ESMA flags Malta's crypto licensing gaps in first MiCA peer review

The European Securities and Markets Authority (ESMA) has questioned Malta’s handling of one crypto asset service provider’s (CASP) authorization, citing several supervisory gaps. The findings were part of a peer review on the Maltese Financial Services Authority’s (MFSA) licensing practices under the Markets in Crypto-Assets Regulation (MiCA).

The review, released early Thursday, scrutinized the authorization of a single, unidentified CASP by the MFSA. According to ESMA, Malta’s process only “partially met expectations,” listing some deficiencies noted in the handling and timing of the license approval.

Shortcomings in the authorization process of a CASP

ESMA’s ad hoc Peer Review Committee (PRC), which carried out the evaluation, found that the MFSA granted a green light to the CASP while several “material issues” were yet to be resolved. 

These included outstanding remediation from previous enforcement cases and pending supervisory matters that, in the committee’s view, should have been addressed before the license was issued.

The report mentioned that the MFSA did not effectively apply the licensing process to compel the CASP to address its regulatory inefficiencies. It added that aspects of the applicant’s business plan, like its expansion model and new client listings, were not adequately inspected.

“The PRC did not find evidence that certain key aspects of the authorisation file were adequately assessed, including conflicts of interest, governance structures, and technology-related risks tied to custody, ICT infrastructure, Web3 integrations, and Anti-Money Laundering/Counter Financing of Terrorism (AML/CFT) protocols,” the review read.

Still, the committee asserted that while it is nearly impossible to issue a completely risk-free authorization, these material issues were beyond what could reasonably be addressed during post-authorization supervision. 

“The MFSA’s supervisory response appears largely appropriate and proportionate. However, the PRC considers that some of the measures could have already been considered as part of the authorisation process,” ESMA explained.

Peer review launched to assess coordinated oversight

In December 2024, ESMA’s Board of Supervisors agreed upon a coordinated approach to oversee CASP authorizations under MiCA. One of the parameters included a supervisory briefing and group-level discussions on license applications through the Digital Finance Standing Committee (DFSC).

Malta’s authorization of the unnamed CASP became a case study in the review process. The PRC’s evaluation was conducted under ESMA’s Peer Review Methodology and officially launched in April 2025. The goal was to assess licensing and the early-stage supervision of the authorized firm.

Even after flagging several issues, the PRC did commend the MFSA for its crypto regulation domain and its resource allocation toward CASP oversight. 

Still, it asked Malta’s watchdogs to be vigilant and adaptive in supervisory practices in pace with the increasing number of applicants and licensees.

One of the recommendations from the review is that MFSA use a more “stringent” application process during the pre-authorization phase. The PRC requested the regulatory body to question any material gaps before a license is issued, rather than pushing it forward to post-licensing supervision. 

Moreover, supervisory measures that MFSA enacted after licensing were, according to ESMA, appropriate, but could have been incorporated earlier in the process.

MFSA tightens transparency rules for crypto firms

In May, MFSA issued a directive requiring firms operating in the European Union or European Economic Area to provide region-specific information through dedicated websites.

Sarah Pulis, Head of Conduct Supervision at the MFSA, stated that all CASPs must give regulators “clear, accessible information about their products and services” and ensure any non-available offerings in specific jurisdictions are properly disclosed, per MiCA rules.

The MFSA is reviewing CASP websites in compliance with MiCA’s rules on fairness, transparency, and accuracy. Christopher Buttigieg, MFSA’s Chief Officer Supervision, propounded that proactive reviews help hold firms accountable for how they communicate with clients. 

“We are ensuring that their communications are transparent, fair, and aligned with consumer expectations, even in their first few months of operation under MiCAR,” he remarked.

KEY Difference Wire: the secret tool crypto projects use to get guaranteed media coverage