ESMA launches first crypto custody review under MiCA
Crypto custody providers across Europe are facing increased scrutiny as regulators focus on protecting digital assets and strengthening market stability.
The European Securities and Markets Authority has launched a Common Supervisory Action on the digital operational resilience of crypto-asset service providers, with a specific focus on custody services.
The exercise will assess the maturity of authorised CASPs’ digital operational resilience frameworks in relation to custody activities.
National competent authorities will conduct a risk-based review of a sample of authorised crypto-asset service providers.
The exercise will run from the second half of 2026 to the first half of 2027.
ESMA said the review will focus on risks linked to distributed ledger technology, including governance arrangements, key and storage management, transaction controls, incident detection and response, smart contract risks and dependencies on third-party providers.
The initiative reflects ESMA’s risk-based supervisory priorities, which identify both digital operational resilience and crypto-asset service providers as key risk areas.
The findings collected by national regulators will be consolidated into a final report and submitted to ESMA’s Board of Supervisors upon the exercise’s conclusion in the second half of 2027.
The action marks a shift from rule implementation towards coordinated supervision of crypto firms operating under the EU’s MiCA framework.
Why does it matter?
Crypto custody is a critical part of the digital-asset market because failures in private key management, storage, transaction controls or incident response can directly affect users’ assets. ESMA’s coordinated review shows that MiCA supervision is moving from authorisation towards testing how firms manage operational and technology risks in practice. It could also help align national supervisory approaches and reduce uneven standards across the EU crypto market.
Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our chatbot!