ESMA launches EU crypto custody review under MiCA

ESMA has launched an EU-wide review of crypto custody providers under MiCA, focusing on operational resilience and risk management. Inspections run through mid-2027, with a final report due late 2027.

The European Securities and Markets Authority (ESMA) has initiated a coordinated review of crypto-asset service providers (CASPs) across the European Union. This effort focuses on custody services within the Markets in Crypto-Assets (MiCA) regulatory framework. The Common Supervisory Action (CSA) will see national regulators conduct synchronized inspections of authorized crypto firms from the second half of 2026 through the first half of 2027. The review will assess operational resilience, governance, private key and storage management, transaction controls, incident detection and response, smart contract risks, and reliance on third-party providers. This initiative aims to ensure crypto custody providers meet stringent requirements for safeguarding client assets and managing operational risks, in line with MiCA and the Digital Operational Resilience Act (DORA). ESMA will consolidate findings into a final report expected in late 2027, aiming to enhance supervisory consistency and investor protection across the EU digital asset market.