European regulator ESMA criticizes Maltese authorities after issuing licenses to OKX, Gemini, and CryptoCom

What’s new? The European Securities and Markets Authority (ESMA) has conducted an inspection of the Malta Financial Services Authority (MFSA), which has issued OKX, Gemini, and CryptoCom licenses since the start of 2025, allowing the crypto exchanges to operate in the EU under the Markets in Crypto-Assets (MiCA) regulation. The inspection focused on the authorization process and subsequent oversight of the unnamed crypto service provider.

Bloomberg’s material

What else is known? ESMA criticized Malta’s hasty decision to grant the license because the service provider had not addressed a number of significant “material issues.”

The review also looked at the MFSA’s response to developments since the issuance of the license, including an assessment of whether the exchange was still compliant with the terms of the license.

OKX, which is registered in Seychelles, received provisional approval from the MFSA to operate under MiCA in January. A month later, the exchange pleaded guilty to processing more than $1 trillion worth of US customer transactions without a license and paid $500 million in fines.

As for Gemini and CryptoCom, EU regulators have not accused them of breaking the rules this year. Gemini only has in-principle approval from Malta so far, while OKX and Crypto.com already have full licenses to operate in the EU.

In March, European regulators began looking into OKX’s role in laundering funds from crypto exchange Bybit. Thus, through the aggregator of decentralized exchanges, OKX passed part of the $1,5 billion stolen by North Korean hackers from Bybit in February 2025.

In connection with this, OKX suspended the service. It resumed operations in May with several new features, including a real-time abuse detection and blocking system.

Those involved in the investigation called on ESMA and the MFSA to take action against OKX, including possible license revocation.

In April, Malta’s FIU fined OKX’s European unit, Okcoin Europe, 1,1 million EUR due to multiple violations of AML laws in previous years. It was noted that OKX had previously failed to conduct risk assessments when connecting some customers.

Back then, the exchange said it had “implemented a comprehensive compliance program” over the past two years and had taken “proactive measures to address the identified issues.”

In a July 10 statement, MFSA officials said that their activities are “largely meeting expectations with respect to the practical implementation” of MiCA. It is emphasized that the directorate takes into account ESMA’s recommendations for further improvements.

In turn, ESMA said that the Maltese regulator did not adequately assess previous and ongoing enforcement actions against the unnamed exchange when approving the license.

ESMA officials identified shortcomings in the approval process, including assessments of client connectivity processes, risks of using Web3 services, asset custody conditions, and the exchange’s ability to comply with AML regulations.