The European Securities and Markets Authority has set operational resilience, outsourcing and sufficient EU based operations among its main crypto supervisory priorities for 2027 as the bloc moves further into enforcement of the Markets in Crypto Assets Regulation.
Summary
- ESMA will focus its 2027 MiCA supervision on operational resilience, outsourcing, liquidity, reverse solicitation and crypto firms maintaining sufficient EU operations.
- The regulator plans common risk indicators and reporting standards for national authorities supervising crypto asset service providers.
- ESMA expects the first phase of its MIDAS crypto market surveillance system to become fully operational in 2027.
- Supervisory findings will feed into the European Commission’s MiCA review expected by June 2027.
ESMA said in its 2027 work program published Monday that its work on MiCA will concentrate on coordinating national regulators and developing more consistent supervision of crypto asset service providers across the European Union. The program comes as the regulator moves from writing and implementing MiCA rules toward overseeing how licensed firms comply with them in practice.
Chair Verena Ross described the change during a meeting of the European Parliament’s Committee on Economic and Monetary Affairs, saying ESMA’s MiCA work had moved “from rulemaking towards supervision and convergence.”
“We want innovation to flourish within a framework that provides clarity for firms, safeguards for investors and confidence in the markets,” Ross said.
ESMA will focus MiCA supervision on operational risks
Operational resilience will be one of the main areas under scrutiny as ESMA works with national competent authorities responsible for supervising CASPs.
Outsourcing risks, liquidity, reverse solicitation and the classification of crypto assets are among the other areas identified for coordinated work in 2027. Supervisors will pay attention to whether firms maintain sufficient operations within the EU instead of relying heavily on functions or infrastructure based elsewhere.
MiCA places specific requirements on outsourcing by CASPs. Firms remain responsible for their regulatory obligations when operational functions are handed to third parties, while outsourcing arrangements cannot prevent national regulators from carrying out their supervisory duties.
The 2027 priorities build on work already underway. In July, crypto.news previously reported that ESMA had started reviewing MiCA custodians to test how authorized providers manage operational risks.
The Common Supervisory Action covers areas including private key and storage management, transaction controls, incident response and reliance on third party technology providers. The exercise moved scrutiny beyond whether a firm had obtained authorization and toward the controls used after receiving a license.
Cyber and operational resilience will remain an EU wide supervisory priority in 2027 alongside a new priority covering digital innovation. ESMA said on Sept. 23 that the new work will initially focus on how supervised entities use artificial intelligence and tokenization, while the resilience priority has been in place since 2025.
MiCA reporting and surveillance are next on ESMA’s agenda
ESMA plans to develop a more consistent approach to the information CASPs periodically submit to national regulators.
The regulator intends to promote common risk indicators and supervisory dashboards that authorities can use when monitoring licensed firms. The work is designed to support convergence between national supervisors as MiCA continues to be applied across different EU jurisdictions.
Market surveillance will form another part of the 2027 program through MIDAS, ESMA’s centralized system for monitoring potential market abuse in crypto markets.
The first phase of MIDAS is expected to become fully operational in 2027. A second phase, first disclosed in February, is intended to provide more analytical capabilities and add new types of data to the system.
ESMA has scheduled that rollout for the fourth quarter of 2027, subject to approval by its board.
The regulator has already produced guidelines for national authorities on supervisory practices used to prevent and detect market abuse under MiCA, forming part of the framework that MIDAS will support.
Data and technology are set to play a larger role across ESMA’s supervisory work beyond crypto. Its 2027 program includes development of the ESMA Data Platform and the deployment of artificial intelligence tools to support supervision, alongside work on cybersecurity and tokenization.
ESMA supervision follows the end of MiCA transition periods
The focus on supervision follows the expiry of the final MiCA transition period on July 1, which left firms that had previously relied on national registrations facing EU wide authorization requirements.
Only 281 of 1,343 crypto service providers operating across the European Economic Area had secured MiCA authorization after the deadline, leaving 1,062 without approval at the time.
Data cited in that August report showed that 12% of unauthorized firms carried High or Severe risk ratings, compared with 2% of authorized providers. Unauthorized firms had sent $5 billion directly to sanctioned counterparties, while authorized firms recorded roughly $1.7 billion.
The pool of authorized firms continued to grow after the deadline. ESMA’s register reached 300 providers in early July after 57 firms gained authorization, including Standard Chartered and FalconX. Authorized providers can use MiCA passporting rights to offer covered services across EU member states.
Supervisory questions have remained around firms that continue serving European customers without a MiCA license. Binance, for example, was serving some EU customers through provisions including reverse solicitation after missing the July 1 licensing deadline and withdrawing its Greek application in June.
ESMA had sought confirmation that Binance was properly winding down relevant EU operations, while the exchange continued pursuing authorization elsewhere. Reverse solicitation, which covers situations where an EU client initiates contact with a third country firm on their own exclusive initiative, is among the areas ESMA has identified for supervisory attention in 2027.
ESMA will feed supervision findings into MiCA review
Experience gained from supervising CASPs will feed into the European Commission’s scheduled review of MiCA, which is expected by June 2027.
The Commission opened a public consultation on the functioning of the framework in May, seeking feedback from individuals, crypto service providers, issuers, financial institutions, academics, industry groups and public authorities. The consultation ran through Aug. 31.
ESMA plans to contribute its supervisory findings to that review and prepare for any legislative proposal that follows.
Questions over how crypto supervision should be organized across the EU remain part of the regulatory debate. A BaFin official warned in September that moving authorization responsibilities to a centralized EU supervisor could place extra burdens on firms and reduce flexibility, arguing that national authorities retain knowledge of local markets and individual business models.
For 2027, ESMA’s work program keeps national regulators at the center of CASP oversight while placing greater emphasis on coordination, common supervisory tools and consistent application of MiCA across the bloc.
