to 15 of about 360 crypto providers
EU finance ministers agreed on Oct. 9 to put the largest crypto providers under direct ESMA supervision, an estimated 10 to 15 of roughly 360. The Council's text is far narrower than the Commission's plan to move every provider under ESMA.
The Investor · Invest desk
Three figures: under the Council's draft, ESMA would directly oversee crypto providers with at least 15 million active EU users; one other criterion is over 1 billion euros in crypto assets under custody; between 345 and 350 of roughly 360 providers would stay with national regulators.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Active EU users for direct ESMA oversight, at least | 15 million users | 7 | |
| Custody criterion, over | 1 billion euros | 8 | |
| Providers left with national regulators, at least | 345 providers | up to 350 of roughly 360 | 14 |
What happened
- Under the draft, the European Securities and Markets Authority would supervise any provider with 15 million active EU users, or any that meets three of five criteria on customers, custody, volumes and interconnectedness.
- ESMA would gain powers to request information, inspect, investigate breaches and fine, and the draft envisages powers to restrict services or withdraw authorization.
- A July 2025 ESMA review of Malta's approval of an unnamed provider found insufficient evidence that governance, conflicts of interest, technology, custody and some money-laundering risks were adequately assessed.
- Malta said it was implementing ESMA's recommendations but opposed handing supervision to ESMA, arguing in September 2025 that MiCA was too new and that centralization could add bureaucracy.
- The agreement is the Council's negotiating position and does not change the law; the text must still be negotiated with the European Parliament.
Why it matters
- What it limits constraint Roughly 345 to 350 providers stay with their home regulators, so single-license passporting works as before for about 96% to 97% of firms.
- What doesn't add up contradiction The one case the source cites for central supervision is a review that credited Malta's regulator with sector expertise and sufficient resources and did not find every Maltese license deficient.
- Who has to decide decision Providers growing toward the user, custody and volume figures have to decide how much compliance to build for ESMA inspections and fines, since scale and not place of incorporation would move them.
Next story · Invest · yesterday
BingX EU wins Austrian MiCA license 105 days after the transition period endedConfirmed4 publishers
The draft offers a provider two routes in. A flat 15 million active EU users qualifies it outright [7]. Failing that, it needs three of five criteria, and the source gives figures for three of them: more than 1 million active users, over 1 billion euros in custody and more than 4 billion euros in annual client transactions [8]. The user bar on the second route is one fifteenth of the bar on the first [13].
Reuters, citing officials, counted 10 to 15 of roughly 360 providers that would qualify [3]. Under the Commission's original plan to move all providers, ESMA's direct caseload would be 360 firms, 24 to 36 times larger [2][15]. We think the Council has chosen deliverability over breadth: ESMA takes the firms where a failure would reach the most customers and leaves the rest where their licenses were issued. The report does not say how much custody or client volume those 10 to 15 firms hold. That share would show how much of the risk the perimeter covers.
The review as described identifies neither the provider at the center of the Malta case nor its size [10]. If it was small, the Council's draft leaves it with the regulator that approved it [5]. A size test measures reach. The gaps ESMA described, in governance, custody and technology, concern the quality of an authorization, and for any firm under the bar that remains a national decision [10][5].
We expect the loophole to narrow at the top and stay open below. Parliament could lower the thresholds and push the count of 10 to 15 firms toward the Commission's 360. Or the Council's text could survive intact, and the count holds. Or the user and custody figures could be rewritten in negotiation, moving the count either way. The first would make our view of a narrow perimeter wrong. So would a first list of directly supervised firms that included the provider in the Malta review, since that would show the size test catching the case that prompted it.
What to watch
- Parliament's position on the thresholds: any cut to the 15 million user bar or the three-of-five test raises the 10 to 15 count toward the Commission's 360.
- Whether a first list of directly supervised firms includes the provider at the center of ESMA's Malta review.
- Whether Reuters' 10 to 15 estimate survives once the two criteria without published figures are pinned down in the final text.
Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+8
- Incentives
- Not scored
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The Council of the European Union reached a political agreement on Oct. 9 to give ESMA direct responsibility for the bloc's most significant crypto-asset service providers, as part of a wider package to integrate European financial markets.
- [2]
The compromise is considerably narrower than the European Commission's original plan to move all crypto service providers under ESMA.
- [3]
Officials estimate that only 10 to 15 of roughly 360 providers would qualify for centralized supervision.
- [4]
The agreement sets the Council's negotiating position rather than changing the law immediately; the Council must still negotiate the proposal with the European Parliament.
- [5]
Only 10 to 15 of roughly 360 providers may face centralized oversight, leaving most firms under national regulators.
- [6]
Under MiCA, a firm licensed in one member state can serve customers across the 27-country bloc while remaining primarily supervised by its home-country regulator.
- [7]
Under the Council's draft, ESMA would take direct oversight of crypto providers with at least 15 million active EU users, or those meeting three of five additional significance criteria covering their customer base, custody assets, transaction volumes and financial interconnectedness.
- [8]
The criteria include more than 1 million active users, over 1 billion euros in crypto assets under custody and more than 4 billion euros in annual client transactions.
- [9]
ESMA would gain powers to request information from directly supervised firms, conduct inspections, investigate breaches and impose financial penalties; the draft also envisages authority to restrict services or withdraw authorization where firms do not meet requirements.
- [10]
A July 2025 ESMA review of the Malta Financial Services Authority's authorization of an unnamed crypto provider questioned why the company was approved while material issues remained unresolved, and found insufficient evidence that the assessment adequately addressed governance, conflicts of interest, technology infrastructure, custody arrangements and certain anti-money-laundering risks.
- [11]
The review did not establish that every Maltese license was deficient; it credited the Maltese regulator with sector expertise and sufficient supervisory resources, while recommending improvements to its authorization process.
- [12]
Malta said it was implementing the recommendations but opposed transferring supervision to ESMA, arguing in September 2025 that MiCA was too new to justify an additional regulatory layer and warning that centralization could introduce bureaucracy and hamper competitiveness.
- [13]
The 15 million user route is 15 times the 1 million active user criterion.
- [14]
Between 345 and 350 of roughly 360 providers, about 96% to 97%, would stay with national regulators.
- [15]
Moving all roughly 360 providers to ESMA would make its direct caseload 24 to 36 times the 10 to 15 firms in the Council's estimate.
Sources
2 independent publishers whose own reporting we read for this story.
- cryptobriefing.comEU finance ministers strike preliminary deal to centralize markets oversight under ESMA
1 article · October 9, 2026
- cryptoslate.comEU targets MiCA loophole that lets crypto exchanges serve 27 countries with one license
1 article · October 12, 2026
Topics and entities
Topics
- EU Crypto Regulation
- Financial market supervision
- MiCA licensing and passporting