ESMA put both its supervisory slots on technology and closed the ESG one

The European Securities and Markets Authority will make AI and tokenization the first focus of a new supervisory priority on digital innovation, starting in 2027. National supervisors will map where tokenization is emerging, document how firms use both technologies in products that reach investors, and run initial checks on a subset of the most affected firms. The mechanics of the calendar say more than the announcement does.

Three numbers frame it:

• ESMA sets up to two Union Strategic Supervisory Priorities every three years.
• Both slots are now technology: cyber and operational resilience, launched in 2025, and this one from 2027.
• The environmental, social and governance priority is being closed this year.

Read those together and this is an allocation decision, not a statement of concern. ESMA has two strategic slots, it fills them once every three years, and it has now put both on technology risk while retiring the one on sustainability disclosure. Whatever else happens in European securities supervision between now and the end of the decade, these are the two things the bloc has committed its coordinated attention to.

“Biased or misleading AI outputs, products investors may struggle to understand, and reliance on a limited number of third-party providers.”

— ESMA, Union Strategic Supervisory Priority factsheet, via Cointelegraph

ESMA, on the risks named in the priority's factsheet

The risk that already has numbers

The third item on that list is the one with numbers already attached. Concentration among a small number of providers is not a forecast in crypto markets, it is the current state: one venue handles 20.75% of volume across the 50 largest exchanges, and on the US ETF side three funds took 98.7% of a single day's net inflow this week. We measured the venue side in detail, and the picture has not moved. ESMA is scheduling for 2027 a look at something already measurable in 2026.

Expectations should be set accordingly. Mapping where tokenization is emerging and checking a sample of firms is preparatory work. It produces supervisory expertise and common approaches, which matter later, and it produces no rules, no authorisations and no enforcement in 2027 by design. The priority runs alongside the cyber resilience one rather than replacing it.

Two regulators, two clocks

The contrast with the other side of the Atlantic is a matter of dates rather than philosophy. The US securities regulator opened a path for tokenized stocks six days ago, and yesterday a registered fund received permission for a tokenized share class. Those are live permissions. Europe's answer is a supervisory priority that begins in 100 days and starts by finding out what is already there. Neither approach is obviously right. They are simply running on different clocks, and firms choosing where to launch will read the difference.

Informational material, not investment advice. The priority begins in 2027 and describes supervisory mapping and sample checks, not new rules or enforcement actions.