The European Securities and Markets Authority is shifting from MiCA rulemaking to enforcement, setting operational resilience, outsourcing, liquidity, reverse solicitation, and EU-based operations as key supervisory priorities for 2027. ESMA's work program, published Monday, aims to coordinate national regulators and build consistent supervision of crypto-asset service providers across the European Union.
ESMA Chair Verena Ross told the European Parliament's Committee on Economic and Monetary Affairs that MiCA work had moved “from rulemaking towards supervision and convergence.” She said the EU wants innovation to flourish within a framework that provides clarity for firms, safeguards for investors, and confidence in the markets.
Key focus areas include whether licensed CASPs maintain sufficient operations inside the EU rather than relying on non-EU infrastructure, how outsourcing arrangements affect regulatory obligations, and the use of reverse solicitation by firms serving EU clients without full MiCA authorization. ESMA is also developing common risk indicators, supervisory dashboards, and reporting standards for national authorities.
The first phase of ESMA's MIDAS crypto market surveillance system is expected to become fully operational in 2027, with a second phase scheduled for the fourth quarter of 2027, subject to board approval. ESMA will contribute supervisory findings to the European Commission's MiCA review expected by June 2027.
The push follows the July 1 expiry of the final MiCA transition period. At that point, only 281 of 1,343 crypto service providers across the European Economic Area had secured MiCA authorization. An August report found 12% of unauthorized firms carried high or severe risk ratings, compared with 2% of authorized providers, and said unauthorized firms had sent about $5 billion directly to sanctioned counterparties, versus roughly $1.7 billion for authorized firms. ESMA's register reached 300 providers in early July after 57 more firms gained authorization, including Standard Chartered and FalconX.
In parallel, stablecoin issuers face detailed MiCA compliance requirements. E-money tokens and asset-referenced tokens have different authorisation, reserve, safeguarding, redemption, white paper, governance, risk management, and marketing obligations. Businesses must classify tokens based on their actual structure, confirm the correct legal entity, maintain adequate reserve and redemption systems, and ensure public communications match the token's legal features. Non-EU operations do not automatically avoid MiCA if they serve European users.
ESMA's 2027 program keeps national regulators at the center of oversight while emphasizing coordinated tools and consistent application of MiCA across the bloc. A BaFin official warned in September that moving authorization to a centralized EU supervisor could add burdens and reduce flexibility, arguing that national authorities retain knowledge of local markets and business models.
