The European Securities and Markets Authority (ESMA) has identified outstanding regulatory arrangements in Poland and Romania in its latest compliance table on market-abuse supervision under the Markets in Crypto-Assets Regulation (MiCA).
Poland is listed as non-compliant by default because it has yet to designate a competent authority, while Romania also has outstanding national implementation arrangements. The Central Bank of Cyprus remains classified as intending to comply despite a stated September target, and Hungary reports further work on its internal market-surveillance procedures.
The findings, set out in ESMA's compliance table dated 21 October 2026, contrast with the positions of most EU regulators, which report compliance with the guidelines. The remaining issues concern national supervisory arrangements rather than findings of misconduct in crypto-asset markets.
Poland is listed as non-compliant by default because the competent authority responsible for the guidelines has not yet been designated. ESMA's table does not identify an authority or provide an expected date for the designation.
Romania is also listed without a designated competent authority. ESMA's table states that national implementation arrangements for MiCA remain outstanding and that no implementation date has been provided. The entry does not identify an authority responsible for applying the market-abuse guidelines.
The positions recorded for Poland and Romania concern unresolved national regulatory arrangements rather than findings that identified supervisory authorities have refused to follow ESMA's guidelines. The compliance table does not quantify any financial consequences arising from either country's position.
Cyprus has two authorities listed in the document, with different reported compliance positions. The Cyprus Securities and Exchange Commission (CySEC) is marked as complying, while the Central Bank of Cyprus (CBC) remains classified as intending to comply.
The central bank's entry states that it intended to comply by 30 September 2026 in its capacity as the competent authority for market-abuse supervision under MiCA for electronic money institutions and payment institutions. The explanation refers to the absence of an expressed intention among regulated entities to begin the relevant activities.
Although the October table continues to display an intention-to-comply classification after the stated target date, it does not establish whether implementation was subsequently completed or whether the circumstances described in the notification remain applicable. ESMA's explanatory note states that an authority continuing to intend to comply after the guidelines' application date will generally be considered non-compliant, subject to specified exceptions. These include situations where the relevant institutions or instruments do not exist in the jurisdiction or where necessary legislative or regulatory proceedings have begun.
Hungary's central bank, Magyar Nemzeti Bank (MNB), is classified as complying with ESMA's guidelines, although its accompanying explanation identifies additional internal implementation work. According to the table, MNB Deputy-Governor Order No. 2026-250, covering market-surveillance procedures, has been adopted and entered into force.
The authority states that these rules support the implementation of ESMA's guidelines for crypto-assets. Full implementation is expected following an amendment to MNB Deputy-Governor Order No. 2023-248, which concerns procedures for managing market-surveillance reports and detections. ESMA records that the amendment was in its final phase as of 12 October 2026.
The table records compliance classifications of Yes for authorities including Germany's Federal Financial Supervisory Authority (BaFin), France's Autorité des Marchés Financiers (AMF), Spain's Comisión Nacional del Mercado de Valores (CNMV) and the Central Bank of Ireland. Ireland's entry also refers to the development of MIDAS, a centralised European crypto-asset surveillance tool, and confirms the bank's involvement in the project.
Other authorities, including Italy's CONSOB, Belgium's Financial Services and Markets Authority and the Netherlands' Authority for the Financial Markets, are also marked as complying. The document separately covers three European Economic Area countries outside the EU, listing Iceland's central bank as having provided no response while the competent authorities in Liechtenstein and Norway are marked as complying.
Under Article 16(3) of the ESMA Regulation, national competent authorities must notify ESMA whether they comply or intend to comply with its guidelines. Authorities that do not comply or do not intend to comply must explain their reasons, allowing ESMA to publish an overview of national implementation positions.
The October table highlights differences in how regulators have incorporated the MiCA market-abuse guidelines into their supervisory arrangements. While most authorities report compliance, the entries for Cyprus, Hungary, Poland and Romania show that national implementation remains uneven, particularly in the designation of competent authorities and the completion of internal supervisory procedures.
ESMA's assessment relies on information submitted by national regulators rather than an independent examination of their supervisory effectiveness. The table therefore provides a record of reported compliance positions, but does not establish whether those arrangements have improved the detection or prevention of market abuse across EU crypto-asset markets.
