Europe's crypto watchdog just stopped making rules and started enforcing them, and most of the market hasn't caught on yet.
ESMA Chair Verena Ross confirmed this week that the regulatory phase for MiCA has fundamentally shifted. The European Securities and Markets Authority is no longer focused on building the rulebook. It is now laser-focused on supervision, and it has three specific targets locked in: CASP operational resilience, outsourcing arrangements, and reverse solicitation abuse.
That last one deserves your full attention.
Reverse solicitation is the loophole that allowed non-EU crypto firms to serve European customers without a MiCA license, as long as the client made first contact. Regulators suspected from the start it would be exploited. ESMA is now treating it as a priority enforcement area, which means platforms that built their European strategy around that exemption are suddenly in a very uncomfortable position.
What ESMA Is Actually Watching
The supervisory focus breaks down into three pillars.
Resilience means ESMA wants to know whether CASPs, or Crypto Asset Service Providers, can actually withstand operational shocks. Think exchange outages during high-volatility events, cyberattacks, and liquidity crunches. Firms that outsourced their core infrastructure to third-party providers are going to face hard questions about who is actually responsible when things go wrong.
Outsourcing is the second pillar and it connects directly to resilience. If a licensed CASP is running on cloud infrastructure or custody solutions controlled by an entity outside the regulatory perimeter, ESMA wants a clear chain of accountability. No more hiding behind vendor agreements.
Reverse solicitation is the third pillar and the most politically charged. ESMA has already signaled that national regulators were interpreting this exemption inconsistently across member states. The new push for harmonized reporting is designed to close that gap and create a unified picture of which firms are actually operating inside the rules.
What This Means For Crypto Holders and Traders
If you are using a non-EU platform to access European markets, check whether that platform holds a MiCA license or is relying on reverse solicitation to serve you. That exemption is now under active scrutiny and firms leaning on it may face operational disruption if regulators move to restrict it.
For traders watching exchange risk, prioritize platforms that have pursued full MiCA licensing in major EU jurisdictions. The compliance gap between licensed and unlicensed operators in Europe is about to get a lot more expensive.
ESMA is no longer writing the test. It is grading it. Find out where your exchange sits before the scores come back.