The ESAs' 2027 work programme is not legislation. It is a statement of supervisory intent. But for a compliance function built around managing separate vendors for custody, liquidity, banking, and reporting, that intent should concentrate attention. The programme commits the three authorities to intensified coordination on digital operational resilience under DORA, cross-sectoral risk monitoring, and, critically, supervisory convergence across borders. The phrase appears throughout: "reducing overlapping requirements (including in reporting), fostering greater supervisory convergence."
For CASPs that secured authorisation before the July 2026 deadline, the operational question has shifted. Authorisation was the first gate. The second is whether your infrastructure can sustain the reporting and oversight coordination that European regulators are now building.
ESMA's own 2027 work programme, published two weeks earlier, spells out what that means for crypto firms specifically. The regulator will focus its MiCA supervisory convergence efforts on digital operational resilience, corporate substance in the EU, outsourcing risks, liquidity, reverse solicitation, and asset classification. It intends to harmonise the periodic reports CASPs file with national competent authorities and to develop common risk indicators and supervisory dashboards shared across regulators. A common supervisory action on custody resilience, launched in mid-2026, will produce a final report in 2027. ESMA's centralised market surveillance system for crypto, MIDAS, is expected to reach full operational status in 2027, with a second phase adding analytical capabilities.
The operational implication is straightforward: if your reporting flows through three or four vendors, a custody provider here, a liquidity source there, a separate banking partner, a bolt-on compliance tool, you are not building for the supervisory environment regulators are describing. You are building against it.
The supervisory direction became clearer still in late September when ESMA responded to the Commission's consultation on the MiCA review. ESMA explicitly called for stronger convergence tools and more effective supervision of cross-border risks. It flagged supervisory divergence as a threat to investor protection and market integrity, noting that the current framework gives rise to uncertainty and risks "fostering divergent interpretations and supervisory practices."
Behind that language sits a structural question that compliance teams cannot avoid: who supervises you, and how? The Commission's Market Integration and Supervision Package, proposed in December 2025, would transfer supervision of all CASPs from national competent authorities to ESMA. If adopted, ESMA becomes the single authorising body, the single ongoing supervisor, and the single enforcer of MiCA's market abuse provisions for every licensed crypto-asset service provider in the EU. The Council agreed in October 2026 on key elements of its negotiating position. The Parliament's ECON committee published draft reports in June 2026 that were, in several respects, more ambitious than the Commission's proposal.
The timing matters because infrastructure decisions are not reversible on regulatory timelines. Switching custody providers, re-papering banking relationships, or integrating a new reporting vendor typically runs 12 to 18 months from decision to live operation. If the supervisory architecture consolidates around ESMA by late 2027 or 2028, the window to act is now, not when the implementing regulations are published.
The DORA requirements compound the pressure. Since January 2025, CASPs have been subject to the full DORA framework, including ICT risk management, incident reporting, resilience testing, and third-party oversight. The ESAs designated the first 19 critical ICT third-party providers in November 2025, and oversight is now active. Every contractual arrangement with an ICT vendor must be documented in a Register of Information and reported annually. A fragmented vendor stack means a fragmented register, fragmented risk ownership, and fragmented accountability when the regulator asks who is responsible for an incident.
None of this is to say regulators are demanding consolidation. They are demanding coherence. But for most CASPs, coherence and consolidation point in the same direction.
The economics reinforce the argument. Industry estimates put first-year CASP authorisation costs between €350,000 and €900,000, with ongoing compliance costs, audits, monitoring tools, personnel, DORA readiness, running into the hundreds of thousands annually. A Deloitte survey found 64 percent of financial entities expected to spend €2 million to €5 million on DORA readiness alone. Every additional vendor relationship adds contract risk, onboarding time, and reporting coordination overhead. Those costs do not scale linearly when cross-border supervision becomes the norm.
The question compliance officers face is not whether the regulatory environment is tightening, it is. The question is whether your current infrastructure can absorb that tightening or whether it becomes the failure point.
Consider what the 2027 supervisory priorities mean in practice. Harmonised periodic reporting requires that the data you submit to your NCA, or, under MISP, to ESMA directly, is consistent, reconciled, and auditable. If your custody balances come from one system, your trading data from another, your fiat positions from a third, and your compliance flags from a fourth, you are not submitting a report. You are submitting a reconciliation exercise that your regulator must trust you performed correctly.
Operational resilience requirements mean demonstrating that you can maintain services during disruptions. If your custody provider goes down, your liquidity source is unreachable, and your banking partner is on a different incident-response protocol, your resilience is only as strong as the weakest link, and the supervisory burden of proving otherwise falls on you.
The ESAs' programme states that joint work will contribute to "reducing overlapping requirements" and "improving the usability and consistency of the EU regulatory framework." That is a signal to firms that regulators want simpler architecture to supervise, not more complex architecture held together by vendor SLAs.
The compliance teams that move first will not necessarily be the ones with the largest budgets. They will be the ones that recognised the structural question underneath the regulatory language: when supervision consolidates, fragmented infrastructure becomes a liability rather than a feature.
References
[1] European Supervisory Authorities, Joint Committee Annual Work Programme 2027, 13 October 2026
[2] European Securities and Markets Authority, 2027 Annual Work Programme, 28 September 2026
[3] European Commission, Market Integration and Supervision Package, 4 December 2025
