EU Regulator Zeroes In on Crypto Custody Risks as MiCA Transition Ends

ESMA opens EU-wide review of crypto custody firms

The European Securities and Markets Authority (ESMA) launched a coordinated review of crypto custody providers on 8 July 2026. The regulator opened a common supervisory action (CSA) into the digital operational resilience of crypto-asset service providers (CASPs), with a specific focus on custody. ESMA said the exercise responds to its risk-based supervisory priorities, which flag both operational resilience and CASPs as key areas of risk across the EU.

Regulators will inspect key and storage management

The review will assess how mature firms' resilience frameworks are in relation to custody activities. Regulators will examine governance arrangements, key and storage management, transaction controls, and incident detection and response. ESMA will also look at smart contract risks and firms' dependencies on third-party technology providers. The regulator tied the focus to risks inherent in distributed ledger technology (DLT), the systems that record who owns each crypto-asset and that underpin every custody service.

"The CSA will assess the maturity of CASPs' digital operational resilience frameworks in relation to custody activities", 8 July 2026. — European Securities and Markets Authority

National authorities will sample authorised providers

National competent authorities (NCAs) across the EU will carry out the checks. They will review a risk-based sample of authorised CASPs rather than inspect every licensed firm. The exercise runs from the second half of 2026 through the first half of 2027. ESMA will then consolidate the findings into a final report for its Board of Supervisors, expected in the second half of 2027. The regulator said the action should strengthen supervisory convergence in a fast-moving segment of the market.

Review follows the end of MiCA's transition period

The action follows the end of the Markets in Crypto-Assets (MiCA) framework's transitional period on 1 July 2026. From that date, any firm serving EU clients without a MiCA licence breaches EU law and must stop offering services. ESMA has said unauthorised providers must put orderly wind-down plans in place. Those plans should give clients prior notice and transfer their crypto-assets to an authorised firm or to a self-hosted wallet. MiCA also bars authorised firms from delegating custody to entities that are not themselves authorised CASPs.

Custody rules govern a multi-trillion-dollar market

The custody rules cover a large pool of assets. The global crypto market was worth about $2.25 trillion, down roughly 2% over the past 24 hours (CoinPaprika, 8 July 2026). Custody firms hold the private keys that control access to client holdings, which makes key management central to the review. Under MiCA, custodians remain liable for client losses caused by incidents attributable to them, with liability capped at the market value of the lost asset. The review does not set new custody requirements. It measures whether firms already meet the operational standards MiCA demands.

Custody providers face closer supervisory questions

ESMA framed the CSA as a way to compare how national regulators supervise custody under the same rulebook. The findings will not name individual firms, but they will shape how NCAs apply MiCA standards in practice. Custody providers across the EU can expect closer questions on key management, incident response and their reliance on outside technology vendors. A weak result in the sample could prompt tighter supervision or guidance once the report reaches ESMA's Board of Supervisors in 2027.

Primary source: Source ↗