ESMA launches first major crypto custody review after MiCA

The European regulator ESMA has launched the first coordinated crypto market review since MiCA became fully effective. The investigation focuses on the digital resilience of crypto custodians and will run until 2027.

According to ESMA, this involves a so-called Common Supervisory Action (CSA), specifically targeting Crypto Asset Service Providers (CASPs) that carry out custody activities. This is the first CSA that ESMA is conducting now that MiCA is fully enforced. The European market already counts more than 270 authorised CASPs, making the scope of this supervisory exercise substantial.

What exactly is ESMA assessing?

The CSA assesses how mature the digital resilience frameworks of CASPs are with regard to custody activities. In doing so, ESMA looks at risks associated with distributed ledger technology (DLT), such as how companies structure their governance and how they manage keys and storage.

In addition, the investigation focuses on transaction controls, detection and handling of incidents, risks surrounding smart contracts, and dependencies on third parties. In other words, ESMA wants to know whether crypto custodians are technically and operationally robust enough to protect clients.

National supervisors carry out the investigation

The practical execution lies with the national supervisors, the so-called National Competent Authorities (NCAs). They conduct the assessments based on a risk-driven sample of authorised CASPs. This is not a mandatory check for every provider but a targeted selection of parties that may require extra attention.

The process runs from the second half of 2026 through the first half of 2027. This is a clear signal that European crypto regulation is becoming increasingly concrete and more active. Where rules were previously established, now real enforcement and testing in practice follow.