- ESMA reviews CASPs to assess custody security, governance, and operational resilience under MiCA rules.
- EU regulators will examine key management, incident response, and third-party service risks.
- Crypto custody firms face stricter oversight as MiCA shifts toward active market supervision.
The European Securities and Markets Authority (ESMA) has launched its first major review of crypto custody providers under the Markets in Crypto-Assets (MiCA) framework, targeting operational resilience and asset protection standards across the European Union.
ESMA Begins MiCA Review of Crypto Custody Operations
On July 8, ESMA announced the launch of a Common Supervisory Action (CSA) focused on crypto-asset service providers (CASPs), with particular attention on custody services and digital operational resilience. The initiative will be conducted alongside national competent authorities across the European Union.
The review examines how authorized CASPs manage operational risks linked to custody activities, including digital asset storage, governance frameworks, and cybersecurity measures. Additionally, regulators will assess whether firms maintain effective systems for protecting customer assets.
The supervisory action comes after the completion of MiCA’s transitional period in June 2026, requiring crypto service providers operating in the region to meet the regulation’s full compliance standards. Therefore, firms must now demonstrate ongoing operational readiness beyond securing regulatory approval.
ESMA’s assessment will focus on several risk areas, including private key management, transaction controls, incident response procedures, and reliance on third-party technology providers. Moreover, regulators will evaluate how companies handle risks associated with distributed ledger technology.
National authorities will select CASPs through a risk-based approach, allowing regulators to examine firms considered more exposed to operational challenges. The review is expected to run from the second half of 2026 through the first half of 2027.
Crypto Firms Face Higher Standards After MiCA Transition
The ESMA review signals a shift from licensing oversight toward continuous supervision of crypto businesses operating within the European market. Custody providers will need to prove that their internal controls remain effective under real-world conditions.
For crypto firms, the review could increase compliance requirements around information security, business continuity planning, and external service provider management.
Consequently, companies may need to strengthen operational frameworks to satisfy national regulators.
ESMA’s action also highlights the importance of custody services within the broader digital asset ecosystem. Since these providers manage investor holdings, regulators consider their resilience essential for maintaining market confidence.
Following the review, ESMA plans to consolidate findings from national authorities into a final report for its Board of Supervisors. The outcome could influence future supervisory guidance and additional MiCA standards for custody providers.
Meanwhile, unauthorized firms that failed to secure MiCA authorization continue facing pressure to exit the European market. Regulators are increasingly focused on ensuring customers transition toward compliant platforms.
As MiCA enforcement enters a new phase, crypto companies must prepare for deeper regulatory monitoring. The ESMA review indicates that operational security will remain a central requirement for firms seeking long-term access to the European digital asset market.
Leave a Reply
You must be logged in to post a comment.