ESMA Begins EU-Wide Crypto Custody Reviews Under MiCA

The European Securities and Markets Authority (ESMA) has launched its first Common Supervisory Action (CSA) to review the custody operations of crypto‑asset service providers (CASPs) across the European Union. The coordinated reviews, carried out by national competent authorities, will assess the digital operational resilience of authorised CASPs, focusing on governance, key and storage management, transaction controls, incident detection and response, smart‑contract risks and dependence on third‑party providers. The risk‑based sample will be examined from now through the first half of 2027, with a final report to be submitted to ESMA’s Board of Supervisors in the second half of 2027. The initiative follows the end of the MiCA transition period on 1 July 2024, marking a shift from licensing to scrutiny of actual operational practices. ESMA said the action aims to ensure consistent supervision across member states and to close gaps that previously allowed regulatory arbitrage. The move comes as crypto‑custody firms such as BitGo launch Europe‑focused services to help platforms comply with the new framework, highlighting the growing importance of robust custody standards in the EU’s emerging crypto market.