The European Securities and Markets Authority (ESMA) put Malta’s Financial Services Authority (MFSA) under the spotlight for its authorization process for crypto asset service providers (CASPs) under the EU Markets in Crypto-Assets Regulation (MiCA). Malta’s regulator only “partially met expectations” in the authorization of a specific CASP, ESMA’s peer review report, published Thursday, said. The review verified shortcomings and requested stricter scrutiny in future authorizations. MiCA Review Seeks Consistency in Authorization The ESMA report is a product of an April 2025 decision by the ESMA Board of Supervisors to undertake MFSA procedures within MiCA. Although intended for Malta, the review aims at promoting supervisory convergence for all EU NCAs. PRC held that Malta possessed a sound supervisory system and competent staff. However, it reported MFSA did not give sufficient regard to all material matters at the authorization of a CASP. The committee recommended that outstanding issues in the authorization process be reviewed with urgency. Scope of Deficiencies and Sector-Wide Warnings The peer review involved three areas: supervisory environments, authorization process, and supervisory review authorities. MFSA was up to the mark in staff and primarily in supervisory review—but not in the actual process of authorization. The report emphasized that all EU regulators should apply uniform and tight standards while licensing CASPs due to the unique nature of risks involved in digital asset firms. Four MiCA Licenses Issued by Malta Currently, four have been licensed by MiCA from the MFSA: Bitpanda (BP23) Crypto.com (Foris Dax) OKX (Okcoin Europe) ZBX (Zillion Bits) Whether any of them were involved in the ESMA criticism is not currently known. Okcoin Europe was penalized $1.2 million in April by Malta’s Financial Intelligence Analysis Unit for pre-approval violations of its MiCA license. While concerns are evident, regulatory experts believe the review will not lead to the cancellation of licenses. Nathan Catania of XReg Consulting clarified that without data on the areas still under contention, it is hard to quantify the entire implication. What’s Next for Malta and EU Crypto Oversight? The ESMA reports are concurrent with MiCA as a pillar of the EU’s regime for crypto, which has been in effect since June 2024. While others and Malta ramp up CASP licenses, the ESMA urges more caution to avoid regulatory gaps. ESMA and MFSA were approached for comment on how the reports might affect Malta’s current MiCA-approved entities. No comments were received at publication.
