ESMA Exposes Malta’s Crypto Licensing Shortfalls in Groundbreaking MiCA Audit

Europe's markets watchdog just dropped a truth bomb on Malta's 'blockchain island' fantasy.

Cracks in the crypto paradise

The European Securities and Markets Authority (ESMA) revealed glaring gaps in Malta's digital asset oversight during its first Markets in Crypto-Assets (MiCA) regulation peer review. Turns out, sunshine and cheap corporate taxes don't automatically create robust financial frameworks.

Regulators playing catch-up

While Malta raced to attract crypto firms with friendly policies, ESMA's findings suggest their licensing regime couldn't spot a red flag if it was written in blockchain. The review—part of MiCA's harmonization push—exposes the risks of regulatory arbitrage in Europe's digital asset space.

The irony isn't lost on us

A jurisdiction that built its reputation on lax banking controls now faces scrutiny over—wait for it—inadequate financial safeguards. Maybe next they'll discover water is wet.

This wake-up call comes as MiCA implementation kicks into high gear, forcing crypto hubs to choose between being serious financial centers or just tropical offices with good WiFi.

Shortcomings in the authorization process of a CASP

ESMA’s ad hoc Peer Review Committee (PRC), which carried out the evaluation, found that the MFSA granted a green light to the CASP while several “material issues” were yet to be resolved. 

These included outstanding remediation from previous enforcement cases and pending supervisory matters that, in the committee’s view, should have been addressed before the license was issued.

The report mentioned that the MFSA did not effectively apply the licensing process to compel the CASP to address its regulatory inefficiencies. It added that aspects of the applicant’s business plan, like its expansion model and new client listings, were not adequately inspected.

“The PRC did not find evidence that certain key aspects of the authorisation file were adequately assessed, including conflicts of interest, governance structures, and technology-related risks tied to custody, ICT infrastructure, Web3 integrations, and Anti-Money Laundering/Counter Financing of Terrorism (AML/CFT) protocols,” the review read.

Still, the committee asserted that while it is nearly impossible to issue a completely risk-free authorization, these material issues were beyond what could reasonably be addressed during post-authorization supervision. 

“The MFSA’s supervisory response appears largely appropriate and proportionate. However, the PRC considers that some of the measures could have already been considered as part of the authorisation process,” ESMA explained.

Peer review launched to assess coordinated oversight

In December 2024, ESMA’s Board of Supervisors agreed upon a coordinated approach to oversee CASP authorizations under MiCA. One of the parameters included a supervisory briefing and group-level discussions on license applications through the Digital Finance Standing Committee (DFSC).

Malta’s authorization of the unnamed CASP became a case study in the review process. The PRC’s evaluation was conducted under ESMA’s Peer Review Methodology and officially launched in April 2025. The goal was to assess licensing and the early-stage supervision of the authorized firm.

Even after flagging several issues, the PRC did commend the MFSA for its crypto regulation domain and its resource allocation toward CASP oversight. 

Still, it asked Malta’s watchdogs to be vigilant and adaptive in supervisory practices in pace with the increasing number of applicants and licensees.

One of the recommendations from the review is that MFSA use a more “stringent” application process during the pre-authorization phase. The PRC requested the regulatory body to question any material gaps before a license is issued, rather than pushing it forward to post-licensing supervision. 

Moreover, supervisory measures that MFSA enacted after licensing were, according to ESMA, appropriate, but could have been incorporated earlier in the process.

MFSA tightens transparency rules for crypto firms

In May, MFSA issued a directive requiring firms operating in the European Union or European Economic Area to provide region-specific information through dedicated websites.

Sarah Pulis, Head of Conduct Supervision at the MFSA, stated that all CASPs must give regulators “clear, accessible information about their products and services” and ensure any non-available offerings in specific jurisdictions are properly disclosed, per MiCA rules.

The MFSA is reviewing CASP websites in compliance with MiCA’s rules on fairness, transparency, and accuracy. Christopher Buttigieg, MFSA’s Chief Officer Supervision, propounded that proactive reviews help hold firms accountable for how they communicate with clients. 

“We are ensuring that their communications are transparent, fair, and aligned with consumer expectations, even in their first few months of operation under MiCAR,” he remarked.

Cryptopolitan Academy: Want to grow your money in 2025? Learn how to do it with DeFi in our upcoming webclass. Save Your Spot