Malta’s cryptocurrency licensing process has come under scrutiny from the European Securities and Markets Authority (ESMA), Europe’s primary supervisory body overseeing the Markets in Crypto-Assets Regulation (MiCA).
The ESMA on Thursday released a review of the authorization process of crypto asset service providers (CASPs) by Malta’s Financial Services Authority (MFSA), highlighting several shortfalls and proposing a set of recommendations.
Despite saying the MFSA met certain expectations in supervisory setup and staffing, the EU watchdog said the Maltese authorities only “partially met expectations” in the authorization process for an unidentified CASP.
Following the review, the ESMA’s ad hoc Peer Review Committee (PRC) recommended that MFSA “assess material issues that were pending at the date of the authorization or that have not been adequately considered at the authorization stage.”
Malta review launched in April
The report comes over a year after the MiCA framework came into force on June 29, 2024, becoming a major milestone in the EU’s approach to regulating digital assets.
Since MiCA is aimed at providing a unified and consistent legal framework for crypto in the EU, the regulator highlighted that MiCA’s authorization approach applies to all National Competent Authorities (NCAs).
In December 2024, the European Banking Authority’s Board of Supervisors (BoS), the agency’s main decision-making body, agreed on the adoption of a coordinated approach for CASPs authorizations.
“Following a series of events, the BoS of ESMA decided, in April 2025, to launch a peer review on the authorization and early supervision of a CASP by the Malta Financial Services Authority,” the report noted, adding:
“Although the peer review targeted one NCA, still, it aims to foster supervisory convergence and improve the supervisory practices of all NCAs, at a time when consistency across NCAs in authorization and setting supervisory expectations is key.”
MFSA’s authorization fell short of expectations
The ESMA’s PRC, the committee that conducted the peer review process into MFSA, reported that MFSA has built a “good level of expertise in this sector and has sufficient supervisory resources for CASP authorizations and supervision.”
PRC’s review concerned three main areas: the supervisory settings and resources, the authorization process and the supervisory review and use of adequate powers.
While fully meeting the supervisory settings requirements and largely meeting the supervisory review rules, the report said the MFSA has only “partially met expectations” relevant to the “authorization of the specific CASP.”
Malta’s MFSA “needs to monitor closely the growth in authorization applications” and identify and adjust supervisory practices in a timely manner, the PRC said.
It reiterated that all the EU state NCAs have to consider this issue and strictly follow the standards:
“Due to the novelty and nature of these type of entities as well as the inherent risks of their business model, the PRC recommends to all NCAs, currently in the process of authorising CASPs, to pay particular attention to certain aspects of the authorization.”
Any impact on the licenses?
Since the ESMA did not disclose the name of the CASP in question of the MFSA’s authorization misstep, it’s unclear whether the PRC’s recommendation to assess the issue would impact any issued licenses.
“It is hard to comment without knowing exactly what the unresolved issues were,” XReg consulting partner Nathan Catania told Cointelegraph.
“I wouldn’t expect any revocation or re-evaluation based on the report,” he said.
Related: Bybit, OKX expand crypto services in Europe under MiCA
Juan Ignacio Ibañez, general secretary of the MiCA Crypto Alliance, voiced a similar view, stating that the ESMA review is “largely positive.”
“I do not see a material risk to existing licences,” Ibañez told Cointelegraph, adding that ESMA does not hold legal power over the national regulators.
He also suggested that the issue is likely related to a difference of opinion in degree between ESMA and MFSA. “MFSA seems to think that some issues can be managed via ongoing monitoring, whereas ESMA thinks MFSA should leverage the threat of licence rejection to get the issues resolved before authorisation,” Ibañez said.
Four MiCA CASPs licensed by MFSA
According to the MFSA register of licensed CASPs operating under MiCA, there are currently four registered companies.
Those include BP23, trading as Bitpanda; Foris Dax, trading as Crypto.com; Okcoin Europe, trading as OKX; and Zillion Bits, trading as ZBX.
In April, Malta’s Financial Intelligence Analysis Unit fined Okcoin Europe $1.2 million after detecting certain violations dating back to 2023. The penalty came soon after the MFSA granted a MiCA license to OKX in January 2025.
Cointelegraph approached ESMA and MFSA for comment regarding the review’s potential impact on the MiCA-licensed companies in Malta, but had not received a response by publication.
Magazine: Bitcoin vs stablecoins showdown looms as GENIUS Act nears
