← Regulators
MiCA EU 2023/1114 DORA EU 2022/2554 EU-wide

Who is ESMA: the EU's securities-markets and crypto rule-maker

The European Securities and Markets Authority is the EU body that writes the technical rulebook for MiCA crypto and is one of the three authorities overseeing DORA. What it does, what it deliberately does NOT do (it does not licence or fine crypto firms — national regulators do), who runs it, and where it sits next to EBA — every fact sourced.

Published May 17, 2026 · 7 min read · 12 sources cited

If you are trying to work out who actually regulates crypto in the EU, you will keep hitting the name ESMA — and then discover ESMA does not licence a single crypto firm and cannot fine one. That is not a contradiction; it is the design. This is a profile of what ESMA is, what it does under MiCA and DORA, and what it deliberately leaves to others. Every fact is sourced.

Quick facts

  • Full name: European Securities and Markets Authority (ESMA)
  • Established: by Regulation (EU) No 1095/2010; began operations on 1 January 2011 (ESMA)
  • Legal status: independent EU authority, part of the European System of Financial Supervision (ESFS) alongside the EBA (banking) and EIOPA (insurance/pensions)
  • Headquarters: Paris (esma.europa.eu)
  • Mission: enhance investor protection, promote orderly financial markets, and safeguard financial stability (ESMA)
  • Chair: Verena Ross — term ends 31 October 2026; she has announced she will not stay beyond it and ESMA has launched the process to select a successor (ESMA)
  • Executive Director: Natasha Cazenave — in post since 1 June 2021; mandate renewed by the Board of Supervisors on 7 October 2025 for a second five-year term (ESMA)
  • Website: esma.europa.eu

What ESMA is — and what it is not

ESMA is the EU-level authority for securities markets and, since MiCA, for crypto-assets. It writes the detailed technical rulebook, maintains EU-wide registers, and pushes national regulators to apply the rules the same way.

It is not a national regulator and, for crypto, not the body you apply to or get fined by. Under MiCA the licence comes from a national competent authority (NCA — the financial regulator in each Member State, e.g. France’s AMF, Germany’s BaFin), designated under Article 93 MiCA, and administrative penalties are imposed by those NCAs (ESMA). ESMA sets the standards and runs the register; it does not authorise or sanction firms directly.

What ESMA actually does

ESMA’s mission is to enhance investor protection, promote orderly markets and safeguard financial stability (ESMA). In practice that breaks into three things relevant to the verticals here:

  1. Writes the Level 2/3 rulebook — the regulatory and implementing technical standards (RTS/ITS — the detailed rules that fill in how a high-level Regulation actually works in practice), developed in cooperation with the EBA, EIOPA and the ECB.
  2. Maintains EU-wide registers — the single place to check who is authorised and who is not.
  3. Drives supervisory convergence — making sure 27 national regulators interpret the same rule the same way, so a firm cannot shop for the softest Member State.

ESMA’s role under MiCA

MiCA (Regulation (EU) 2023/1114, the EU’s single rulebook for crypto-assets) gives ESMA three concrete jobs:

  • The central register. Articles 109 and 110 MiCA require ESMA to publish, by 30 December 2024, a central register of crypto-asset white papers, authorised crypto-asset service providers (CASPs — firms offering exchange, custody, brokerage, advice, etc.), issuers of asset-referenced and e-money tokens, and non-compliant entities (firms ESMA flags as operating without authorisation). The interim register is refreshed weekly (ESMA).
  • The technical standards. ESMA developed the RTS/ITS packages covering authorisation, investor protection, market-abuse detection and operational resilience.
  • What it does not do. It does not authorise CASPs (NCAs do, under Article 93), it does not supervise asset-referenced / e-money tokens (ART/EMT — euro- or asset-backed stablecoins) prudentially (that significant-issuer role sits with the EBA), and it does not impose the fines — national regulators do. ESMA is the rule-writer and the register-keeper, not the enforcer.

For the wider MiCA picture — who needs a licence, the rollout dates, the penalties — see the MiCA pillar.

ESMA’s role under DORA

ESMA is one of the three European Supervisory Authorities (ESAs) — with the EBA and EIOPA — that run DORA (Regulation (EU) 2022/2554, the EU’s ICT operational-resilience law for finance). DORA applies to 21 types of financial entity; 12 of those fall in ESMA’s remit (ESMA).

DORA’s headline novelty is direct EU oversight of critical ICT third-party providers (CTPPs — the cloud and tech suppliers the financial system depends on, e.g. the hyperscale clouds). The ESAs jointly designate which providers are “critical” under Article 31 DORA and run the oversight through a Lead Overseer model and a Joint Committee, with joint examination teams drawing staff from all three ESAs. The first list of designated CTPPs — 19 providers — was published by the ESAs’ Joint Committee on 18 November 2025. For the full DORA picture see the DORA pillar.

ESMA vs EBA vs the national regulators — who does what

These three are constantly conflated. The clean split:

  • ESMA — securities markets and the crypto rulebook + the MiCA register + supervisory convergence. Writes the rules, lists who is authorised, does not licence or fine.
  • EBA (European Banking Authority) — banking, and under MiCA the prudential supervision of significant asset-referenced and e-money token issuers (the big stablecoins).
  • National competent authorities (NCAs) — one per Member State (AMF in France, BaFin in Germany, etc.). They authorise CASPs, supervise them day-to-day, and impose the fines. This is the level a crypto firm actually deals with.

So “is crypto regulated at EU or national level?” — the answer is both, by design: EU-level rulebook and register (ESMA), EU-level stablecoin prudential supervision (EBA), national-level licensing and enforcement (NCAs).

Leadership

ESMA is run by a Chair (the public-facing head, who also chairs the Board of Supervisors — the body of all national regulators) and an Executive Director (who runs the organisation day to day).

  • Chair: Verena Ross. Appointed Chair in 2021. Her term ends on 31 October 2026; she has confirmed she will not continue beyond it, and ESMA has begun selecting a successor (ESMA).
  • Executive Director: Natasha Cazenave. In post since 1 June 2021. The Board of Supervisors renewed her mandate on 7 October 2025 for a second five-year term (ESMA).

Day-to-day, ESMA’s decisions are taken by the Board of Supervisors, made up of the heads of the 27 national regulators (ESMA senior management).

What this means for you

  • If you are a crypto firm seeking a MiCA licence: you apply to, are supervised by, and are fined by your national regulator (NCA) — not ESMA. ESMA’s relevance to you is the rulebook you must meet and the public register you will appear in (or be listed on as non-compliant if you operate without authorisation).
  • If you are a financial entity under DORA: ESMA is one of your three ESAs; if you rely on a provider that gets designated a critical ICT third-party, that provider comes under EU-level oversight ESMA helps run.
  • If you are checking whether a crypto service is legitimate: ESMA’s MiCA register is the authoritative EU-wide place to look — including its non-compliant-entities list.
  • If you are a journalist or researcher: when a crypto firm says “we’re MiCA-regulated”, the licence is national; ESMA’s register tells you which NCA, when, and for which services.

TL;DR

ESMA is the EU’s securities-markets authority and, under MiCA, the crypto rule-writer and register-keeper — not the licensing or fining body (that is the national NCAs, with the EBA handling significant stablecoins). Under DORA it is one of the three ESAs jointly overseeing critical ICT third-party providers. It was established by Regulation (EU) No 1095/2010, operational since 2011, based in Paris. Chair Verena Ross steps down at the end of her term on 31 October 2026; Executive Director Natasha Cazenave was renewed for a second term in October 2025.

Sources