ESMA on Monday set operational resilience, outsourcing controls, and the physical presence of crypto firms inside the European Union as its top supervisory priorities for 2027, marking a shift from rulemaking to enforcement under the Markets in Crypto-Assets Regulation (MiCA).

The Paris-based European Securities and Markets Authority laid out the agenda in its annual work program. It targets six areas where the regulator will coordinate with national competent authorities overseeing crypto asset service providers (CASPs).

Only 281 of 1,343 crypto service providers operating across the European Economic Area had secured MiCA authorization after the final transition period expired on July 1, leaving 1,062 firms without approval.

What enforcement gaps triggered the new priorities?

Data cited in an August report showed 12% of unauthorized firms carried High or Severe risk ratings, compared with 2% of authorized providers. Unauthorized firms had sent $5 billion directly to sanctioned counterparties, while authorized firms recorded roughly $1.7 billion.

The risk disparity underscores why ESMA wants to move beyond licensing into post-authorization supervision. ESMA Chair Verena Ross framed the change before the European Parliament's Committee on Economic and Monetary Affairs.

"We want innovation to flourish within a framework that provides clarity for firms, safeguards for investors and confidence in the markets," Ross said, describing the shift as moving "from rulemaking towards supervision and convergence."

Which areas will draw the most scrutiny?

Operational resilience tops the list. ESMA will examine whether licensed firms can maintain services during disruptions or rely on fragile infrastructure.

Outsourcing risk is the second priority. Under MiCA, crypto firms remain responsible for regulatory obligations even when operational functions move to third parties. ESMA will test whether firms lean too heavily on external providers or infrastructure located outside the bloc.

The regulator will also scrutinize whether CASPs maintain sufficient operations within the EU. Liquidity considerations, reverse solicitation practices, and the correct classification of crypto assets round out the six-item agenda.

ESMA launched a review of MiCA custodians in July, covering private key and storage management, transaction controls, incident response, and reliance on third-party technology providers. That exercise moved scrutiny beyond authorization and toward the controls used after a license is granted.

How will ESMA harmonize oversight across the bloc?

ESMA plans to standardize periodic reporting by CASPs to national authorities and promote common risk indicators and supervisory dashboards. Standardized formats let regulators detect outliers and apply interventions with greater consistency.

Market surveillance will run through MIDAS, ESMA's centralized system for monitoring potential market abuse in crypto markets. The first phase of MIDAS is expected to become fully operational in 2027. A second phase, first disclosed in February, adds analytical capabilities and new data types. ESMA scheduled that rollout for the fourth quarter of 2027, subject to board approval.

What about the firms still operating without a license?

ESMA has pressed firms that continue serving European customers without MiCA authorization to wind down relevant operations. Binance was serving some EU customers through reverse solicitation provisions after missing the July 1 licensing deadline and withdrawing its Greek application in June.

Reverse solicitation, which covers situations where an EU client initiates contact with a third-country firm on its own initiative, is now on the 2027 supervisory list.

The authorized pool kept growing after the deadline. ESMA's register reached 300 providers in early July after 57 firms gained authorization, including Standard Chartered and FalconX. Authorized providers can use MiCA passporting rights to offer covered services across EU member states.

What happens next?

Experience from supervising CASPs will feed into the European Commission's scheduled review of MiCA, expected by June 2027. The Commission opened a public consultation in May, which ran through Aug. 31. ESMA plans to contribute its supervisory findings and prepare for any legislative proposal that follows.

A BaFin official warned in September that moving authorization to a centralized EU supervisor could add burdens for firms and reduce flexibility, arguing national authorities retain knowledge of local markets.

For 2027, ESMA keeps national regulators at the center of CASP oversight while emphasizing coordination, common tools, and consistent application of MiCA across the bloc. The open question is how quickly national regulators converge in practice, particularly around operational resilience expectations and how risk indicators translate into enforcement actions as MIDAS goes live.