ESMA will supervise only 10 to 15 of 360 crypto firms: your exchange stays with its home regulator

Anyone in Germany buying crypto assets through an exchange with an EU licence remains in BaFin's hands in Bonn and Frankfurt, even after the agreement of October 9, 2026. EU finance ministers have agreed to place only the largest crypto service providers under the direct supervision of the European Securities and Markets Authority, ESMA. On estimates from the Council, that covers 10 to 15 of roughly 360 authorised firms. All the others keep the supervisor that granted their licence.

The agreement is a negotiating position, not law in force. For the exchange you trade on today, nothing changes for now. The position becomes interesting where it reveals something about the next two years: who will handle complaints, who will examine custody and own funds, and which authority an enquiry actually gets results from.

What the EU Council decided on October 9

The EU Council has settled the core elements of its negotiating position on the Market Integration and Supervision Package, or MISP. The MISP is a legislative package through which the EU wants to concentrate supervision of financial markets more firmly at European level; it is the centrepiece of the savings and investments union. The crypto part is just one chapter among several.

The European Commission's proposal from December 2025 went considerably further. It would have moved supervision of all crypto-asset service providers from national authorities to ESMA. Little of that survives in the Council text. According to the Council's statement, only the most significant providers are to fall under European supervision, and the group is to be delimited by thresholds.

The same package moves supervision of significant central counterparties and central securities depositories to EU level, as well as of the most significant cross-border trading venues. Germany secured an exemption for parts of Deutsche Börse in the process, as the trade publication Ledger Insights reports. ESMA itself gains a full-time executive board with a chair and five independent members.

15 million users or several significance criteria: the thresholds for direct supervision

So far, the EU's Markets in Crypto-Assets Regulation, MiCA, knows only one hard line: a provider counts as significant from 15 million active users in the EU. At most a handful of platforms reach that number. The Council has therefore added alternative criteria that bite further down.

Accounts of the detail differ, and that has to be said. CryptoSlate describes the mechanics as ESMA supervising providers directly from 15 million active EU users, or those meeting three of five significance criteria; the ones named are more than one million active users, over one billion euros of crypto assets in custody and more than four billion euros of customer transactions a year. Ledger Insights sets out the same construction, noting that a provider with a good one million users could be caught if at least two further tests are added. The Council text itself has not yet been published in final form, so the exact thresholds are not yet settled.

What the thresholds mean in practice

Assets in custody and annual volume hit large trading venues, but hardly a custodian with German clients or a broker that carries crypto assets only as a sideline. That was precisely the point of contention: the Commission wanted supervision for everyone, while the Council draws a line behind which national competence remains. An existing MiCA licence stays valid, incidentally, even if a provider moves into direct supervision. Nobody faces a second authorisation procedure.

10 to 15 of roughly 360 providers: whom ESMA will supervise itself

The order of magnitude comes from the Council and was reported by Reuters: 10 to 15 providers out of around 360. That is a good three to four percent. Public analyses of the ESMA register arrive at somewhat lower totals; the site casptracker.eu counted more than 330 authorised providers across Europe as of September 7, 2026, and put Germany at the top with 81 authorisations, ahead of France with 35 and the Netherlands with 29. Another overview cites around 100 German providers as of the register on October 6, 2026, and describes itself as a lower bound. What is solid here is the ranking, not the second digit: Germany is the largest authorisation location under MiCA.

That produces a quirk often lost in the debate. The more licences an authority grants, the more work stays with it when direct supervision skims off only the top. BaFin therefore remains Europe's most important crypto supervisor, measured by the number of firms it oversees. How laborious such a procedure is shows in the German legal framework: the Crypto Markets Supervision Act implements MiCA nationally and sets out what BaFin bases its licences and warnings on.

For most crypto providers in Germany, BaFin stays in charge

For customers, competence is no formality. It determines where a complaint goes, which language the procedure runs in and which authority steps in when withdrawals stall. With a provider holding a German licence, that is BaFin. With a provider licensed in Malta, Ireland or Lithuania it is the authority there, even if the company has almost only German customers.

What supervision delivers and what it does not

A MiCA licence is a permission to operate under supervisory conditions. What gets examined is organisation, own funds, custody and complaints handling. Deposit insurance is not part of it, and the licence does not help against price losses either: with crypto assets there is nothing equivalent to the statutory deposit guarantee of €100,000 per customer and bank. If you do not want to carry counterparty risk, you take custody yourself. Which devices are suitable and where their limits lie is in our hardware wallet comparison.

The reverse also holds: without an EU licence, a provider may not actively approach German customers at all. How supervisors handle platforms that invoke the customer's own initiative shows in the debate around so-called reverse solicitation, the claim that the customer sought out the provider unprompted.

Passporting and the peer review of Maltese supervision

Behind the whole debate sits a design feature of MiCA called passporting: a firm authorised in one member state may offer services in all 27 and remains largely supervised by its home state's authority. That saves procedures and creates a gradient. Responsibility for a provider winning millions of customers across Europe stays with the authority that issued its licence once.

How robust that is was doubted early on. CryptoSlate points to an ESMA peer review from July 2025 on an authorisation by the Maltese financial supervisor MFSA. The finding there: no sufficient evidence was found that the authorisation review had adequately addressed questions of corporate governance, conflicts of interest, technology, custody and parts of money laundering risk. The MFSA countered in September 2025 that MiCA was too new to justify an additional layer of regulation.

The Council text does not resolve that gradient; it softens it. For providers below the thresholds, ESMA is to work with guidelines, peer reviews, coordinated investigations and certain powers of intervention in order to even out unequal enforcement. That is less than supervision of its own and more than today's state of affairs.

Two years of transition: how competence is meant to change hands

The Council provides for a transition period of two years. During that time, teams led by ESMA and staffed with European and national experts are to transfer information, procedures and expertise. No cut-off date from which ESMA actually supervises appears in the text; that depends on the outcome of the negotiations.

For investors, that means the practical effect arrives at the end of this decade at the earliest. Anyone waiting for stricter European supervision as an argument for a platform will be waiting a long time. The authorisation itself, by contrast, applies today. That is a feature you can look up straight away, and it stands in the register, not in the advertising. What a MiCA licence demands of a provider is something we have set out in our overview of MiCA obligations.

The Commission regrets the compromise

The responsible commissioner's reaction was unusually blunt. Maria Luís Albuquerque told ministers, according to Ledger Insights, that under the compromise "only some providers would be supervised by ESMA", and that the Commission "deeply regrets the proposed compromise". The commissioner's criticism referred to several parts of the package, of which crypto was one.

A commissioner publicly criticising a Council agreement says something about what comes next. The Commission will try in the trilogue to win back parts of its proposal, and on questions of European competence it often has the Parliament as an ally.

Checking the ESMA register: where your exchange's supervisor is listed

A provider's supervisory authority is a matter of public record, regardless of what its website says. Three places carry the information: ESMA's MiCAR register with the providers authorised under Article 63, BaFin's company database for German licences, and the Bundesanzeiger. The registers are updated at intervals, so a fresh authorisation appears with a few days' delay.

The difference between two statements matters. "Licensed in the EU" names the country that granted the licence and whose authority is competent. "Available in Germany" says only that the platform can be used here. As things stand, the first statement remains the decisive one for the large majority of providers even after the MISP.

It is worth a look in particular at providers that received their licence during 2026. The MiCAR transition period in Germany ended on July 1, 2026, and grandfathering does not constitute an authorisation. That BaFin also rejects applications it showed in October 2026, when it refused the operator of bitcoin.de a MiCAR licence.

What MiCA 2, the EU summit and Parliament can still shift

Three procedures are running at the same time, and they are readily confused. The MISP governs who supervises. The review of MiCA itself, informally called MiCA 2, governs what applies; its consultation closed in August 2026. And the agreement of October 9 is only the Council's position, which still has to be formally adopted.

Negotiations begin only once the European Parliament has adopted a position of its own. Until then, a great deal can still change in the shape of the package, in the thresholds as much as in the question of which trading venues are covered. According to reports, heads of state and government could take up the compromise again at their meeting on October 15 and 16, 2026.

For context, that means the direction is set, the numbers are not. Anyone concluding from the news that their exchange will now be supervised at European level is jumping ahead. The opposite is more likely, namely that national supervision stays in place permanently for the large majority of providers.

ESMA supervision: first Parliament, then two years of transition

1. Establish your exchange's licensing country. Look up in ESMA's MiCAR register or BaFin's company database which authority granted the licence. Which firms can demonstrate an EU authorisation is shown in the overview of regulated crypto exchanges.
2. Cap counterparty risk. A licence is no substitute for deposit insurance. Decide which share of your holdings has to sit on the trading platform and which belongs in your own custody; the devices for that are in the hardware wallet comparison.
3. Weigh costs against authorisation. An EU licence costs the provider money, and that shows up in the fees. Compare trading and withdrawal costs before moving over supervision, for instance in the exchange comparison.

The Council's negotiating position is set out in its statement of October 9, 2026 (Council of the EU).

(As of October 13, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)