ESMA Reviews Crypto Custody Resilience Through First Half of 2027
The EU securities regulator launched a review of authorized crypto-asset service providers offering custody, with a final report planned for the second half of 2027.
The European Securities and Markets Authority will review custody-related resilience at authorized crypto firms from the second half of 2026 through the first half of 2027, increasing scrutiny of infrastructure used to safeguard digital assets.
ESMA launched the Common Supervisory Action on July 8, 2026. National competent authorities will select a risk-based sample of authorized crypto-asset service providers that offer custody services and assess how they manage operational and technology risks.
The review will cover governance, cryptographic keys, storage systems, transaction controls, incident detection and response, smart-contract risks and dependencies on outside technology providers. ESMA plans to combine the national findings in a final report for its Board of Supervisors during the second half of 2027.
The action examines how firms meet requirements under the European Union’s Markets in Crypto-Assets Regulation and the Digital Operational Resilience Act. It does not itself create new rules, enforcement measures or compliance fees.
DORA applies to crypto-asset service providers authorized under MiCA. The law defines digital operational resilience as the ability to maintain information and communications technology capabilities that support financial services during disruptions.
The review follows the latest possible end of MiCA’s transitional regime. Firms operating under national law before Dec. 30, 2024, could continue operating until July 1, 2026, or until authorization was granted or refused, whichever came first. Member states could set an earlier deadline or eliminate the transition.
For U.S. crypto market participants, the exercise shows how EU oversight is moving beyond authorization toward continuing supervision of custody infrastructure, transaction processing, incident response and technology vendors. The work will run alongside ESMA’s 2027 supervisory priority on artificial intelligence and tokenization.
The next concrete milestone is the completion of the supervisory exercise in the first half of 2027, followed by ESMA’s consolidated report in the second half of that year.
