Malta’s cryptocurrency licensing process has come under scrutiny from the European Securities and Markets Authority (ESMA), Europe’s primary supervisory body overseeing the Markets in Crypto-Assets Regulation (MiCA).
The ESMA on Thursday released a review on the authorization process of crypto asset service providers (CASPs) by Malta’s Financial Services Authority (MFSA), highlighting several shortfalls and proposing a set of recommendations.
Despite saying the MFSA met certain expectations in supervisory setup and staffing, the EU watchdog said the Maltese authorities only “partially met expectations” in the authorization process for an unnamed CASP.
Following the review, the ESMA’s ad hoc Peer Review Committee (PRC) recommended that MFSA “assess material issues that either were still pending at the date of the authorization or that have not been adequately considered at the authorization stage.”
Malta review launched in April
The report comes over a year after the MiCA framework came into force on June 29, 2024, becoming a major milestone in the EU’s approach to regulating digital assets.
Since MiCA is aimed at providing a unified and consistent legal framework for crypto in the EU, the regulator highlighted that MiCA’s authorization approach applies to all National Competent Authorities (NCAs).
In December 2024, the European Banking Authority’s Board of Supervisors (BoS), the agency’s main decision-making body, agreed on the adoption of a coordinated approach for CASPs authorizations.
“Following a series of events, the BoS of ESMA decided, in April 2025, to launch a peer review on the authorization and early supervision of a CASP by the Malta Financial Services Authority,” the report noted, adding:
“Although the peer review targeted one NCA, still, it aims to foster supervisory convergence and improve the supervisory practices of all NCAs, at a time when consistency across NCAs in authorization and setting supervisory expectations is key.”
MFSA’s authorization falls short of expectations
The ESMA’s PRC, the committee that conducted the peer review process into MFSA, reported that MFSA has built a “good level of expertise in this sector and has sufficient supervisory resources for CASP authorizations and supervision.”
PRC’s review concerned three main areas: the supervisory settings and resources, the authorization process and the supervisory review and use of adequate powers.
While fully meeting the supervisory settings requirements and largely meeting the supervisory review rules, the report said the MFSA has only “partially met expectations” relevant to the “authorization of the specific CASP.”
Malta’s MFSA “needs to monitor closely the growth in authorization applications” and identify and need to adjust supervisory practices in a timely manner, the PRC stated.
Related: Bybit, OKX expand crypto services in Europe under MiCA
It reiterated that all the EU state NCAs have to consider this issue and strictly follow the standards:
“Due to the novelty and nature of these type of entities as well as the inherent risks of their business model, the PRC recommends to all NCAs, currently in the process of authorising CASPs, to pay particular attention to certain aspects of the authorization.”
Four MiCA CASPs licensed by MFSA
Since the ESMA did not disclose the name of the CASP in question of the MFSA’s authorization misstep, it’s unclear whether the PRC’s recommendation to assess the issue would impact any of the issued licenses.
“It is hard to comment without knowing exactly what the unresolved issues were,” XReg Consulting partner Nathan Catania told Cointelegraph.
“I wouldn’t expect any revocation or re-evaluation based on the report,” he stated.
According to the MFSA register of licensed CASPs operating under MiCA, there are currently four registered companies: BP23, trading as Bitpanda; Foris Dax, trading as Crypto.com; Okcoin Europe, trading as OKX; and Zillion Bits, trading as ZBX.
In April, Malta’s Financial Intelligence Analysis Unit fined Okcoin Europe $1.2 million after detecting certain violations dating back to 2023. The penalty came soon after the MFSA granted a MiCA license to OKX in January 2025.
Cointelegraph approached the ESMA and the MFSA for comment regarding the review’s potential impact on the MiCA-licensed companies in Malta, but did not receive a response by publication.
Magazine: Bitcoin vs stablecoins showdown looms as GENIUS Act nears