ESMA Launches EU-Wide Review of Crypto Custody Providers Under MiCA

The European Securities and Markets Authority (ESMA) is launching a dedicated review process for crypto custody providers as the European Union moves into the next phase of oversight under the Markets in Crypto-Assets (MiCA) framework. According to Cointelegraph, ESMA will carry out a common supervisory action (CSA) focused on the operational resilience of crypto-asset service providers (CASPs), with particular attention on custody services, based on an official announcement made on Wednesday. ESMA said the CSA will evaluate how mature CASPs’ digital operational resilience frameworks are in relation to custody activities, with reviews concentrating on key and storage management as well as other operational risks. The initiative follows the end of MiCA’s transition phase on July 1, increasing scrutiny over how EU authorities will supervise compliance with the new rules and raising questions about potential enforcement approaches.

National competent authorities (NCAs) across the EU will conduct the supervisory action by assessing a risk-based sample of authorized CASPs, ESMA said. The reviews are set to run from now through the first half of 2027, examining how firms manage custody-related operational risks. Beyond key and storage management, regulators are expected to assess governance structures, transaction controls, incident detection and response capabilities, and dependencies on external service providers. ESMA said it will consolidate the results into a final report for submission to its Board of Supervisors after the exercise concludes in the second half of 2027. The review also comes as some custody providers have moved to support crypto platforms adapting to Europe’s new regulatory environment, including last month’s launch by crypto custody company BitGo of a Europe-focused crypto-as-a-service platform intended to help platforms maintain market access while working through MiCA-related compliance requirements.