ESMA launches EU wide review of crypto custody services

The European Securities and Markets Authority (ESMA) launched a coordinated supervisory review of crypto custody services on July 8, marking a significant step in the European Union's post-MiCA regulatory enforcement. The initiative will see national regulators across the bloc examine a risk-based sample of authorized cryptoasset service providers (CASPs) from late 2026 through the first half of 2027, focusing on the operational resilience of firms that safeguard client digital assets.

The Common Supervisory Action, announced by ESMA, will assess how licensed crypto firms manage custody-specific risks inherent to distributed ledger technology. Key areas of scrutiny include governance arrangements, the management and storage of cryptographic keys, transaction controls, incident detection and response capabilities, smart contract risks, and dependencies on third-party service providers. ESMA stated the exercise is intended to evaluate the maturity of firms' digital operational resilience frameworks and improve the harmonization of supervisory practices across member states.

This sweeping review follows the full implementation of the Markets in Crypto-Assets (MiCA) framework, whose...