Regulation22 October 2026

ESMA supervision of crypto: 10–15 of 360 providers

EU ministers want ESMA to supervise only the largest crypto providers. For most exchanges nothing changes. What is settled and what is not?

On 9 October 2026, the EU finance ministers adopted a negotiating position under which only the ‘most important’ crypto service providers would come under direct ESMA supervision. According to an estimate by the Council, which CryptoTicker takes over from Reuters, that means 10 to 15 of the roughly 360 authorised providers. The rest keep the supervisor that granted their MiCA authorisation: the AFM in the Netherlands, BaFin in Germany. This is a Council proposal and not law; the European Parliament has yet to settle its own position.

This follows on from our piece on how ESMA wants to tighten MiCA: that one was about what the rules say, this one is about who checks them. Below you can read what the Council decided, which figures are and are not settled, what Parliament is doing now and what you can check yourself.

ESMA supervision of crypto in short

Date and body: the finance ministers of the EU countries, on 9 October 2026. It concerns the Council's negotiating position on the Market Integration and Supervision Package (MISP), part of the savings and investments union.
Two tiers: only the most important crypto-asset service providers (CASPs) get ESMA as their supervisor. In its proposal of December 2025, the European Commission had proposed that ESMA would supervise all CASPs. The Council does not take that part forward.
Number: 10 to 15 of roughly 360 authorised providers, an estimate by the Council (via Reuters and CryptoTicker). That is 2.8 to 4.2 per cent.
Transition: two years, with joint teams of ESMA and national experts. ESMA has the final say on decisions.
Nothing changes now: no new rule is in force. Your authorised exchange stays under the same supervisor.
Still open: the exact thresholds, Parliament's position and the final legal text.

What exactly did the Council decide?

On 9 October the Council adopted the core of its position on the MISP. The package moves more supervision from national authorities to ESMA. According to the Council's press release, as Regulation Tomorrow (Norton Rose Fulbright) reports it, there are four elements:

Crypto service providers: only significant CASPs come under ESMA. The Commission's proposal was for ESMA to be the sole supervisor of all CASPs.
Infrastructure: significant central counterparties and central securities depositories, and the most important cross-border trading venues, will also have ESMA as their supervisor.
ESMA governance: a new full-time executive board, but the board of supervisors with the national authorities remains the main decision-making body.
Transition period: two years. During that time, joint teams of ESMA and national experts support the supervision, and ESMA keeps ultimate responsibility for decisions (TokenPost, 9 October).

Our editorial team could not open the Council's press release itself at the time of writing: the Council's website refuses connections from data centres. The content above comes from two sources that summarise the press release, Regulation Tomorrow and TokenPost, which do not copy from each other. Check the original text via the link under Sources.

When is a provider ‘significant’?

This is the part where the sources differ. MiCA already has one hard line: according to CryptoTicker, a provider counts as significant from 15 million active users in the EU. Only a handful of platforms reach that. The Council therefore wants extra criteria that start lower.

Source	What does it say about the thresholds?
Council (press release, via Regulation Tomorrow)	Only ‘the most important’ CASPs. No figures given.
CryptoTicker, citing CryptoSlate and Ledger Insights	15 million active EU users, or three of five criteria. Mentioned are, among others, more than 1 million active users, more than €1 billion in crypto under custody and more than €4 billion in client transactions per year.
What we could not verify	The full Council text has not yet been published, so we cannot check the thresholds ourselves.

If you work with the figures mentioned, the custody threshold mainly hits large trading platforms and hardly touches a small custodian or a broker that offers crypto on the side. That is CryptoTicker's reading, not text from the Council decision. Until the Council publishes the text, ‘10 to 15’ remains an estimate and not a list.

According to CryptoTicker, an existing MiCA authorisation stays valid if a provider comes under ESMA; there is then no second application procedure. That, too, is not yet legal text.

What is Parliament doing now?

Negotiations with Parliament only begin once Parliament has its own position. This is where things stand:

ECON Committee: according to Regulation Tomorrow, the position of the Committee on Economic and Monetary Affairs is expected in early November 2026. Regulation Tomorrow gives 1 November, a Sunday, in its report on the Council position; it is an expectation and not a fixed date.
Rapporteurs: Markus Ferber (EPP) and Eero Heinäluoma (S&D) are negotiating with the shadow rapporteurs on compromise amendments in September and October. Regulation Tomorrow described the state of play on 22 October 2026 and warns that the texts may still change.
Crypto in the draft compromise: there, too, ESMA would supervise only significant CASPs, with a new Article 59a in MiCA that lays down how a provider is declared significant. A provider that is not significant could choose ESMA supervision itself.
Market abuse: in the draft, ESMA becomes responsible for enforcing the MiCA rules against market abuse, including at providers that are not significant, with powers for market monitoring.
A difference with the Council: for central counterparties and securities depositories, Parliament's draft wants more than the Council: all of them, not only the significant ones. For crypto, the Council and this draft therefore agree; for the rest of the package they do not.

Talks between the Commission, the Council and Parliament follow. The Commission wanted more. What will come out of that, we do not know; there is no date for an agreement.

What does this mean for you as a European investor?

Now. There is nothing to do. The MISP is not law, and the transition period is two years. According to CryptoTicker, the practical effect arrives at the earliest at the end of this decade, if the proposal is adopted in this form.

Where your exchange stands now. ESMA's MiCA register names the competent authority for each provider. According to our piece on the register of 21 October, the file has 379 rows. The Netherlands is home state for 29 rows (AFM), Germany for 109 (BaFin), France for 36 and Belgium for 2. Germany therefore has by far the most; some of them are notifications from banks under Article 60. According to CryptoTicker, under this proposal a country with many authorisations also keeps the most work, because ESMA only takes the top from it.

What you can check yourself. Look up your provider in the ESMA register and check the home Member State and the legal basis (Article 63 is an authorisation, Article 60 a notification). Our MiCA authorisations page presents the register in searchable form. An authorisation in one country applies through the passport in all other EU countries, so your exchange does not have to be based in your country.

What it does not say. That a provider will soon fall under ESMA says nothing about costs, the safety of your balance or the quality of the service. That a provider stays under the national supervisor does not either.

What is not certain yet

The thresholds. The Council text had not been published at the time of writing. We know the criteria only via CryptoTicker, which cites CryptoSlate and Ledger Insights, and those sources do not all give the same figures.
Which providers it will be. ‘10 to 15’ is a Council estimate. There is no list of names.
The Council's press release. We could not open it from our environment. We rely on two summarising sources.
Parliament's position. The rapporteurs' draft compromise may still change.
The end date. The Council mentions a two-year transition, but no date on which ESMA actually takes over supervision.

This article is not investment advice. Crypto can lose a lot of value and you could lose your entire stake.

Frequently asked questions

Which crypto exchanges will ESMA supervise?

That is not known. The Council estimates 10 to 15 of the roughly 360 authorised providers, without names. The thresholds are not yet settled.

Will anything change for my account with my exchange?

No, not now. The proposal is not law and has a two-year transition period. Your exchange stays under the supervisor that granted the MiCA authorisation.

Who supervises my exchange if I live in the Netherlands?

That is the supervisor of the country where the provider received its authorisation. For a Dutch provider that is the AFM; a provider from Germany falls under BaFin. You can find it in the ESMA register.

Is this the same as MiCA 2?

No. The MISP regulates who supervises; the revision of MiCA itself, commonly called MiCA 2, regulates what applies. We wrote about that revision in our piece of 30 September.

When will I know more?

Parliament has to settle its position first; the ECON Committee is expected in early November 2026. Talks with the Council then begin.

Sources

Read on 22 October 2026.

#esma#mica#toezicht#misp#bafin#afm#regulering#vergunning