1. ESMA Peer Review Highlights Gaps

• Scope & Trigger:
  ESMA launched a peer review in April 2025 targeting the MFSA's CASP authorization under MiCA—effective since June 29, 2024.

• Resource Strengths:
  The MFSA demonstrated strong supervisory capabilities, backed by adequate staff and technical expertise.

• Authorization Deficiencies:
  However, for one provider, ESMA flagged that key material issues remained unresolved at authorization time—including governance, IT infrastructure, AML/CFT controls, business expansion strategy, and conflicts of interest .

2. Regulatory Red Flags

Persistent Pre-Licensing Gaps

ESMA noted MFSA’s license was granted before enforcement remediations were complete—resulting in an authorization process that lacked sufficient depth and timing provisions.

Unchecked Risk Domains

The peer review identified several pressing risk areas:

• Scaling of business plans without proportionate operational resources

• Weak internal governance frameworks

• Exposure from ICT and custody systems

• Insufficient AML/CFT activities and controls

These areas should have been rigorously evaluated during licensing, rather than retrospectively post-approval.

3. ESMA’s Recommendations

1. Reassess the CASP license:
   ESMA urges MFSA to revisit pending issues before authorization becomes effective.

2. Enhance consistency across NCAs:
   ESMA calls on all EU regulators to share supervisory practices through the DFSC (Digital Finance Standing Committee) to foster uniform enforcement.

3. Prioritize key risk areas in future reviews:
   This includes growth forecasts, governance, ICT resilience, conflicts-of-interest safeguards, DeFi and Web3 risks, user interfaces, and cross-border compliance measures.

4. MFSA’s Response

The MFSA—from 2018’s Virtual Financial Assets (VFA) framework to full MiCA implementation—welcomed the peer review’s findings. They accepted that authorization procedures were only partially in line with expectations and pledged to enhance supervisory quality by integrating ESMA’s recommendations.

5. Sector-Wide Implications

• CASPs Licensed in Malta (as of July 10, 2025):
  Bitpanda (BP23), Crypto.com (Foris Dax), OKX (Okcoin Europe), and ZBX (Zillion Bits).

• Cross-Border Significance:
  A Maltese MiCA license enables firms to operate EU-wide—so strong, consistent licensing is vital for maintaining cross-border investor confidence.

• Fast-Track Critique:
  Malta’s legacy VFA-based “fast-track” route has been criticized for allowing swift but potentially superficial MiCA approvals—such as OKX's license shortly before a $500 M SEC settlement—prompting worries about due diligence quality.

6. Looking Ahead

Malta retains a leadership role in Europe's crypto licensing scene, but ESMA’s review exposes critical gaps in its authorization approach. As MiCA matures, uniformity across national regulators will be essential to safeguard investor interests and preserve the integrity of the EU’s crypto market.

The next test lies in MFSA’s capacity to implement ESMA’s corrective actions and enhance trust in Malta’s regulatory diligence—without undermining the country’s competitive edge.