The European Securities and Markets Authority (ESMA) has launched its first coordinated supervisory review of crypto custody services. This review is under the Markets in Crypto-Assets (MiCA) regulation which took into effect on 1st of July 2026. The initiative, known as a Common Supervisory Action (CSA), will assess the digital operational resilience of Crypto-Asset Service Providers (CASPs) offering custody services across the European Union. Currently, there are over 270 MiCA regulated platforms providing services in EU.
As per ESMA’s official announcement, the review aims to evaluate how authorized crypto custodians safeguard client assets, manage operational risks, and comply with MiCA’s regulatory requirements. Secondly, the review will also seek to strengthen supervisory consistency and enhance standards across the European crypto custody sector.
ESMA to Assess Governance, Security, and Operational Resilience
The CSA will focus on several critical aspects of crypto custody operations. These include governance arrangements, cryptographic key generation and storage management. Moreover, it will assess transaction controls and reconciliation processes, incident detection and response mechanisms, and smart contract-related risks.
National competent authorities across the EU will thoroughly conduct risk-based reviews of selected authorized CASPs. The supervisory exercise is scheduled to run from the second half of 2026 through the first half of 2027.
According to ESMA, the review aligns with its risk-based supervisory priorities, which identify digital operational resilience. Crypto-asset service providers are the key areas requiring closer regulatory oversight. By coordinating supervisory efforts across member states, the authority aims to promote consistent implementation of MiCA requirements. This will ultimately help improve the security and reliability of crypto custody services.
Final ESMA Report Expected in 2027
ESMA noted in its official blog that the findings from the Common Supervisory Action will be consolidated into a final report. However, it will take some time and the report is expected to be published in the second half of 2027. The report is anticipated to provide insights into supervisory practices across the EU and help strengthen the regulatory framework governing crypto custody under MiCA.