In April 2025, the ESMA Board of Supervisors decided to establish a ad hoc Peer Review Committee (PRC)<\/strong> The trigger was Malta's status as one of the first EU countries to issue MiCA licenses\u2014significantly ahead of other member states. The suspicion was that speed might have come at the expense of thorough vetting.<\/p>\n\n\n\n The result was published as an Executive Summary on July 10, 2025 (ESMA42-2004696504-8164). The PRC consisted of representatives from ESMA, the European Banking Authority (EBA), and several National Computing Centres (NCAs). The review focused on a single, unnamed crypto-asset service provider (CASP) licensed by the MFSA in the first months of 2025.<\/p>\n\n\n\n The Markets in Crypto Assets Regulation (MiCA) was introduced on June 29, 2024<\/strong> It entered into force and has been fully applied since December 30, 2024. Since January 2025, crypto service providers in the EU have been required to apply for a CASP license from their national supervisory authority. Existing providers with a national license issued before the entry into force are exempt from this requirement. Grandfathering phase until June 30, 2026<\/strong> \u2014 they may continue their services under the old regimes during this period, but must submit the MiCA license in due time.<\/p>\n\n\n\n The regulation pursues three main objectives: uniform investor protection in the EU, market integrity (insider trading, market manipulation) and combating money laundering and terrorist financing.<\/p>\n\n\n\n In the specific case under investigation, the PRC concludes that the MFSA acted improperly during the authorization process. \u201epartially met expectations\u201c<\/strong> \u2013 so partial compliance, not full compliance. The main points:<\/p>\n\n\n\n Important for context: ESMA does not name the CASP. Market speculation suggests it could be OKX (operating in Malta as Okcoin Europe) \u2014 the Maltese Financial Intelligence Analysis Unit imposed a \u20ac1.2 million fine on Okcoin Europe in April 2025 for AML violations from 2023, shortly after it received its MiCA license in January 2025. There is no official confirmation.<\/p>\n\n\n\n The review is not a blanket condemnation. On the contrary \u2014 the MFSA is explicitly praised in several areas:<\/p>\n\n\n\n The central point, which was overlooked in many headlines: The peer review is formally aimed at Malta, which However, the recommendations are directed at all NCAs in the EU\/EEA.<\/strong>. ESMA highlights five issues that should be examined more closely in authorization procedures:<\/p>\n\n\n\n The Maltese regulatory authority has publicly accepted the findings. MFSA CEO Kenneth Farrugia stated that the agency welcomes the recommendations and will incorporate them into its own practices. A spokesperson also clarified: \u201eNo MiCA license in Malta is at risk of revocation or re-evaluation as a result of the peer review outcomes.\u201c<\/strong> The MFSA has committed to completing the implementation of the recommendations by September 2025.<\/p>\n\n\n\n Currently, four MiCA CASPs are listed in Malta: Bitpanda (BP23), Crypto.com (Foris Dax), OKX (Okcoin Europe) and ZBX (Zillion Bits).<\/p>\n\n\n\n The peer review touches upon a fundamental question that has been a pressing issue in EU crypto regulation since MiCA came into force: How quickly can\u2014and how quickly must\u2014a license be granted? Malta argues that this is necessary to promote innovation and establish an early market order. Other supervisory bodies, such as the French AMF or the German BaFin, are considered significantly stricter; BaFin, for example, explicitly points out that it only grants "immediately effective, formal licenses," not "preliminary approvals in principle.".<\/p>\n\n\n\n Behind this debate lies the accusation of regulatory overreach. Forum Shopping<\/strong>Companies choose the member state with the fastest or least restrictive procedure, obtain the license there, and then use the EU passporting<\/strong>, in order to become active across the EU. Closely related to this is the second major stock market movement of 2025: OKX received the first full MiCA license from Malta in January.<\/a>, in parallel, Bybit<\/a>, HTX<\/a> and other global platforms for licensing pathways in various EU countries.<\/p>\n\n\n\n Specifically, the peer review process changes little for private investors:<\/p>\n\n\n\n From a crypto forensics perspective, regulatory convergence under MiCA is a positive development. KYC data, complaint procedures, and regulatory inquiries function significantly better with licensed EU CASPs than with unregulated offshore platforms. Anyone who suspects that coins originating from a fraudulent case have ended up on an EU-regulated exchange should promptly obtain an initial forensic assessment through a [relevant forensic expert\/institution]. Wallet check<\/a> to toast.<\/p>\n\n\n\n No. The MFSA has explicitly stated that no licenses will be revoked or reassessed as a result of the peer review. Existing licenses remain valid; the recommendations were implemented by September 2025.<\/p>\n<\/div><\/div>\n\n\n\n No. ESMA explicitly certifies that the MFSA "fully meets expectations" regarding resources and settings, and "largely meets" expectations regarding ongoing supervision. The criticism focuses on the authorization process for an individual CASP, not on Maltese supervision as a whole.<\/p>\n<\/div><\/div>\n\n\n\n ESMA has not released the name. Market observers are speculating about OKX because the Maltese FIAU imposed a \u20ac1.2 million fine on Okcoin Europe in April 2025 for AML violations from 2023. There is no official confirmation.<\/p>\n<\/div><\/div>\n\n\n\n For end customers, there are few concrete changes. EU passporting continues to function, and BaFin retains national intervention rights through the KMAG (German Act on the Modernization of the Law of Banking Supervision). Consumer protection under MiCA remains unchanged.<\/p>\n<\/div><\/div>\n\n\n\n According to ESMA, key issues\u2014business model, IT architecture, compliance\u2014were not resolved before the license in question was granted, but rather postponed to ongoing oversight. ESMA counters that the license itself is the appropriate mechanism for clarification.<\/p>\n<\/div><\/div>","protected":false},"excerpt":{"rendered":" MiCA is intended to harmonise the European crypto market - but Malta is being criticised for lax licensing. The island is facing a balancing act between being a centre of innovation and strict consumer protection.<\/p>","protected":false},"author":4,"featured_media":235768,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[7],"tags":[],"class_list":["post-235767","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-krypto-neuigkeiten"],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/krypto-investigation.de\/en\/wp-json\/wp\/v2\/posts\/235767","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/krypto-investigation.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/krypto-investigation.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/krypto-investigation.de\/en\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/krypto-investigation.de\/en\/wp-json\/wp\/v2\/comments?post=235767"}],"version-history":[{"count":1,"href":"https:\/\/krypto-investigation.de\/en\/wp-json\/wp\/v2\/posts\/235767\/revisions"}],"predecessor-version":[{"id":238290,"href":"https:\/\/krypto-investigation.de\/en\/wp-json\/wp\/v2\/posts\/235767\/revisions\/238290"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/krypto-investigation.de\/en\/wp-json\/wp\/v2\/media\/235768"}],"wp:attachment":[{"href":"https:\/\/krypto-investigation.de\/en\/wp-json\/wp\/v2\/media?parent=235767"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/krypto-investigation.de\/en\/wp-json\/wp\/v2\/categories?post=235767"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/krypto-investigation.de\/en\/wp-json\/wp\/v2\/tags?post=235767"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}MiCA frames in brief<\/h2>\n\n\n\n
What ESMA specifically criticizes<\/h2>\n\n\n\n
\n
What ESMA views positively<\/h2>\n\n\n\n
\n
Recommendations for all NCAs \u2014 not just Malta<\/h2>\n\n\n\n
\n
MFSA reactions<\/h2>\n\n\n\n
Context: Forum Shopping and the debate about the right scale<\/h2>\n\n\n\n
Significance for investors in Germany<\/h2>\n\n\n\n
\n
Note on forensic practice<\/h3>\n\n\n\n
FAQ \u2013 Frequently Asked Questions about the ESMA Peer Review<\/h2>\n\n\n\n
Will OKX, Crypto.com, or Bitpanda lose their Malta license?<\/h3>
Does this criticism mean that Malta is unfairly regulated?<\/strong><\/h3>
Which CASP was investigated?<\/h3>
What will change for German investors?<\/strong><\/h3>
What was the main problem in the licensing process?<\/strong><\/h3>