On 30 September 2026, ESMA — the EU’s securities and markets regulator — formally asked the European Commission to write stricter crypto advertising rules. Its language is unusually specific for a consultation response: safeguarding investors will require “stricter rules for the marketing of crypto-assets, particularly when they are promoted by influencers and third parties.”
Read that sentence as the agency running the spend, not as a headline. You are a third party. You promote crypto-assets on a client’s behalf, across accounts the client does not personally operate, using creative someone had to approve. ESMA has just told the Commission that the current framework does not fully cover what you do.
This is a proposal, not a rule. But it is the fourth time in nine weeks that a European financial regulator has pointed at the same layer — and the fourth time that the document doing the pointing contains no vocabulary for what a supervised firm is supposed to produce.
What ESMA actually asked for
The document is a response to the Commission’s consultation on the review of Markets in Crypto-Assets Regulation. ESMA published it under reference ESMA75-113276571-1721 on 30 September. It groups its investor-protection asks under three headings: stricter rules for the marketing of crypto-assets, greater transparency in costs, and proportionate requirements for staking, lending and borrowing.
The marketing ask is the one aimed at paid acquisition. ESMA’s own framing is that these are areas “where investors face risks that are not fully covered under the current framework.” Alongside it, ESMA asks for powers to “detect, block and deactivate fraudulent websites” and reinforced authority over “third-country firms which solicit EU investors without being authorised under MiCA.”
Note the shape of the ask. It is about who may promote, to whom, with what stated risk. It is not about what an agency has to be able to show afterwards. That distinction is the entire article.
Your agency is the third party
“Influencers and third parties” is doing a lot of work in one clause. An influencer is the obvious target: a person who is not the issuer, promoting an asset to an audience that trusts them. A third party is the wider set — affiliates, media buyers, performance agencies, anyone who places or produces the promotion without being the regulated firm.
A finance agency running paid social and Telegram funnels for a crypto exchange sits squarely in that set. So does the affiliate network it buys through, and the sub-affiliate that network has never met. Crypto promotion is structurally the hardest kind to attribute: creative is produced in one place, approved in another, uploaded into several ad accounts, and amplified by people who are not on the client’s payroll.
The fourth move in nine weeks
No single document here is a compliance deadline. Read together, they are a direction, and the direction has been consistent all quarter:
| Date | Instrument | What it says |
|---|---|---|
| 31 Jul 2026 | ESAs joint statement (JC 2026 25) | Financial entities should have “robust governance and risk management frameworks” for frontier-AI risk; use it as a “basis for supervisory dialogue.” |
| 23 Sep 2026 | ESMA USSP on digital innovation | A supervisory priority from 2027; initial focus on “how supervised entities use artificial intelligence and tokenisation.” |
| 25 Sep 2026 | FCA CFD crackdown | 21 CFD firms closed since 2025, 3 more cancelling, over misuse of UK authorisation — firms using it “as a badge to make linked overseas companies look more trustworthy.” |
| 30 Sep 2026 | ESMA MiCA review response | “Stricter rules for the marketing of crypto-assets, particularly when they are promoted by influencers and third parties.” |
Three themes — AI governance, supervisory attention on AI use, and the integrity of who is behind a promotion — are converging on the same operating layer. That layer is not the exchange. It is the agency.
Count the words the regulators didn’t use
Here is the part that is easy to miss when you read a press release for its headline. These documents are precise about the risk and silent about the artefact. That silence is measurable.
| Document | Governance vocabulary | Record vocabulary |
|---|---|---|
| ESMA MiCA review (30 Sep) | “marketing” ×1 · “influencer” ×1 · “third part*” ×1 | audit 0 · record 0 · approv* 0 · jurisdiction 0 · evidence 0 |
| ESAs frontier-AI statement (31 Jul) | “governance” ×5 · “frontier AI” ×7 · “risk management” ×1 | audit 0 · record 0 · approv* 0 · jurisdiction 0 · client 0 |
| ESMA USSP (23 Sep) | “artificial intelligence” ×1 · “tokenisation” ×1 · “frontier AI” ×2 | audit 0 · record 0 · approv* 0 · evidence 0 |
A regulator saying “governance” five times while never saying “record” is not an oversight. It is the boundary of the instrument. The rulebook can tell a firm that it must govern AI risk; it cannot carry the timestamped entry that proves which person approved which change on which client’s account. That has to exist inside the firm — or inside the agency acting for it.
This is the same gap we have documented across the vendor market all year, arriving from the other direction. Vendors sell the words; the regulators state the expectation; neither ships the artefact. Which leaves the agency holding a question it cannot currently answer.
What a “third party” promotion has to prove
Imagine the supervised-client conversation eighteen months from now. A supervisor asks about one promotion — not the campaign, one creative. Five questions follow, and none of them are about performance.
- Who placed it? A named person or entity, not the ad account that hosted it.
- On whose behalf? Which client engagement, and which licensed entity the promotion was made for.
- Who approved the wording? The claim as it shipped, signed off before it ran — not a version history in a chat thread.
- When, and in which jurisdiction? Promotion rules are national; a brand run across three markets is three compliance questions.
- What did the claim say at serve time? Not what the landing page says now.
Your ad platform answers none of these. It will tell you the creative was delivered 41,208 times at a cost of 84 pence each. It will not tell you who authorised the wording, because authorisation is not an event the platform records. Screenshots decay, spreadsheets rot, and an export you can only read by logging into the platform that produced it is a feature — not evidence.
The influencer case is where it breaks
Influencer promotion is the branch of this that most agencies have not wired up at all. The creative may be produced by the influencer, edited by the brand, approved informally, and posted from a personal account that never appears in the agency’s ad manager. The agency’s only involvement may be boosting it, or paying for it.
If ESMA’s ask becomes a rule, “it ran on their account” stops being an answer to “who promoted this?” The entity that paid for the reach is the entity with the record. And if that entity is your client, the record they will want is the one you hold.
What to do now
You do not need to wait for the Commission. Every item below is useful whether or not the ask becomes law, because it is the same record you would need for a chargeback dispute, a client audit or a platform appeal.
- Name the promoters. Write down every person and entity that can place or produce promotion for a crypto client — including affiliates and sub-affiliates. “The team” is not a name.
- Write the rule set down per brand. One brand, three markets, three rule sets. That belongs in the record, not in somebody’s memory.
- Record the approval where the copy is finalised. A single event — actor, timestamp, the value before and after — attached to the creative before it ships.
- Test the export. Pull one promotion’s full history without logging into the ad platform. If you cannot, you have a report, not a record.
- Keep a claims register. Which claim ran, for which client, from which date. It is the document the marketing-rules question is actually answered from. If you manage Telegram funnels, see how crypto exchanges run this on Ott.
Where Ott fits
Ott’s Activity Logging records the four fields a regulator-facing question resolves to: the actor, the value before and after, the timestamp, and the linked object. It is stored independently of the ad platform, so the answer survives a platform change, an account ban or a reporting outage. An MCP connection means an AI assistant working on your client’s accounts reads through the same structure rather than beside it.
Two limits, stated plainly. Ott is read-only — it records what happens in the accounts and in your operations; it does not write to ad platforms. And on coverage: Meta is connected today, with Google Ads on the roadmap, so an agency running this across four platforms is getting the record for the surface it uses most. We also publish no retention number, which is the same gap we hold vendors to — it is a limit, not a hidden detail.
The reason this matters for a question like ESMA’s is scope, not volume. Ott prices by brands and seats, and doesn’t charge per ad account, per data source or per Telegram join — so the number of accounts a crypto client adds does not change the cost of keeping the record. See what that looks like on the pricing page.
The rule is a proposal. The prep is not
ESMA’s marketing ask may be softened, redrafted or dropped in the Commission’s review. That is how reviews work, and nobody should plan a business around a paragraph in a consultation response. But the direction across these four documents is not in doubt: the EU and UK are moving toward a regime where the firm behind a promotion has to be able to say who was behind it.
For most crypto advertisers, that sentence is trivial — the exchange is the firm. For the agencies that place the spend, it is the moment a performance report stops being sufficient. The comparison we published on the SEC’s crypto-asset proposal made the same point from the US side: your ads become the evidence. ESMA is making it from the marketing side. Either way, the artefact is the same one.
You will be asked who approved a creative, in a jurisdiction, on a date, for a named client. That is a record. It is worth building before anyone requires it.