ESMA checks Europe's crypto keykeepers 🔑

The European Securities and Markets Authority (ESMA) is launching a dedicated review of crypto custody providers, announcing a common supervisory action (CSA) aimed at gauging the operational resilience of crypto-asset service providers (CASPs) under the Markets in Crypto-Assets (MiCA) framework. "The CSA will assess the maturity of CASPs' digital operational resilience frameworks in relation to custody activities," ESMA said in an official announcement on Wednesday. The supervisory action lands shortly after the close of MiCA's transition phase on July 1, intensifying scrutiny of how EU authorities plan to enforce compliance with the new regime.

Under the exercise, national competent authorities (NCAs) across the EU will assess a risk-based sample of authorized CASPs, with the reviews running through the first half of 2027. Regulators will examine how firms manage custody-related operational risks, including key and storage management, governance structures, transaction controls, incident detection and response, and dependencies on external service providers.

ESMA will later consolidate findings from the NCAs into a final report to be submitted to its Board of Supervisors after the exercise concludes in the second half of 2027. The widened supervisory lens comes as some custody specialists have moved to support platforms adjusting to Europe's new rules, including crypto custody company BitGo, which last month launched a Europe-focused crypto-as-a-service platform aimed at helping platforms maintain access to the market while working through MiCA-related compliance requirements.