ESMA’s 2027 Work Programme: the MiCA supervisory agenda for CASPs

On 28 September 2026, the European Securities and Markets Authority (ESMA) published its Annual Work Programme for 2027 (ESMA22-50751485-1673). The programme covers ESMA’s full remit. Section 2.3.13 sets out its work for the year on crypto-assets under the Markets in Crypto-Assets Regulation (MiCA) and on distributed ledger technology.

What the programme says

Supervisory convergence. ESMA states that its “supervisory convergence efforts will focus on areas such as”:

• the digital operational resilience of crypto-asset service providers (CASPs);

• “the maintenance of sufficient corporate substance in the EU and outsourcing risks”;

• “liquidity in the EU crypto-asset market”;

• reverse solicitation; and

• the classification of assets.

ESMA will continue to support information sharing among national competent authorities (NCAs), including on specific CASPs, and to use level 3 tools such as guidelines to promote convergence.

Cooperation with other authorities. ESMA will continue to cooperate with the Anti-Money Laundering Authority (AMLA) on CASPs’ compliance with anti-money laundering and know-your-customer obligations, and with the European Banking Authority (EBA) and the European Insurance and Occupational Pensions Authority (EIOPA) on opinions concerning crypto-asset classification.

Reporting and follow-up. ESMA “intends to promote harmonisation in the periodic reporting of CASPs to their NCAs”. It will also monitor implementation of the recommendations from its 2025 fast-track peer review of CASP authorisation and supervision.

Custody. ESMA will publish a final report on the Common Supervisory Action (CSA), launched in June 2026, on the digital operational resilience of custody services provided by CASPs.

Market surveillance. The first phase of MIDAS, ESMA’s centralised system for surveillance of crypto-asset markets, is to be fully operational by 2027. Roll-out of a second phase is subject to approval by ESMA’s Board.

Trading platforms. Under Article 143(2)(b) of MiCA, operators of trading platforms must ensure by 31 December 2027 that a crypto-asset white paper is drawn up, notified, published and kept updated for crypto-assets, other than asset-referenced and e-money tokens, that were admitted to trading before 30 December 2024. The programme states that ESMA “is thus also expected to conduct preparatory supervisory convergence work on this topic in 2027”.

The MiCA review. Article 140 of MiCA requires the Commission to report on the application of the Regulation by 30 June 2027, “accompanied, where appropriate, by a legislative proposal”. ESMA says that, in the context of any consultation on the report, it will share views and experience on MiCA’s implementation and “start preparatory work for any legislative proposal that may accompany the EC report”.

Tokenisation. ESMA will continue to monitor the DLT Pilot Regime and the consistent classification of assets issued, traded and settled using DLT. It will assess supervisory and regulatory challenges linked to tokenisation, including interoperability, settlement, custody and legal certainty, and will feed this work into the forthcoming review of the DLT Pilot Regulation.

Elsewhere in the programme. ESMA lists guidance on crypto-asset reporting under MiCA among its simplification work, and says it may provide further guidance to NCAs on preventing and detecting market abuse in crypto-asset trading.

The programme’s output table gives a Q4 2027 due date for four crypto-asset outputs: the CSA final report, the annual report on market developments under Article 141 of MiCA, the annual report on DLT Pilot exemptions, and the roll-out of MIDAS phase 2, subject to Board approval.

What it does not do

A work programme sets out ESMA’s priorities. It does not amend MiCA, create new obligations for firms or change the powers of NCAs. Guidelines and other convergence tools it produces may shape how NCAs apply existing requirements.

The programme does not mention stablecoins, e-money tokens or asset-referenced tokens. In our view, this reflects the allocation of supervision under MiCA. Under Article 117, the EBA supervises issuers of significant asset-referenced tokens and, as regards compliance with Articles 55 and 58 only, electronic money institutions issuing significant e-money tokens, in close cooperation with the other competent authorities. NCAs supervise all other issuers, including credit institutions issuing e-money tokens, and any crypto-asset services those issuers provide.

Our reading for CASPs

Substance and outsourcing. Article 59(2) of MiCA requires a CASP authorised under Article 63 to have its “place of effective management in the Union” and at least one director resident in the Union. Article 73 requires a CASP that outsources operational functions to “remain fully responsible” for its obligations.

ESMA’s fast-track peer review of 10 July 2025 assessed the Malta Financial Services Authority’s authorisation and early supervision of one CASP. It observed that “the most prevailing business model is a single entity hub in Europe providing crypto services, through a passport, to the entire EU single market, while the main client base is not necessarily in the home NCA”. It recommended that all NCAs authorising CASPs pay particular attention to “governance and intragroup arrangements” and to “ICT architecture including intragroup reliance and use of sub-providers”.

In our view, convergence work on substance and outsourcing is likely to test how much of an EU CASP’s operation can be provided by a group outside the EU can provide, and to narrow differences in how NCAs assess this. Firms whose EU entity relies on intragroup services may wish to review those arrangements against Articles 59 and 73 now.

Reverse solicitation. Article 61 disapplies the authorisation requirement only where an EU client initiates a service “at its own exclusive initiative”. In our view, its inclusion as a convergence area indicates continued scrutiny of third-country firms serving EU clients without authorisation. Firms relying on the exemption may wish to review the evidence held for each client relationship.

Custody. The CSA final report is the only specific output in section 2.3.13 dedicated to a single CASP service. In our view, CASPs providing custody should expect its findings to inform supervisory expectations on operational resilience for that service.

Timing. The programme does not change any firm’s obligations. Articles 59 and 73 already apply, and ESMA’s convergence work on CASP supervision is continuing. In our view, firms should expect NCAs to apply any resulting expectations as they emerge, rather than from a fixed date.

Dates

• 28 September 2026: ESMA 2027 Work Programme published.

• 30 June 2027: deadline for the Commission’s report on the application of MiCA (Article 140).

• Q4 2027: CSA final report on CASP custody resilience; ESMA annual report under Article 141; annual report on DLT Pilot exemptions; MIDAS phase 2 roll-out, subject to Board approval.

• 31 December 2027: deadline for trading platform operators to ensure white papers for crypto-assets admitted to trading before 30 December 2024 (Article 143(2)(b)).

Sources: ESMA press release, 28 September 2026; ESMA 2027 Annual Work Programme; ESMA fast-track peer review, 10 July 2025; Regulation (EU) 2023/1114 (MiCA).

Prepared by James Ross, Head of Advisory, denouement. This note is not legal advice.