EU Council Limits ESMA Crypto Supervision to Significant CASPs

EU finance ministers have agreed the Council's opening position on a key piece of crypto market legislation, and in doing so they have significantly narrowed the European Commission's original ambition. Rather than giving the European Securities and Markets Authority (ESMA) direct oversight of every MiCA-licensed crypto asset service provider (CASP) across the bloc, the Council wants that supervisory power reserved for firms that qualify as "significant." For accounting firms, auditors, and CFOs whose clients hold or are pursuing MiCA authorisation, the practical question is not whether this compromise matters but whether their clients sit above or below the revised threshold. The answer to that question now requires more than a simple user-count check, because the Council has expanded the criteria in ways that could catch mid-sized platforms that previously assumed they were out of scope.

What the Commission Originally Proposed

The starting point is the Market Integration and Supervision Package (MISP), published by the European Commission in December 2025. One of its headline provisions was a proposal to centralise supervisory authority over all MiCA-regulated CASPs at the EU level, handing that responsibility to ESMA rather than leaving it with the twenty-seven national competent authorities (NCAs) that currently enforce MiCA on the ground.

The Commission's rationale was straightforward: a fragmented patchwork of national supervisors creates regulatory arbitrage opportunities, inconsistent enforcement standards, and cross-border risk that no single NCA is well placed to address. Commissioner Maria Luís Albuquerque has been a vocal advocate of that centralising approach.

Why the Commission's Approach Was Controversial

Not everyone in the Council agreed. Several member states were reluctant to cede supervisory authority over their domestic crypto markets to a single EU-level body, particularly for smaller or domestically focused CASPs that pose limited cross-border risk. The political compromise that emerged reflects those concerns: ESMA gets supervisory teeth, but only over the platforms whose scale makes them genuinely cross-border systemic issues.

What the Council Has Agreed Instead

Under the Council's negotiating position, ESMA will supervise only CASPs that meet the "significant" designation. The existing benchmark carried over from current MiCA provisions sets that bar at fifteen million EU users. The Council has retained that figure, so a CASP with a large retail footprint remains firmly in scope regardless of other factors.

The more consequential change is the addition of a set of alternative criteria. A CASP can now be classified as significant even with a user base of just over one million, provided it simultaneously satisfies at least two other qualifying tests. Those additional tests are understood to include metrics such as the value of assets held in custody and the firm's trading volumes.

How the Threshold Works in Practice

The structure creates a tiered test rather than a single binary rule. In practical terms:

• A CASP with fifteen million or more EU users is significant on that basis alone.
• A CASP below that user count can still be significant if it clears the one-million-user floor and then satisfies at least two of the additional quantitative criteria, such as assets under custody and trading volume.
• A CASP that falls short on all metrics remains subject to its home-state NCA, not ESMA.

Commissioner Albuquerque made clear at the Council meeting that the Commission "deeply regrets" the compromise, arguing that it will leave a significant share of EU-wide crypto activity outside direct ESMA oversight. Her criticism covered multiple elements of the MISP package, of which the CASP supervision question was one part.

MISP and MiCA 2: Two Separate Tracks

A point of confusion worth clarifying for compliance teams is that MISP and the separate omnibus package informally called MiCA 2 are distinct legislative tracks. MiCA 2 is a broader review of the original Markets in Crypto-Assets Regulation, and its public consultation closed in August 2026. MISP, by contrast, is a market integration and supervision measure that does not reopen the full MiCA text. The Council's agreement on its MISP negotiating position means trialogue negotiations with the European Parliament can begin, but the MiCA 2 timeline is separate and likely longer.

Why the Distinction Matters for Planning

Clients who have been waiting on MiCA 2 to finalise compliance architecture should not treat the MISP position as a proxy for that broader review. The two processes will move on different schedules, and the supervisory model agreed under MISP may itself be revisited once MiCA 2 reaches its own trialogue stage. Advisers should track both dockets and avoid conflating them in board-level briefings.

Accounting and Audit Implications for B2B Practices

The shift from a universal ESMA model to a tiered significant-CASP model has concrete implications for the accounting and audit work that firms perform on behalf of crypto clients.

Regulatory Capital and Prudential Reporting

ESMA-supervised CASPs are expected to face more intensive prudential reporting obligations than their NCA-supervised counterparts, consistent with the pattern seen in banking under the ECB's significant institution framework. Firms that find themselves reclassified as significant under the expanded multi-factor criteria may need to upgrade their regulatory capital calculations, internal controls attestations, and periodic disclosure schedules. Audit teams should identify which clients are near the boundary now, well before the MISP text is finalised, so that scope letters and fee structures can be adjusted if needed.

AML and KYC File Standards

ESMA-supervised entities are unlikely to be held to identical AML standards as NCA-supervised ones in terms of examination frequency and documentation depth. Significant CASPs should anticipate more frequent regulatory interaction and correspondingly higher evidentiary standards for transaction monitoring records, beneficial ownership files, and suspicious activity reporting. Practices advising those clients will want to benchmark current file quality against the expectation of enhanced supervisory scrutiny. For background on what strong AML documentation looks like in practice, see our analysis of stablecoin AML compliance standards for financial institutions.

Digital Asset Accounting Software and Multi-Jurisdiction Reporting

One underappreciated consequence of ESMA direct supervision is the likelihood of harmonised reporting templates that may differ from formats currently accepted by national regulators. Practices using crypto bookkeeping software or digital asset accounting software to generate regulatory reports should verify that their tooling can produce ESMA-compatible outputs without manual reworking. This is a technology readiness question that can take months to resolve, and firms that wait for the final legislative text before raising it with their software providers will be behind the curve.

Cross-Border Client Structures

A CASP that operates across multiple EU member states but currently relies on a single home-state NCA for supervision may find that ESMA designation triggers reporting obligations to a body that has different data formats, different language requirements, and different supervisory calendars than its domestic regulator. Accounting teams managing consolidated group accounts for such clients should model both scenarios now: one in which the client remains NCA-supervised, and one in which ESMA assumes primary oversight. For broader context on how transaction monitoring scales across jurisdictions without proportionally scaling cost, see our piece on scaling crypto transaction monitoring efficiently.

What Comes Next

The Council's adoption of a general approach on MISP opens the door to trialogue talks with the European Parliament. The Parliament's own position on the supervisory model is not yet finalised, and it is entirely possible that MEPs will push for a broader ESMA remit closer to the Commission's original proposal. The final text could therefore land anywhere on the spectrum between the Council's targeted approach and the Commission's universal model.

For now, the key dates to watch are the Parliament's committee-stage amendments to MISP and the first formal trialogue session. Given that the MiCA 2 consultation has already closed, there is also a possibility that elements of both processes are eventually reconciled in a single legislative vehicle, though that remains speculative at this stage.

What is not speculative is the need for accounting firms and CFOs to begin the classification exercise today. The multi-factor threshold means that a client who assumed they were comfortably below the significant designation may need to revisit that assumption as soon as the MISP text advances.

Frequently Asked Questions

What is a "significant" CASP under the Council's MISP position?

Under the Council's proposed framework, a CASP is significant if it has at least fifteen million EU users, or if it has just over one million EU users and also satisfies at least two additional quantitative criteria, understood to include metrics such as assets in custody and trading volume.

Which body supervises CASPs that do not qualify as significant?

CASPs that fall below the significant threshold remain under the supervision of their home-state national competent authority, the same arrangement that applies under the current MiCA framework.

Is MISP the same as MiCA 2?

No. MISP, the Market Integration and Supervision Package, and MiCA 2, the broader review of the original Markets in Crypto-Assets Regulation, are separate legislative tracks. MISP focuses on market integration and supervisory architecture; MiCA 2 is a wider review of the regulation itself. Both are progressing, but on different timelines.

What should accounting firms do now to prepare clients for potential ESMA supervision?

Firms should map each relevant client against both the fifteen-million-user threshold and the new multi-factor criteria, audit current AML documentation and regulatory reporting formats for compatibility with enhanced supervisory standards, and check whether their crypto bookkeeping software or digital asset accounting software can generate ESMA-compatible outputs.

Could the final MISP text differ significantly from the Council's position?

Yes. The Council's general approach is a negotiating position, not final law. The European Parliament may seek a broader ESMA remit during trialogue, and the Commission has stated it regrets the Council's compromise. The eventual text could be meaningfully different from what the Council has proposed.

Source: Ledger Insights