The ESMA view on CASPs: Substance, control, and oversight

If you enjoy reading our articles and want to support our mission of sharing valuable insights on AML and investment funds, the easiest way to help is by subscribing to the Fundiligence newsletter.
For us it is very important, for you it is FREE.

The European Union has made it clear: crypto is now part of the regulated financial system. With MiCA finally in place, crypto-asset service providers, CASPs, have to meet the same kind of expectations that apply to any other financial firms.

The ESMA goal is simple: make authorization consistent across the European Union. ESMA wants all regulators to apply the same standards, whether a company applies in Paris, Madrid, or Vilnius. A firm that wants a license will need people, systems, and real decision-making power inside the EU.

According to the ESMA approach, there are no low-risk CASPs. Crypto companies, even the small ones, often operate without the layers of control that exist in traditional finance. In the conventional system, several intermediaries are between the client and the market: banks, custodians, transfer agents, and nominee account structures. Each of them performs checks, records transactions, and provides a degree of transparency and accountability. Client assets are normally held through segregated accounts, and their movements pass through multiple controlled systems subject to reconciliation and oversight.

In crypto, most of these controls are missing. A single platform can onboard clients, hold their assets, and execute their transactions at the same time. The flow of funds does not pass through correspondent banks or custodians but through blockchain networks that operate outside regulated infrastructure. The absence of nominee accounts or independent custody means that the firm itself often controls both the records and the assets. This concentration of roles makes supervision more difficult and increases the risk.

For regulators, this is why the scale of a CASP is less relevant than its structure. Even a small exchange can move large volumes across borders instantly, with limited traceability compared to the reporting obligations and audit trails expected in traditional finance. Most of them have little experience working under regulatory supervision. That’s why ESMA says they all CASP carry higher risk than traditional financial firms, with no esclusion.

The level of regulatory scrutiny will depend on factors like size, structure, and business model. A large platform Delegation and outsourcing remain among the most sensitive points in ESMA’s guidance. In traditional finance, delegation is common but strictly framed: the fund or manager keeps full responsibility, and the delegate performs a specific task under supervision. There are defined reporting lines, oversight procedures, and the possibility for the regulator to inspect both parties. In crypto, this concept has often been interpreted too loosely. Many CASPs rely on group companies or external providers for key functions — compliance, risk, IT security, even parts of client onboarding — but without the same structure of control.

ESMA draws a clear line here. Support tasks can be delegated, but the responsibility cannot. A firm cannot outsource its own mind. The compliance, risk, and management functions must remain within the EU entity, with people who understand the business and are accountable to the local regulator. The same principle applies within groups: using another group company as a service provider does not make the obligation lighter. If the parent company controls too many decisions, the EU entity becomes a letter-box, and authorization should not be granted.

In traditional finance, delegation works because there are multiple layers of defense: contractual obligations, oversight, initial and periodical due diligence according to the risks, collecting and analyzing KPIs, on-site visits, establishment of polices and procedures. These generate a real oversight of the delegated function. From my perspective, this is the only sustainable approach. Delegation is efficient only when the a strong oversight is performed. MiCA’s framework makes this new framework explicit, and in my opinion, this is a necessary step if crypto wants to be treated as a regulated business.

ESMA also warns about the use of staff and outsourcing outside the country of authorization. Some support functions can be abroad, but critical roles must stay within the EU. The firm must remain in full control and ensure the regulator can get information without obstacles. Outsourcing cannot turn the EU entity into an empty shell. This includes group arrangements: delegating tasks to another company in the same group does not reduce the responsibility of the EU entity.

Substance is another central theme. CASPs must show that they can make decisions inside the EU, not just follow instructions from a parent company abroad. At least one board member must be based locally, and the CEO should dedicate full time to the role. Senior managers are expected to have real authority and be available to meet the local regulator in person.

Governance and internal controls are also under the microscope. ESMA expects firms to have clear responsibilities and enough qualified staff in the EU to manage compliance, risk, and audit functions. These roles cannot be outsourced entirely. The CASP itself must monitor its own risks and compliance, with a structure that covers all activities, including those performed by service providers. Policies, procedures, and periodic reviews are a must. Reports on compliance and internal audit findings must reach the management body regularly, not stay buried in the second line.

Each CASP must appoint a dedicated compliance officer with the authority to influence key decisions and access senior management, a robust chinese wall between teams has to be established. Only in very small firms can this be combined with risk management. The compliance officer must have the right resources, tools, and independence to challenge the business when needed.

When it comes to “fit and proper” checks, ESMA stresses that all board members must understand how crypto-assets and related services work and have a strong knowledge of Crypto. Gaps in experience can be compensated by others with stronger backgrounds in regulated finance, but the board must function as a whole. Past regulatory issues don’t automatically disqualify someone, but they will raise questions. ESMA expects supervisors to dig into those cases, contact other authorities, and interview the individuals directly. Ongoing criminal proceedings, even without conviction, must also be considered.

Another key point is realism. Business plans should make sense and reflect what the firm can actually achieve. ESMA expects three-year forecasts with clear milestones and contingency plans for bad scenarios. If revenues drop below expectations, the CASP must still be able to operate safely. In other words, no fantasy projections.

Regulators will keep public registers showing which firms are authorized or have had their license suspended. The notification process under MiCA comes with strict deadlines. If an application is incomplete, it must be withdrawn and resubmitted, no endless back-and-forth. This is meant to bring order and predictability, both for supervisors and for firms.

Overall, the Supervisory Briefing is not just a set of guidelines. The EU wants to professionalize the crypto industry and align it with the standards of traditional finance. Firms will need real presence, qualified management, and proper controls. Regulators will expect to see substance, not marketing.

In short, ESMA’s message could not be clearer: crypto businesses that want to operate in Europe must grow up. The time of running global operations from a laptop in another country is over. MiCA brings structure, accountability, and discipline. And under ESMA’s eye, there’s no such thing as a low-risk CASP.

If you arrived until here, it means that you potentially enjoyed this article. I personally thank you and I invite you to subscribe to the newsletter. Also, feel free to get in contact and suggest any particular topic for the next release.

The views and opinions expressed in this article are my own and do not reflect the official policy, position, or opinions of any financial institution, or other organization.
The content of this article is based on personal research of the author and understanding of AML (Anti-Money Laundering) and compliance topics.