ESMA launches EU custody reviews of crypto firms

The European Securities and Markets Authority has opened a common supervisory action for national regulators to review the operational resilience of crypto custody providers across the EU. The exercise targets custody activities, with reviews running through the first half of 2027.

ESMA announced the exercise will evaluate how crypto-asset service providers manage cryptographic keys and storage systems and how mature their digital operational resilience frameworks are for custody functions. “The CSA will assess the maturity of CASPs’ digital operational resilience frameworks in relation to custody activities,” the regulator said in its announcement.

National competent authorities in EU member states will select a risk-based sample of authorised crypto-asset service providers for inspection. Reviews will begin immediately and examine how firms prevent, detect and respond to custody-related failures.

Review teams will assess cryptographic key handling, secure storage arrangements and governance structures that oversee custody. They will also examine transaction controls, incident detection and response processes, and reliance on third-party service providers.

ESMA expects the exercise to identify operational weaknesses that could affect market integrity or investor protection. After the national reviews conclude, ESMA will consolidate the findings and provide a final report to its Board of Supervisors in the second half of 2027.

The report will present common observations and may recommend follow-up supervisory actions or guidance for firms and regulators.

The supervisory action follows the end of the Markets in Crypto-Assets transition period on July 1, which has prompted closer regulatory attention to how firms comply with the new EU rules and how authorities enforce them. Some custody providers have introduced services aimed at helping trading platforms maintain market access while meeting MiCA-related compliance requirements.