The European Securities and Markets Authority has launched its first coordinated supervisory review of crypto-asset custody since the Markets in Crypto-Assets Regulation became fully applicable on July 1. The Common Supervisory Action, announced July 8, directs national regulators across the EU to examine the digital operational resilience of licensed crypto-asset service providers, with custody arrangements as the specific target.
What Happened
ESMA’s review is not a rule change. It is the first sign that the two-year MiCA licensing process is giving way to active supervision of the firms that got licensed. National regulators will assess a risk-based sample of authorised custody providers, focusing on governance, cryptographic key and storage management, transaction controls, incident response, smart contract risk, and dependencies on sub-custodians, cloud services and blockchain infrastructure vendors. The exercise runs through the first half of 2027, with a consolidated findings report due in the second half of that year.
Why It Matters
Custody is where crypto-asset regulation has the least room for ambiguity, because a custody failure means client assets are simply gone. MiCA set the licensing bar for who can hold customer crypto, the same way U.S. regulators set the bar with approvals like the one that let Circle clear its final OCC national trust bank approval. This review tests whether the operational controls behind MiCA licences actually hold up, rather than taking firms’ own attestations at face value.
The Original Insight
The timing signals a broader shift. ESMA’s custody review lands the same month the Bank of England, PRA and FCA began direct oversight of the cloud providers UK banks depend on, and both target the same weakness: financial firms outsource the technical guts of their operations to a small number of specialist vendors, and that vendor layer is no longer being taken on faith. Firms that read MiCA licensing as the finish line should treat this review as evidence that supervision, not just authorisation, is now the active front.
Source: ESMA
