Who ESMA Will Supervise: Every CASP in the Commission's Text, Only the Significant Ones in the Council's Direction

Executive Summary

The Commission has proposed that the European Securities and Markets Authority (ESMA) authorize and supervise every crypto-asset service provider (CASP) in the Union, not just the large ones. It would delete the one article of MiCA that defines a “significant” CASP. Most Member States, in the Council’s own reports, want the opposite: ESMA for significant CASPs only, national authorities for the rest.

The Council’s Economic and Financial Affairs configuration (ECOFIN) meets in Luxembourg on 9 October 2026 and is invited to agree its position on the package that carries this change. Whatever it says, nothing becomes law that day. For a tokenization issuer, the practical question is who supervises the companies that custody, trade, place or transfer your tokens, and when that changes.

This is general information, not legal advice. Where we draw a conclusion, we say “by our reading”.

Key Takeaways

• The word “significant” already exists in MiCA. Article 85 says a CASP is significant with at least 15 million active users, on average, in one calendar year. Today it triggers reporting to ESMA, not ESMA supervision.
• The Commission’s proposal does not use that threshold. It moves all CASPs to ESMA and deletes Article 85. Banks stay with their current supervisors.
• The Council Presidency reports that most Member States want a significance-based split. No numbers are agreed in the public documents we read.
• The ECB supports ESMA supervision and also wants a significant-CASP category kept and strengthened.
• Under the Commission’s text, ESMA would take over 24 months after entry into force. Nothing here is law yet.

The Word “Significant” Is Already in MiCA

MiCA (Regulation (EU) 2023/1114) has a Chapter 5 of Title V called “Significant crypto-asset service providers”. It has one article. Article 85(1) says a CASP is deemed significant if it has at least 15 million active users in the Union, on average, in one calendar year, calculated from the daily number of active users in the previous calendar year. Under Article 85(2), the CASP must notify its authority within two months of reaching the number.

What follows from significance is small. The home authority gives ESMA’s Board of Supervisors annual updates on authorizations, withdrawals and certain supervisory powers (Article 85(3)), and ESMA may use some of its general powers (Article 85(5)). Supervision stays national. Today, a significant CASP and a small one answer to the same kind of authority.

That is the baseline the debate is about. The Commission proposes to delete it. The Council wants to turn it into the dividing line.

What the Commission Proposed

On 4 December 2025 the Commission published a proposal for a regulation on capital market integration and supervision, COM(2025) 943 (procedure 2025/0383(COD)). It amends fourteen regulations, including MiCA in its Article 9. The explanatory memorandum describes the aim for CASPs as transferring authorization, monitoring and supervision of all CASPs from national competent authorities to ESMA. The same package makes ESMA the supervisor only of significant central counterparties, central securities depositories and trading venues, plus pan-European market operators. For CASPs, “all” is a deliberate choice, and the recitals give the reason: CASPs are a new activity, it is important to ensure consistency from the start, and the activity is dominated by cross-border services provided by electronic means.

Two details matter in practice. First, the speed: the 40-working-day decision period is the same figure as in the current Article 63, so the proposal changes who decides, not the clock. Second, the transition: a CASP authorized by a national authority keeps that authorization. What moves is the supervisor, not the license.

Who Is Not Moved

MiCA lets some already regulated firms provide crypto-asset services without a CASP authorization: credit institutions, central securities depositories, investment firms, market operators, e-money institutions, UCITS management companies and alternative investment fund managers, each within the limits of Article 60. The proposal leaves them with the authorities that supervise them, with two conditions.

• Banks do not move. The explanatory memorandum says the existing centralized banking supervision makes a transfer unnecessary where the entity is a credit institution.
• A 50% test moves the rest. Under new Article 138a(2), an entity counts as providing crypto-asset services as its main activity when more than 50% of its total annual turnover, per the last approved financial statements, comes from crypto-asset services for at least two consecutive years. Then ESMA supervises all of its activities, working with the authority that licensed it. Firms must report that percentage yearly (new Article 60(6a)).

The ECB’s opinion of 9 April 2026 (CON/2026/13) supports this transfer and then questions the metric. A single turnover test, it says, may miss models whose risk driver is the volume of operations, such as custody or a trading venue, and proprietary trading and crypto lending could be considered.

What Member States Want Instead

The Council’s documents are the public record of the pushback. The Cyprus Presidency’s steering note of 8 June 2026 (9891/26) reports that on 5 May a broad majority of Member States wished significant CASPs to be added to the list of entities under ESMA’s direct supervision, “and not all CASPs as originally proposed by the Commission”. Its progress report of 24 June 2026 (10735/26) goes further:

• The majority supported limiting direct ESMA supervision to significant CASPs only.
• Many Member States want significance judged on objective, measurable, quantitative criteria that capture scale and cross-border relevance.
• There was convergence on the importance of active users in absolute terms, with thresholds to be calibrated on market evidence. Views diverged on an “assets under custody” criterion.
• Many want short transitional arrangements, meaningful involvement of national authorities, and cost control on ESMA’s budget.
• A significant number of Member States prefer national supervision with enhanced coordination for significant firms that rely on Article 60.

The report also lists what is unsettled: the criteria, the metric for each criterion, the number of consecutive years of significance before supervision transfers, and how market-abuse supervision would work. The 3 July steering note (11406/26) repeats that the scope of direct supervision and the “significance” criteria are outstanding.

By our reading, the likeliest compromise shape is not “all” or “none” but a threshold test that looks like Article 85 with more criteria. That is a reading of the direction of the documents, not a forecast of the number.

What the ECB Adds

The ECB welcomes the transfer of all CASPs and, in the same paragraph, proposes keeping the category of significant CASPs in MiCA and widening the criteria beyond user counts to include size, cross-border activity, systemic relevance, trading volumes for platforms, volumes exchanged against funds and group-wide activity. For significant CASPs it suggests an intermediate EU parent undertaking, group-level recovery plans, prior approval of directors and senior management, and enhanced disclosure.

The reason it gives is structural: multi-function groups that bundle custody, trading and settlement across borders, operating largely outside consolidated supervision. In its September 2026 response to the MiCA review consultation, the ESCB repeats the proposals on significant CASPs.

Where This Meets the MiFID Line

Article 1 of this series set out that a transferable token with share-like or bond-like rights is a MiFID II financial instrument and sits outside MiCA (Article 2(4)(a)). The CASP regime is therefore about crypto-assets that are not financial instruments, including tokens used as settlement assets. It is not the regime for a tokenized security.

That boundary decides which supervisor you will meet:

• A token that is a financial instrument: the venue, custodian and intermediaries are MiFID firms, central securities depositories or DLT Pilot operators. The CASP change does not govern them.
• A token that is not a financial instrument: the services around it (custody, trading platform, exchange, placing, transfer) are crypto-asset services under MiCA Article 3(1)(16), and ESMA or the national authority is your counterparty’s supervisor depending on how this file ends.
• A token used to pay: e-money tokens and asset-referenced tokens fall under MiCA, and a CASP that custodies or exchanges them is a CASP. The ECB says this link is why it wants a seat on ESMA’s Executive Board for CASP discussions.

The same proposal also extends the DLT Pilot Regime to CASPs. The ECB says it has “some concern” about that, because CASPs currently work under a lighter supervisory framework and lower own funds requirements, while the Pilot allows services relating to financial instruments. Where the two regimes touch, the classification question of Article 1 is the one that decides which rulebook applies.

Timeline: What Can Be Said and What Cannot

On 9 October 2026 ECOFIN is invited to agree the Council’s position on the package. The European Parliament’s file is with the Economic and Monetary Affairs Committee (ECON) with Markus Ferber (EPP) as rapporteur; on 1 October the Legislative Observatory showed a committee draft report dated 11 June 2026 and amendments tabled on 31 July 2026, and the stage “Awaiting committee decision”. We did not review the content of the Parliament’s texts.

After both institutions have positions come trilogue negotiations, a final text and publication. The proposal enters into force on the twentieth day after publication; its MiCA amendments apply 12 months after that, and ESMA takes up CASP supervision 24 months after entry into force (Article 143a, in square brackets in the Commission text).

A worked example shows the scale. If a regulation entered into force on 1 January 2028, ESMA would take over CASP supervision on 1 January 2030 under the Commission’s text. That is arithmetic on the proposal, not a forecast. The Council’s stated wish for short transitional arrangements could shorten it, and a significance test could mean that only some CASPs move at all.

By our reading, for a company that tokenizes in 2027, the supervisor of its CASP counterparties will almost certainly still be a national authority at the time it signs, so the useful step now is to write contracts and diligence that survive a change of supervisor.

Counterparty or Competitor

The ten crypto-asset services in MiCA Article 3(1)(16) are: custody and administration, operating a trading platform, exchange for funds, exchange for other crypto-assets, execution of orders, placing, reception and transmission of orders, advice, portfolio management and transfer services. A tokenization issuer meets this list from two sides.

Counterparties. The firms that, for your tokens, custody them (defined by safekeeping or controlling crypto-assets or the means of access to them, including private keys), operate the venue where they are admitted to trading, execute or route orders, or move tokens between addresses for clients. By our reading, a large exchange or custodian is the kind of firm a significance test is aimed at, so the venues and custodians for your tokens are the counterparties most likely to be affected first.

Competitors. A tokenization provider is not a CASP because it tokenizes. It may become one if it also performs one of the ten services for crypto-assets, for example placing: marketing crypto-assets to purchasers on behalf of the offeror. A provider that bundles issuance tooling, custody, placing and trading is the multi-function structure the ECB singles out. Whether a given bundle is inside the regime depends on the facts and on whether the tokens are financial instruments at all.

By public documents alone, you cannot tell which side a given firm is on. You can tell what it has been authorized to do, because the authorization must specify the crypto-asset services the CASP may provide (Article 59(6)). ESMA publishes an interim register of authorized CASPs as weekly CSV files; its page said the last update was 30 September 2026.

The Record View

“Is this counterparty regulated?” is a fact that changes, and a spreadsheet cell hides when it changed. In Stobox Intelligence, the same question is built as a record: who is regulated, under which regime, from which date, and what confirms it. A record reads: the entity, the claim (authorized as a CASP under MiCA Article 63, for these named services), the authority that granted it, the date, the source document (the register entry) and an evidence level that says how far it was checked against that source. When a supervisor changes, the old record stays and a dated record sits beside it. Nothing is averaged: a counterparty authorized for custody but not for trading reads as exactly that.

Design Note: Stobox Orbit

Stobox Orbit, a permissioned tokenization protocol, is in development and running on testnet. One design rule bears on this topic. Stobox is designed to hold no private keys of investors or issuers: an investor brings a wallet or gets one created through a third-party wallet API with the investor in control of the key, and an enterprise connects its own custodian. The Orbit API, which is at design stage, is designed to never sign: every write it offers returns an unsigned transaction, a typed payload for the party whose consent it carries, or a Safe proposal, and the holder of the role signs.

MiCA defines custody by who controls crypto-assets or the means of access, and transfer services by who moves them on behalf of clients. Orbit’s documents record where the keys sit. That is an architecture choice, and this note draws no conclusion about the status of any party under MiCA. Whether an arrangement is a crypto-asset service is a case-by-case question.

What to Do on Monday

1. Map your counterparties to the ten services. For each firm that touches your tokens, write down which of the ten services it performs and under which license: CASP authorization, or an Article 60 notification by a bank, investment firm or central securities depository.
2. Split your tokens by class first. Financial-instrument tokens meet MiFID, CSD and DLT Pilot counterparties. Everything else meets CASPs. The classification analysis from Article 1 decides which list a token goes on.
3. Write contracts that name the “competent authority”, not a country. Representations about authorization and notices of supervisory action should survive a change from a national authority to ESMA.
4. Record status as a dated fact. Copy the authorization, the authority, the services and the register date into your file, and re-check it on a schedule. The interim register updates weekly.
5. Do not read “significant” as a quality mark. It will be a size and cross-border test. A small authorized CASP and a significant one carry the same duty to be authorized for the services they provide.

Stobox Intelligence holds this kind of question as a dated record; Stobox Orbit Docs will follow when they are public.

FAQ

Does ESMA supervise crypto-asset service providers today? No. Under the current MiCA text, national competent authorities authorize and supervise CASPs. Article 85 defines a significant CASP as one with at least 15 million active users, but it only gives ESMA’s Board of Supervisors annual updates from the national authorities.

Would the Commission proposal move only large CASPs to ESMA? No. The proposal, COM(2025) 943 of 4 December 2025, transfers authorization, supervision and enforcement for all CASPs to ESMA and deletes Article 85. Banks are not moved, and other regulated firms move only when crypto-asset services exceed 50% of turnover for two consecutive years.

What do Member States want instead? The Council Presidency’s reports of June 2026 record that a majority of Member States want direct ESMA supervision limited to significant CASPs, with national authorities keeping the rest. The significance criteria are not agreed.

When would ESMA take over? Nothing is law yet. In the Commission’s text, the MiCA amendments apply 12 months after entry into force and ESMA takes over supervision 24 months after entry into force. Entry into force follows adoption and publication, so the earliest realistic handover is several years away.

Related reading in this series

• MiCA or MiFID: how to tell which regime your token falls under
• The EU’s DLT Pilot cap: EUR 6 billion today, EUR 100 billion proposed
• Pontes: central bank money for tokenised securities
• Background: the EU tokenization guide and the glossary. Next in the series: commodity RWAs and asset-referenced tokens.

Sources

Accessed 1 October 2026.

• Regulation (EU) 2023/1114 (MiCA), OJ L 150, 9.6.2023, Articles 2(4), 3(1)(16) to (26), 59, 60, 62, 63, 85, 93, 109, 143: EU Publications Office
• European Commission, proposal COM(2025) 943 final, 4 December 2025, 2025/0383(COD), explanatory memorandum, recitals 91 to 99, Article 9 (amendments to MiCA, new Articles 138a to 138j, 143a) and Article 15: EU Publications Office
• European Commission, Questions and answers on the market integration package, 4 December 2025, questions 43 to 46: European Commission
• ECB, Opinion CON/2026/13 of 9 April 2026, OJ C/2026/2837, 28.5.2026, section 7: EUR-Lex
• ESCB, response to the Commission’s targeted consultation on MiCAR, September 2026: ECB
• Council of the EU, document 9891/26, Presidency steering note, 8 June 2026: Council
• Council of the EU, document 10735/26, Presidency progress report on the Market Integration and Supervision Package, 24 June 2026: Council
• Council of the EU, document 11406/26, Presidency steering note, 3 July 2026: Council
• Council of the EU, Economic and Financial Affairs Council, 9 October 2026: Council
• European Parliament Legislative Observatory, procedure 2025/0383(COD): European Parliament
• ESMA, “ESMA welcomes Commission’s ambitious proposal on market integration”, 4 December 2025: ESMA
• ESMA, Markets in Crypto-Assets Regulation (MiCA) page and interim MiCA register: ESMA

This article is general information, not legal advice. It does not assess any specific company, token or service. The proposal and the Council’s positions may change before anything is adopted. Check the current text before relying on this article.