EBA's Proposed Fine Methodology for Significant ART and EMT Issuers Under MiCA

Key facts

Why the EBA — Not Your National Regulator — Is Enforcement Authority

Under MiCA, supervisory authority is not static. Once the EBA formally classifies a token as significant — applying the criteria in Article 43 (for ARTs) or Article 56 (for EMTs), which require a token to meet at least three of the listed quantitative and qualitative thresholds — supervisory and enforcement competence transfers from the issuer's home national competent authority (NCA) to the EBA. That handover happens within 20 working days of the significance decision becoming effective. From that point, it is the EBA, not a national regulator, that monitors compliance, requests information, conducts on-site inspections, and imposes fines.

The NCA sanction regime under Article 111 MiCA — which sets fine ranges including at least €700,000 for natural persons and at least €5,000,000 for legal persons — is a separate framework that applies to issuers of non-significant ARTs and EMTs. It is not the enforcement mechanism that governs s-ART and s-EMT issuers. Once the EBA assumes direct supervision, the Article 111 NCA track no longer applies to the supervised entity for matters within the EBA's remit. Conflating the two regimes is a common compliance error with real consequences for how teams assess their exposure.

The procedural rules for how the EBA exercises its fine-imposing powers are already in force under Commission Delegated Regulation (EU) 2024/1504, which covers procedural safeguards, rights of defence, and enforcement mechanics. What has been missing until now is a published substantive methodology — how the EBA actually calculates the fine amount. EBA/CP/2026/10 is designed to fill exactly that gap, proposing a structured two-step method for translating a breach into a specific euro figure. It applies exclusively to issuers of significant ARTs and significant EMTs; it does not cover CASPs (who remain subject to NCA oversight under Title V MiCA) and does not affect non-significant token issuers.

The Article 43 Significance Thresholds That Trigger EBA Supervision

Under Article 43(1) MiCA (Regulation (EU) 2023/1114), a token is classified as significant — and its issuer transferred from national competent authority supervision to direct EBA oversight — when it meets at least three of the criteria listed in that article. The same criteria apply to significant e-money tokens by virtue of Article 56 MiCA, which incorporates the Article 43 framework by reference. Classification is not self-assessed: the EBA makes the determination and notifies the issuer accordingly. Once classified, the issuer has 20 business days to acknowledge the decision, and EBA supervisory jurisdiction follows automatically.

The following list is illustrative, not exhaustive — Article 43(1) contains additional qualitative criteria that issuers must review in the full legislative text. The most operationally significant criteria include: (a) the number of holders exceeds 10 million; (b) the value of tokens issued, market capitalisation, or size of the reserve of assets exceeds €5 billion; (c) the average number of daily transactions exceeds 2.5 million and the average daily aggregate value exceeds €500 million — these are a single combined criterion, not two alternatives; (d) the issuer is designated as a gatekeeper provider of core platform services under Regulation (EU) 2022/1925 (Digital Markets Act); (e) the token has significant cross-border or international reach, or is materially interconnected with the broader financial system. Additionally, Regulation (EU) 2024/1620 establishing the Anti-Money Laundering Authority (AMLA) has already been enacted — AMLA as an institution will become fully operational on a phased timeline, but the legal basis is not forthcoming: it is in force.

Projects that sit close to any two thresholds should model the third proactively — not reactively. A token can cross into significance quickly during a bull market or following a major exchange listing, and the compliance obligations that attach at that point (direct EBA supervision, enhanced own-funds requirements, liquidity rules, and exposure to the fine methodology in EBA/CP/2026/10) are materially heavier than those that apply to non-significant issuers. Reviewing the full text of Article 43(1), including qualitative criteria not listed above, is essential for any issuer with a token that is scaling toward these thresholds.

Statutory Fine Ceilings Under Article 131(3) and (4)

Article 131(3) and (4) MiCA establish the upper bounds on any fine the EBA can impose on a significant ART or EMT issuer. The default ceiling is expressed as a share of the issuer's total annual turnover in the last completed business year: 12.5% for significant ART issuers and 10% for significant EMT issuers. This is the figure the EBA works against in the ordinary case — it caps the basic amount produced by Step 1 of the methodology before any adjustments are applied. If the basic amount already sits below that ceiling, the percentage plays no role; it only bites when the calculated figure would otherwise exceed it.

A separate profits-based ceiling can substitute for the turnover percentage, but only under a specific condition: the EBA must first be able to determine, with sufficient certainty, the profits gained or losses avoided as a result of the infringement, and those profits must exceed the applicable turnover percentage. Where both conditions are satisfied, the final fine is capped instead at twice those profits or losses avoided. This is not a free election between two alternatives — the EBA cannot simply choose whichever ceiling is numerically higher. The profits-based ceiling is a conditional carve-out that applies when the economics of the breach are quantifiable and the profit exceeds the default limit; in all other cases, the turnover percentage governs. EBA/CP/2026/10 reproduces this structure faithfully from the Level 1 text.

The Draft Two-Step Fine Calculation Methodology

EBA/CP/2026/10 — published in June 2026 and open for consultation until 28 September 2026 — sets out a proposed two-step methodology for calculating fines against issuers of significant ARTs and significant EMTs. This is a draft proposal, not finalised law. The EBA may revise the approach materially in response to industry submissions before any final methodology is adopted. Compliance teams should track it, but should not treat current figures as settled.

Step 1 establishes the basic amount. The EBA first identifies which infringement from Annex V (for ART issuers) or Annex VI (for EMT issuers) has been committed, then assigns it to one of three severity categories. Category 1 covers breaches of substantive prudential and reserve-asset obligations — the rules most directly protecting token holders. Category 2 covers organisational, governance, and disclosure failures. Category 3 covers obstruction of the EBA's supervisory function itself — including failures to cooperate, provide information, or submit to on-site inspections — and the draft proposal treats this as carrying the highest relative severity, because it undermines the supervisory system as such. Each category maps to a starting percentage range within the statutory ceiling, producing a basic amount before any adjustment. The consultation paper is specific about these ranges; because they remain subject to change, compliance teams should consult the published CP directly rather than rely on any secondary summary.

Step 2 adjusts the basic amount upward or downward. Aggravating factors include: repeated or continuing infringements, direct involvement of senior management or members of the management body, evidence of intentional misconduct, measurable harm to retail token holders, and any active obstruction of supervisory proceedings. Mitigating factors include: voluntary cooperation with the EBA, prompt remediation of the breach, first-time infringement with no prior supervisory record, and self-disclosure before the EBA initiated its inquiry. After applying those adjustments, the draft methodology allows the EBA to make a further discretionary adjustment to ensure the final amount is proportionate to supervisory and consumer-protection objectives — or to ensure it is not lower than any benefit derived from the breach. The adjusted figure is then checked against the statutory ceiling under Article 131(3) and (4) and reduced if necessary.

Three Proposed Severity Categories for Annex V and VI Infringements

EBA/CP/2026/10 proposes grouping all infringements listed in Annexes V and VI of MiCA into three severity categories. The categorisation is the EBA's attempt to create a principled starting point for the base amount calculation in Step 1 of the two-step methodology. This classification is a draft proposal open for public consultation until 28 September 2026. Question 1 of the consultation paper explicitly invites stakeholder comment on whether the proposed distribution across categories is appropriate and proportionate. Nothing in this section should be read as settled supervisory law — the final methodology may differ materially from what is described here.

The EBA's rationale for treating Category 3 as relatively most severe in the draft is that obstructing supervision undermines the entire enforcement framework — without supervisory access, no other rule can be effectively applied. That logic is coherent, but it is still a proposal under consultation, not a binding determination. For issuers building internal escalation matrices or mapping Annex V and VI obligations to risk scores, it is prudent to track both the draft classification and any revisions published after the consultation closes. Treat the three categories as indicative guidance for now, and revisit once the EBA publishes the finalised methodology — expected in late 2026 or early 2027.

Personal Liability of Management Body Members Under Article 131(1)

Article 131(1) MiCA gives the EBA authority to impose fines not only on the issuing legal entity but also directly on individual members of the management body who negligently or intentionally committed an infringement catalogued in Annex V or Annex VI. This is a critical structural feature of the EBA's supervisory toolkit for significant tokens: personal accountability follows the institution. The EBA does not need to establish that the firm itself was at fault — if a director personally authorised a misleading disclosure or failed to act when action was required, they can face a separate fine alongside any sanction levied on the entity.

The same two-step methodology described in EBA/CP/2026/10 applies to individuals. There is no separate statutory minimum floor for natural persons under Article 131 or in the draft methodology for EBA-supervised significant issuers. The base amount is determined by severity category and adjusted upward or downward for aggravating and mitigating factors — exactly as for the legal entity. This is where a common misreading creates real risk. The figures that frequently appear in MiCA commentary — €700,000 for natural persons and €5,000,000 for legal persons — come from Article 111 MiCA, which governs sanctions imposed by national competent authorities (NCAs) on non-significant ART and EMT issuers, and on CASPs. Article 111 does not govern EBA enforcement against significant token issuers. Conflating the two leads to a materially wrong picture of the exposure facing executives at large stablecoin projects.

In practice, this distinction matters most for chief executives, chief financial officers, and board members of issuers that have been — or are at risk of being — classified as significant under Article 43 MiCA. Once the EBA holds direct supervisory jurisdiction, the NCA Article 111 framework no longer sets the relevant ceiling for personal fines; the EBA's own two-step calculation does, subject to the statutory caps in Article 131(3) and (4). Senior managers at significant token issuers should ensure their D&O insurance policies and internal governance frameworks are calibrated to this EBA-specific personal liability regime, not to the NCA-facing Article 111 figures. For a broader picture of ongoing obligations that can generate Annex V and VI exposure, see our guide on MiCA CASP ongoing obligations post-authorisation.

What EBA/CP/2026/10 Means for Your Compliance Programme

EBA/CP/2026/10 is a consultation paper, not yet binding law — but its two-step methodology signals clearly how the EBA intends to exercise its Article 131 enforcement powers once the methodology is finalised. Significant ART and EMT issuers should treat the draft as actionable now. Five areas demand immediate internal attention.

• Map your Annex V and VI exposure. The severity tier attached to each infringement type drives the starting percentage in Step 1. Category 3 breaches — those that undermine the supervisory system itself, such as obstructing EBA inspections or providing false information — carry the highest multipliers in the proposed methodology. Identify every obligation in Titles III and IV of MiCA that your organisation has not yet fully operationalised and cross-reference it against the Annex V and VI lists.
• Audit management body accountability. Under Article 131(1), the EBA can impose fines directly on members of the management body where a breach is committed intentionally or negligently. The same two-step methodology applies to individuals as to the issuing entity. Governance frameworks, decision logs, and escalation trails are now evidence, not just internal process.
• Build a turnover-tracking mechanism. The default statutory ceiling is 12.5% of annual turnover for significant ART issuers and 10% for significant EMT issuers. Take your prior-year total business turnover and calculate both figures as a baseline for your maximum fine exposure under Article 131(3)/(4). Where EBA can quantify profits gained from the infringement, a separate ceiling of twice those profits may apply instead — but only where that figure is determinable. Know both numbers before an investigation begins.
• Review conflicts-of-interest and governance policies. Ensure your policies reflect the procedural framework in Commission Delegated Regulation (EU) 2024/1504 (procedural rules for EBA fines) and the significance criteria codified in Commission Delegated Regulation (EU) 2024/1506. Reference only confirmed delegated acts when aligning internal documentation — do not cite regulation numbers you cannot verify against EUR-Lex.
• Respond to EBA/CP/2026/10 by 28 September 2026. The severity tiers, percentage bands, and aggravating factors proposed in the consultation are not final. Industry submissions directly influence the outcome. If the proposed Category 1 percentage feels disproportionate for technical reporting failures, say so — with data.

For a structured view of where your token and your obligations sit within the MiCA framework, see our guides on MiCA compliance deadlines and ongoing post-authorisation obligations. The content in this section describes regulatory concepts derived from publicly available consultation documents and does not constitute legal advice. Firms should obtain independent legal counsel before making compliance decisions based on draft EBA methodology.

How to Engage With the Consultation Before 28 September 2026

The EBA consultation on its proposed fine methodology closes on 28 September 2026. Submissions are made directly through the EBA's online consultation platform at eba.europa.eu — respondents upload a structured response addressing the specific questions set out in EBA/CP/2026/10. There is no fee and no minimum size threshold for participation; law firms, compliance teams, industry associations, and issuers themselves can all respond. A virtual public hearing took place on 16 July 2026, giving stakeholders an early opportunity to raise concerns before the written consultation closed. If you missed the hearing, the written submission process remains the primary channel.

The EBA is specifically seeking views on six areas: (Q1) whether the proposed severity classification of each infringement category is appropriate; (Q2) whether the percentage bands proposed for each category are proportionate; (Q3) whether the list of aggravating and mitigating factors is complete and correctly weighted; (Q4) the proposed coefficients used to adjust the basic fine amount in Step 2; (Q5) the flexibility mechanisms that allow the EBA to depart from the formula in exceptional circumstances; and (Q6) how the statutory maximums under Article 131(3) and (4) — the 12.5%/10% turnover ceilings and the twice-profits alternative — should interact with the methodology's output. Responses addressing Q2 and Q3 in particular are likely to have the most practical effect on outcomes for issuers, since these govern the fine amounts and adjustments most directly.

After the consultation period closes, the EBA will review submissions, publish a feedback statement, and issue a finalised methodology. Until that document is published, every severity tier, coefficient, and percentage in EBA/CP/2026/10 remains a proposal subject to change — plan your compliance programme against the current draft, but do not treat it as settled law. If you are still assessing whether your token meets the Article 43 significance thresholds that bring you within EBA supervision in the first place, start with a structured scoping review: Compliora's regulatory assessment tool helps issuers map their classification exposure before engaging with the fine methodology. You may also find our analysis of token taxonomy under MiCA and Title VI market-abuse obligations useful context when preparing your consultation response.

Frequently asked questions

Which token issuers does EBA/CP/2026/10 apply to?

EBA/CP/2026/10 applies only to issuers of significant asset-referenced tokens (s-ARTs) and significant e-money tokens (s-EMTs) — entities the EBA has formally classified as significant under Articles 43 and 56 of MiCA. It does not apply to CASPs or to issuers of non-significant ARTs/EMTs, which remain subject to NCA enforcement under Article 111 MiCA.

What is the maximum fine the EBA can impose on an s-ART issuer?

Under Article 131(3) of MiCA, the default maximum fine for an s-ART issuer is 12.5% of the issuer's total annual turnover in the last business year. A higher ceiling — twice the profits gained or losses avoided — applies only if the EBA can determine those profits and they exceed 12.5% of turnover. These are not freely interchangeable alternatives: the profits-based ceiling is a conditional exception, not a standard option.

Can individual directors or executives be personally fined by the EBA?

Yes. Article 131(1) of MiCA allows the EBA to impose fines on members of the management body of a significant token issuer who negligently or intentionally committed an infringement listed in Annex V or VI. The EBA's proposed two-step methodology in EBA/CP/2026/10 applies to individuals under the same framework as to the issuing entity — there is no separate statutory minimum fine floor for natural persons in Article 131 EBA proceedings.

When will the EBA's fine methodology become final?

EBA/CP/2026/10 is a draft consultation paper. The comment period closes on 28 September 2026, after which the EBA will review responses and publish a final methodology. Until it is finalised, the severity tiers, percentage coefficients, and aggravating/mitigating factors described in the consultation paper remain proposals subject to change.

What is the difference between Article 111 and Article 131 MiCA fines?

Article 111 sets the administrative penalty powers of national competent authorities (NCAs) for MiCA infringements — this includes fine floors of €700,000 for natural persons and €5,000,000 for legal persons. Article 131 is the separate provision empowering the EBA to fine significant token issuers and their management bodies. These are distinct enforcement regimes: NCAs handle non-significant issuers; the EBA handles significant ones.

Does EBA/CP/2026/10 affect CASPs?

No. EBA/CP/2026/10 does not apply to crypto-asset service providers (CASPs). CASP authorisation and enforcement sit primarily with NCAs under Title V of MiCA. The EBA methodology in this consultation is scoped exclusively to issuers of s-ARTs and s-EMTs — entities issuing large stablecoins that cross the Article 43 significance thresholds.