The European Securities and Markets Authority (ESMA) stated that as the EU further advances the enforcement of the Crypto Assets Market Regulation Act (CAMR), its focus on crypto regulation in 2027 will be on operational resilience, outsourcing, sufficient local EU business operations, and several other areas.

ESMA stated in its 2027 work plan released on Monday that the focus of work surrounding MiCA will be on coordinating regulatory agencies from various countries and promoting more consistent regulation of crypto asset service providers within the European Union. As this regulatory agency shifts from formulating and implementing MiCA rules to overseeing how licensed companies comply with these rules in practice, this plan has also been introduced accordingly.

ESMA President Verena Ross described this change at a meeting of the Economic and Monetary Affairs Committee of the European Parliament, stating that the work surrounding MiCA has 'shifted from rule-making to supervision and convergence'.

Ross said, "We hope that innovation can thrive within a framework that provides clarity for businesses, safeguards for investors, and enhances market confidence."

ESMA will focus the regulatory emphasis of MiCA on operational risks

As ESMA collaborates with the national regulatory authorities responsible for overseeing crypto asset service providers ( CASP ), operational resilience will become one of the key areas of review.

Outsourcing risks, liquidity, reverse recruitment, and the classification of crypto assets are other areas that will be included in the scope of coordination work in 2027. Regulators will also pay attention to whether companies maintain sufficient operations within the EU, rather than relying excessively on functions or infrastructure outside of the EU.

MiCA has specific requirements for the outsourcing of CASP. Even if operational functions are entrusted to a third party, the enterprise is still responsible for its own regulatory obligations; at the same time, the outsourcing arrangements must not prevent national regulatory agencies from fulfilling their supervisory duties.

The priorities for 2027 are built upon the work that has already been undertaken. As previously reported in July by crypto.news, ESMA has begun reviewing MiCA custodian institutions to test how authorized providers manage operational risks.

This joint regulatory action covers areas such as private key and storage management, transaction control, incident response, and reliance on third-party technology providers. The focus of the review has expanded from whether companies are authorized to the control measures they employ after obtaining their licenses.

Cybersecurity and operational resilience will still be regulatory priorities within the EU in 2027, in addition to new priorities for digital innovation. ESMA stated on September 23 that this new focus will initially be on how regulated entities use artificial intelligence and tokenization, while the resilience priorities have existed since 2025.

MiCA Reporting and market monitoring will become the focus of the next step under ESMA.

ESMA plans to promote a more consistent approach to the information that CASP regularly submits to national regulatory authorities.

The regulatory agency intends to promote common risk indicators and regulatory dashboards for use by authorities in various countries when monitoring licensed companies. This effort is aimed at supporting convergence among regulators around the world, as MiCA is being progressively implemented across different jurisdictions within the European Union.

Market monitoring will also be incorporated into the 2027 plan through MIDAS. MIDAS is a centralized system used by ESMA to monitor potential market abuses in the crypto industry.

MIDAS The first phase is expected to be fully operational by 2027. The second phase, which will be disclosed as early as February, aims to provide the system with stronger analytical capabilities and incorporate new types of data.

ESMA has scheduled the launch of this phase for the fourth quarter of 2027, subject to approval from its board of directors.

The regulatory authority has previously developed guidelines for competent authorities in various countries regarding the prevention and detection of market abuses related to MiCA, which are also part of the framework that MIDAS will support.

In addition to the encryption field, data and technology will also play a more significant role in the broader regulatory work of ESMA. Its plans for 2027 include building a ESMA data platform, as well as deploying artificial intelligence tools to support regulation. This also encompasses work related to network security and tokenization.

After the MiCA transition period ends, the focus of ESMA supervision shifts towards oversight.

The focus of regulation has shifted towards supervision, as the last MiCA transition period expires on July 1st, which means that companies that previously relied on national registration are now faced with authorization requirements within the EU.

As of the deadline, among the 1,343 crypto service providers operating within the EU economic area, only 281 have obtained MiCA authorization, while 1,062 have not yet been approved.

The data cited in the August report also showed that unauthorized companies had a high-risk or severe-risk rating of 12%, while authorized providers had a rate of 2%. Unauthorized companies sent $5 billion directly to sanctioned counterparties, whereas authorized companies sent approximately $1.7 billion.

After the deadline, the number of authorized companies continued to increase. The ESMA registry reached 300 providers at the beginning of July, with 57 companies having been authorized at that time, including Standard Chartered Bank and FalconX. Authorized providers can utilize the MiCA passport rights to provide covered services among EU member states.

Regulatory issues have always existed for companies that continue to provide services to European customers without a MiCA license. For example, after missing the license deadline on July 1st and withdrawing its application in Greece in June, Binance still provided services to some EU customers through arrangements that included reverse recruitment.

ESMA once requested confirmation as to whether Binance was properly exiting its related EU business, while the exchange continued to seek authorization in other places at the same time. Reverse recruitment refers to EU customers independently and proactively contacting companies in third countries, a situation that is also within the scope of regulatory concerns for 2027 listed by ESMA.

ESMA will incorporate regulatory findings into the review of MiCA.

The regulatory experience regarding CASP will be incorporated into the MiCA review planned by the European Commission, which is expected to be completed by June 2027.

The European Commission launched a public consultation on the operation of this framework in May, seeking feedback from individuals, crypto service providers, issuers, financial institutions, scholars, industry groups, and public institutions. The consultation ended on August 31.

ESMA plans to provide its regulatory findings to this review and to prepare for any subsequent legislative proposals that may be made.

The issue of how to organize crypto regulation within the EU remains part of regulatory discussions. In September, an official from the German Federal Financial Supervisory Authority (BaFin) warned that transferring authorization responsibilities to a centralized EU regulatory body could impose additional burdens on businesses and reduce their flexibility; he believed that national authorities still possess knowledge of local markets and individual business models.

For 2027, the work plan of ESMA will still place national regulatory agencies at the center of supervision by CASP, while placing greater emphasis on coordinated and joint regulatory tools, as well as the consistent application of MiCA throughout the European Union.