ESMA makes tokenisation and artificial intelligence a supervisory priority for EU regulators from 2027
Updated: 6 days ago
The European Securities and Markets Authority has told national regulators across the European Union to start examining how financial firms use tokenisation and artificial intelligence. In a statement published on 23 September 2026 the authority, known as ESMA, set a new Union Strategic Supervisory Priority on digital innovation. It begins in 2027.
A Union Strategic Supervisory Priority is a coordination device, not a rule. ESMA writes no new requirement when it sets one. It points the supervisory resources of the national competent authorities, the domestic regulators that actually inspect firms, at a single subject, then checks that they are all looking at it in a comparable way. The existing priority, on cyber and operational resilience, has run since 2025. The one on environmental, social and governance disclosures, which started in 2023, is being wound up as this one starts.
The new priority opens with two technologies, artificial intelligence and tokenisation, and ESMA has said the wording is deliberately broad enough to absorb whatever arrives next. The work is mapping first and inspection second. Supervisors are to identify where tokenisation is emerging and to document how firms use, or plan to use, both technologies in products and processes that reach investors directly. Initial compliance checks then run on a subset of the most affected firms. The emphasis is on customer-facing use rather than back-office systems, and supervisors will look at governance, at the reliability of the data these systems run on, and at the outcomes customers actually get.
The risks ESMA named are specific rather than atmospheric: biased or misleading outputs from AI systems, products investors may struggle to understand, and dependence on a small number of third-party providers. The authority said firms are increasingly using AI and tokenised products in day-to-day financial services to gain market share, and that the benefits of the technology arrive with risks attached.
Where the UK sits
Nothing in the statement mentions the United Kingdom, and ESMA has no jurisdiction over a firm regulated only in London. A British tokenisation business comes into scope through an EU entity or an EU licence, and then only for what that entity does. If a UK company sells into the European Union through a subsidiary in Dublin, Paris or Amsterdam, that subsidiary can expect to be asked, from 2027, to show how it governs a tokenisation product and what it tells customers about it.
The contrast with the UK approach is worth noticing, because the two regulators are working the same subject from opposite ends. Nikhil Rathi, the FCA chief executive, told a TheCityUK dinner on 22 September 2026 that the industry wants to move from experimentation to adoption, and pointed to a joint tokenisation roadmap with the Bank of England running from testing environments to established market infrastructure. That is a programme about enabling. ESMA's is a programme about inspecting. Neither is wrong, and they are not in competition, but a firm operating on both sides of the Channel will be asked different questions in each place.
What has not been decided
ESMA has not published the criteria that will decide which firms count as most affected, has not said what supervisors will ask for, and has not issued a reporting template. The statement carries no figures and no target for how many firms will be inspected. The FCA has not said whether it will set a comparable supervisory focus of its own, and no equivalent priority has been announced for UK firms.
There is a sequencing problem worth stating plainly. Most tokenisation inside regulated firms is still at pilot stage, and a supervisory priority that lands in 2027 will reach processes that have not finished being built. Evidence of governance is easier to produce inside a large institution with a compliance function than inside a small authorised firm running one experiment. Investor protection is the right reason to look early, and looking early is cheaper than unwinding harm later, but the effect at the margin is to raise the cost of a small pilot in a regulated wrapper. Whether that pushes EU tokenisation work towards incumbents, or simply towards firms that document properly, is the thing to watch through 2027.
The wider European picture is moving at the same time. Central banks across Europe are pressing for tighter stablecoin rules in the review of the markets in cryptoassets regulation, which sets the ground rules for the settlement leg of many tokenised transactions.
How we got here
ESMA describes Union Strategic Supervisory Priorities as convergence tools aimed at high-risk areas of strategic importance across the EU. The stated aim of the new one is to help national supervisors build the expertise and capacity to oversee new technologies while protecting investors. ESMA has not published an end date. The cyber and operational resilience priority will run alongside it, and ESMA has said that work will also cover challenges from advanced models such as frontier AI.
Supervision is only one track. On the legislative side, the European Commission's market integration package proposes changes to the DLT Pilot Regime, the EU framework for trading and settling tokenised securities. According to William Fry, the proposals would replace instrument-specific limits with a single aggregate cap of 100 billion euros, create a lighter regime for operators servicing instruments worth up to 10 billion euros, remove time limits on authorisations, and task ESMA and the European Banking Authority with further rules on settlement finality in DLT systems. The proposals still have to pass through the EU legislative process.
What it means for UK founders
The timing overlaps with the UK calendar. The FCA authorisation gateway for cryptoasset firms opened on 30 September 2026, its application period closes on 28 February 2027, and the new UK regime commences on 25 October 2027. A UK founder with an EU subsidiary could be preparing an FCA application and answering EU supervisory mapping questions in the same year.
ESMA has already said what supervisors will look at: governance, the reliability of underlying data, and customer outcomes. Founders running tokenised products through an EU entity can keep a dated record of who approved each product, which data sources it relies on and what customers are told, so that evidence exists before anyone asks for it. Founders may want to take professional advice on whether their EU activity falls within the scope of national supervisors.
Key facts at a glance
ESMA announced the digital innovation priority on 23 September 2026, starting in 2027.
Initial focus: how supervised entities use artificial intelligence and tokenisation. No end date has been published.
The ESG disclosures priority, launched in 2023, is being concluded in 2026.
The cyber and operational resilience priority, in place since 2025, continues alongside it.
Proposed DLT Pilot Regime changes include a 100 billion euro aggregate cap and no time limit on authorisations.
Further reading
Frequently asked questions
What is ESMA's new supervisory priority on digital innovation?
In a statement published on 23 September 2026, the European Securities and Markets Authority set a new Union Strategic Supervisory Priority on digital innovation. It begins in 2027 and opens with two technologies, artificial intelligence and tokenisation.
Does the ESMA supervisory priority create new rules for tokenisation?
No. A Union Strategic Supervisory Priority writes no new requirement. It directs the supervisory resources of national competent authorities at a single subject and checks that they examine it in a comparable way.
What will EU regulators check under ESMA's tokenisation and AI priority?
Supervisors will first map where firms use, or plan to use, AI and tokenisation in products and processes that reach investors directly, then run initial compliance checks on a subset of the most affected firms. They will look at governance, the reliability of the underlying data and the outcomes customers get.
What risks has ESMA identified in AI and tokenised financial products?
ESMA named biased or misleading outputs from AI systems, products investors may struggle to understand, and dependence on a small number of third-party providers.
Does the ESMA tokenisation priority apply to UK firms?
ESMA has no jurisdiction over a firm regulated only in London. A UK tokenisation business comes into scope only through an EU entity or EU licence, and then only for what that entity does. The FCA has not announced a comparable supervisory focus for UK firms.
This is general information, not legal, tax or investment advice.
Key takeaways
ESMA set a new Union Strategic Supervisory Priority on digital innovation on 23 September 2026, starting in 2027 and opening with artificial intelligence and tokenisation.
It changes no rules. It directs national regulators to map where firms use these technologies with customers, then run compliance checks on the most affected firms.
Named risks are biased or misleading AI outputs, products investors may not understand, and reliance on a small number of third-party providers.
UK firms fall in scope only through an EU entity or licence, and the FCA has not announced a comparable supervisory focus.
ESMA has published no criteria for which firms will be inspected and no reporting template.
Sources
European Securities and Markets Authority, "ESMA sets new supervisory priority on digital innovation from 2027", 23 September 2026. Cointelegraph, "ESMA to prioritize AI and tokenization oversight in 2027", 23 September 2026. CoinDesk, "European watchdogs prepare direct oversight of AI and tokenization in retail finance", 24 September 2026. Financial Conduct Authority, Nikhil Rathi, "Building the next generation of market infrastructure", speech delivered 22 September 2026, published 23 September 2026.
Comments