ESMA launches EU-wide review of crypto custody under MiCA

The first EU supervisory sweep of licensed crypto firms will test custody resilience through 2027 as regulators tighten oversight after MiCA took full effect.

18d ago

Fact Check

The official ESMA press release dated 08/07/2026 directly confirms the claim: ESMA launched a Common Supervisory Action (CSA) on crypto-asset service providers with a focus on custody, an EU-wide exercise conducted by National Competent Authorities on authorised CASPs from H2 2026 to H1 2027, with a final report in H2 2027. This corroborates the claim's characterization of an 'EU-wide review of crypto custody' testing 'custody resilience through 2027' following full MiCA effect. The Cointelegraph report independently matches these details. The only mild imprecision in the headline is 'first EU supervisory sweep,' which the sources frame as a Common Supervisory Action, but the substance is fully supported.

Summary

ESMA has begun its first Common Supervisory Action covering crypto-asset service providers, opening an EU-wide review of custody risk at licensed firms just days after MiCA took full effect. National regulators will assess a risk-based sample of authorized CASPs from late 2026 into early 2027, examining governance, key and storage management, transaction controls, incident detection, smart contract risk and reliance on third-party providers. The exercise extends a supervisory tool long used for fund managers into crypto and builds on the Digital Operational Resilience Act, signaling a shift from rulemaking to enforcement-focused oversight of custody safeguards across the EU.

Terms & Concepts

MiCA: The EU's Markets in Crypto-Assets regulatory framework for crypto firms and services.
CASPs: Crypto-asset service providers authorized to offer regulated crypto services in the EU.
Digital Operational Resilience Act: An EU framework aimed at strengthening how financial firms manage technology and operational disruptions.