ESMA sets 2027 MiCA oversight priorities

TLDR

ESMA has set detailed crypto supervision priorities for 2027 under MiCA, moving from rulemaking to hands-on oversight of how firms operate and report across the European Union.

1. ESMA will concentrate 2027 supervision on operational resilience, outsourcing, liquidity, reverse solicitation, asset classification and ensuring CASPs keep substantial operations inside the EU.
2. Crypto firms serving EU customers will face tighter, harmonized reporting and surveillance via the MIDAS system, with higher scrutiny of unauthorized or lightly regulated business models.
3. Key milestones are MIDAS phase one going live, ESMA's input into the European Commission's MiCA review by June 2027 and any follow-on legislative changes that reshape MiCA.

Deep Dive

1. Supervisory Focus Areas

ESMA's 2027 work program under MiCA centers on how crypto asset service providers (CASPs) actually run their businesses, not just what is written in the rules. The priorities include operational resilience, outsourcing risk, liquidity management, reverse solicitation practices and how different crypto assets are classified across the bloc, as highlighted in ESMA's 2027 work program summary.

Chair Verena Ross has described the shift as moving "from rulemaking towards supervision and convergence", meaning ESMA will coordinate national regulators to apply MiCA consistently, and ensure CASPs maintain sufficient real operations inside the EU rather than serving the market from offshore entities.

ESMA also plans to standardize periodic reports from CASPs and promote common risk indicators and supervisory dashboards, which should reduce arbitrage between stricter and looser EU jurisdictions.

2. Effects On Crypto Firms And Markets

For EU based and foreign firms serving EU customers, MiCA moves deeper into an authorization plus ongoing supervision regime. After the MiCA transition period, only a minority of firms obtained authorization, with unauthorized firms showing higher risk scores and sending more volume to sanctioned counterparties, according to recent supervisory data.

Authorized CASPs gain passporting rights across member states but will be examined more closely on private key management, transaction controls, outsourcing to third party tech providers and incident response. Reverse solicitation, a route used by some large exchanges to serve EU users without full authorization, is flagged as a specific supervisory focus, increasing pressure to regularize those models.

3. Key Timelines And Tools To Watch

ESMA aims to have phase one of MIDAS, its centralized crypto market surveillance system, fully operational in 2027, using it to monitor potential market abuse under MiCA and feed standardized data from national supervisors into an EU level view, as outlined in the MIDAS rollout plan.

A second MIDAS phase, planned for the fourth quarter of 2027 subject to board approval, would add analytical tools and broaden data coverage. ESMA also intends to deploy more AI and data platform capabilities for supervision.

The most strategic date is the European Commission's MiCA review, expected by June 2027, where ESMA's supervisory findings will shape whether MiCA is tightened, extended or adjusted, possibly leading to new legislation. Firms and investors should watch that review for changes in scope, such as stablecoin rules, DeFi treatment or stricter outsourcing limits.

Conclusion

ESMA's 2027 MiCA priorities mark a transition from designing crypto rules to enforcing how firms operate, report and manage risk across the EU. Stronger coordination, shared risk indicators and the MIDAS surveillance system are likely to raise standards for authorized CASPs while shrinking room for lightly regulated or reverse solicitation based approaches. For anyone interacting with the EU crypto market, the MiCA review and MIDAS deployment will be the key signals of how demanding the next phase of European oversight becomes.