Key Highlights
- The European Securities and Markets Authority’s (ESMA) register of non-compliant crypto providers currently relies on data from only five out of 30 European Economic Area (EEA) member states.
- Major financial jurisdictions, including Germany, France, and Cyprus, have submitted zero non-compliant entries to the central ESMA database despite issuing numerous domestic warnings.
- Regulatory gaps persist under the Markets in Crypto-Assets (MiCA) framework because Article 110 designates the register as non-exhaustive and imposes no mandatory reporting duty or deadline on national regulators.
European financial institutions—including banks, brokers, and payment providers—relying on the European Securities and Markets Authority (ESMA) to screen digital asset counterparties face significant blind spots. According to an FM Intelligence review of ESMA’s October 29 file, the central register of non-compliant entities draws contributions from only five of the 30 European Economic Area (EEA) states. This leaves counterparty screening tools reliant on a fraction of the region’s national oversight data, raising questions about the operational effectiveness of European-level transparency for unauthorized firms.
National Blacklists Fail to Feed the Central ESMA File
The vast majority of the 188 entries present in ESMA’s file stem from a single country: Italy. The country’s market regulator, the Commissione Nazionale per le Società e la Borsa (CONSOB), has directed internet service providers to block unauthorized financial websites since 2019. By October 29, CONSOB’s domestic tally reached 1,861 blocked domains, with 250 explicitly linked to crypto-assets. Analysts noted that supervisory authorities operating pre-existing systems to identify and catalog bulk domains find it substantially easier to forward non-compliant records to ESMA. Outside of Italy, contributions remain minimal: Belgium’s Financial Services and Markets Authority contributed six entries, while regulatory authorities in the Czech Republic, the Netherlands, and Slovakia submitted just one record each, leaving 25 EEA nations unrepresented.
At the opposite end of the spectrum is Germany, which boasts the largest share of authorized market participants but completely lacks representation in the non-compliant database. ESMA registers 119 authorized or notified providers situated in Germany, mainly consisting of investment firms and banks notified under the Markets in Crypto-Assets (MiCA) regulation. However, the Federal Financial Supervisory Authority (BaFin) has submitted zero non-compliant entities to ESMA. This absence stands in stark contrast to domestic enforcement: between the beginning of 2026 and November 3, BaFin issued 245 public consumer warnings, 89 of which flagged unauthorized cryptocurrency services.
Similar disparities appear across other heavily active financial markets. In France, the Autorité des marchés financiers (AMF) announced on October 19 that it had added 64 crypto entities to its domestic blacklist since January. In Cyprus, the Cyprus Securities and Exchange Commission (CySEC) explicitly referenced MiCA’s Article 59 across warnings published in September and October. Despite these domestic actions, neither the French AMF nor CySEC has transferred entries into the ESMA register.
Regulatory Loopholes Under MiCA Article 110
The reporting disparity stems largely from regulatory architecture. Under MiCA’s Article 110, the register is formally classified as non-exhaustive. While the provision establishes the minimum required content for an entry, it imposes neither a legal obligation nor a filing deadline on national competent authorities. Furthermore, many consumer alerts issued by authorities in Germany and France address blended investment and cryptocurrency services, which are typically addressed under national banking or securities statutes rather than the MiCA crypto registry alone. Consequently, Germany’s lack of entries reflects differing administrative reporting channels rather than a domestic market free from unauthorized crypto operations.
This fragmentation coincides with broader discussions over the scope of pan-European oversight. On October 9, European Union finance ministers reached a consensus to restrict direct ESMA supervision solely to the largest cross-border market participants. This agreement narrowed a broader proposal from the European Commission that initially sought to shift supervision of all crypto firms directly to ESMA in Paris. Meanwhile, national supervisors have expressed concern over cross-border regulatory arbitrage; a BaFin executive director noted in September that firms choose Europe’s weakest supervisor and then expand across the bloc. While a centralized regime seeks to standardize where firms obtain operating licenses, ESMA’s file reveals an unaddressed secondary challenge in reporting unauthorized activity, with ESMA itself having submitted no entries independently.
Why This Matters
The lack of uniform participation across the EEA weakens the practical utility of ESMA’s non-compliant register. Regulated institutions screening potential counterparties or processing cross-border payments cannot depend entirely on the EU-level file, as unlicensed operations flagged by major watchdogs like BaFin, AMF, and CySEC do not automatically appear in the central repository. With the European Commission scheduled to deliver an official review of the MiCA framework by June 30, 2027, the limited scope and uneven submissions within the register highlight significant gaps in enforcement synchronization that European policymakers will have to address.
Frequently Asked Questions
Why are so many EU member states missing from the ESMA non-compliant register?
Article 110 of the MiCA framework defines the unauthorized register as non-exhaustive and does not establish a legal mandate or definitive timeframe for national supervisory authorities to submit entries. Because of this, regulators often manage warnings independently under national frameworks.
Why has Germany submitted zero entries despite issuing crypto warnings?
BaFin frequently issues warnings concerning mixed financial schemes that involve both traditional securities and crypto products. These cases are generally processed under domestic securities and banking statutes rather than through MiCA-specific mechanisms, resulting in divergent reporting paths despite active domestic consumer protection measures.
Who oversees cryptocurrency providers across the European Union?
Under a recent agreement reached by EU finance ministers on October 9, direct ESMA supervision is restricted to the largest cross-border digital asset entities, while national competent authorities retain primary supervisory and enforcement responsibilities over other market participants within their domestic borders.
