ESMA to Look at Crypto Custodians

Just a week after its deadline for companies to register as Crypto Asset Service Providers (CASPs) under its regulatory regime, the European Securities and Markets Authority (ESMA) has unveiled plans to launch a review of the sector, with a specific emphasis on custody providers.

ESMA’s Common Supervisory Action (CSA) focuses on the digital operational resilience of CASPs, with a specific emphasis on custody services and will assess the maturity of these firms’ digital operational resilience frameworks in relation to custody activities. It will focus on risks inherent to distributed ledger technology (DLT), including governance arrangements, key and storage management, transaction controls, incident detection and response, smart contract risks, and dependencies on third-party providers.

European National Competent Authorities will carry out the exercise on a risk-based sample of authorised CASPs, ESMA says, adding that the exercise will run from the second half of 2026 to the first half of 2027. A final report will then be prepared for ESMA’s board of supervisors.

“This initiative responds to ESMA’s risk-based supervisory priorities, which identify both digital operational resilience and CASPs as key areas of risk,” the RU regulator states. “ESMA has developed this CSA to enhance supervisory convergence in a rapidly evolving segment of the market.”