For years a certain sales line travelled well inside the European Union: pick a convenient national authorisation, then sell crypto services across the bloc. The Markets in Crypto-Assets (MiCA) rulebook already tightens who may call themselves a crypto-asset service provider (CASP). The next political fight is who supervises the large cross-border names.
In December 2025 the European Commission proposed moving direct supervision of crypto-asset service providers toward the European Securities and Markets Authority (ESMA) as part of its Savings and Investments Union market-integration package. ESMA publicly welcomed the direction. By October 2026 EU ministers had narrowed the Council’s negotiating line: only the most significant cross-border CASPs would sit under ESMA immediately, rather than every authorised firm — with the rest still watched nationally under tighter convergence.
That is law-making in motion, not a finished consumer shield. It still matters for scam literacy. A footer that says “EU regulated” without a name you can find on an official register remains decoration. Passporting and soft landing spots get harder to brag about when the largest players face a single EU-level desk. Small clone sites and Telegram desks will keep ignoring the whole apparatus; they never intended to apply for MiCA in the first place.
So use the reform as a checklist, not a lullaby. Look the legal name up on the national register or ESMA’s public materials, ignore screenshots of “licences”, and treat any cold offer that needs a deposit before verification as unsupervised — whatever map is drawn in Brussels.
If this pattern matches something you’ve been offered, start at Get help.
This article is for general information only. It is not legal or financial advice. Details change. If you have lost money, contact your bank or card issuer and use the routes on the help pages.