ESMA Peer Review Finds Malta's MFSA Rushed Crypto Firm Authorisation Under MiCA regulation

The European Securities and Markets Authority (ESMA)  has criticised Malta's financial regulator for authorising a crypto asset service provider before resolving material supervisory issues, in the first peer review under the new Markets in Crypto-Assets Regulation.

ESMA's review of the Malta Financial Services Authority (MFSA) found that several significant problems remained unresolved when the MFSA granted authorisation to an unnamed crypto firm, questioning the timing and thoroughness of the approval process under MiCA, which came into force on 29 June 2024.

The peer review committee concluded that "several material issues remained unresolved at the time of the authorisation" and questioned why MFSA "did not leverage on the authorisation process to ensure that the entity would remedy key deficiencies before the authorisation would be effective."

MiCA represents the world's first comprehensive regulatory framework for crypto assets, requiring crypto asset service providers to apply for authorisation to operate within the EU from January 2025. A grandfathering period of up to 18 months allows existing providers to continue operating until 30 June 2026 whilst seeking authorisation.

The review identified that the MFSA failed to adequately assess key risk areas during the authorisation process, including aspects of the firm's business plan related to growth and client onboarding, potential conflicts of interest, governance arrangements, and risks related to ICT infrastructure and custody arrangements.

ESMA noted particular concerns about the entity's supervisory history, stating that "material issues remained unresolved or pending remediation at the time of the authorisation, including the remediation of previous enforcement cases and the outcome of (at the time) pending ones."

Despite the criticisms, the review acknowledged that MFSA "has built a good level of expertise in this sector and has sufficient supervisory resources for CASP authorisations and supervision." The regulator was praised for its proactive recruitment of crypto specialists and industry outreach efforts.

The peer review assessed three main areas: MFSA's authorisation process, its supervisory response to post-authorisation events, and the adequacy of its supervisory setup and resources. MFSA received ratings of "fully meeting expectations" for supervisory settings and resources, "largely meeting expectations" for supervisory review powers, and "partially meeting expectations" for the authorisation process.

ESMA's overall  peer review assessment of the MFSA in each assessment area. Source: ESMA Peer Review Reort: Executive Summary, 10 July 2025 -  https://www.esma.europa.eu/sites/default/files/2025-07/ESMA42-2004696504-8164_Fast-track_peer_review_on_a_CASP_authorisation_and_supervision_in_Malta.pdf 

ESMA's review comes at a critical time as most EU national regulators are currently processing CASP authorisation applications. The regulator emphasised the importance of robust authorisation processes given the cross-border nature of crypto businesses, where firms typically establish a single European hub to serve the entire EU market through passporting arrangements.

The review provides recommendations for all EU regulators currently authorising crypto firms, highlighting risks related to business growth, conflicts of interest, governance arrangements, ICT architecture, and Web3 products. It particularly stressed the need for regulators to assess firms' capacity to block malicious transactions and manage cybersecurity risks effectively.

The MFSA welcomed the peer review findings in a statement, saying: "The insights provided in the review are invaluable in supporting the MFSA's continued efforts to improve and strengthen its performance in the supervision of this sector."

The Malta regulator added: "We view this as an opportunity to reinforce our processes and procedures with respect to this innovative sector and the MFSA and FIAU are onboarding the recommendations as provided by the review to ensure that Malta strengthens the robustness of its supervisory framework in this field."

ESMA noted that the fast-track peer review, launched in April 2025, aimed to foster supervisory convergence across the EU at a time when consistency in authorisation approaches is crucial for the new regulatory framework's success.