ESMA Launches EU-Wide Review of Crypto Custody Security Under MiCA

The European Securities and Markets Authority (ESMA) has opened a bloc-wide supervisory review of how crypto-asset custody providers safeguard client holdings, marking the first significant test of operational compliance since the Markets in Crypto-Assets (MiCA) transition period closed on 1 July. The exercise, described by ESMA as a common supervisory action, will run through the first half of 2027 and will be carried out by national competent authorities across member states.

According to an official announcement published on Wednesday, the review will focus on the “maturity” of digital operational resilience frameworks maintained by crypto-asset service providers, or CASPs, with particular attention paid to custody activities. ESMA said national regulators would examine “key and storage management, alongside other operational risks”, using a risk-based sample of authorised firms rather than a blanket audit of the entire sector.

National regulators take the lead

The practical work of assessing firms will fall to national competent authorities in each EU jurisdiction, which will be expected to look beyond key management into governance structures, transaction controls, incident detection and response capabilities, and the degree to which custodians depend on external technology providers, according to ESMA’s announcement.

That reliance on third-party infrastructure has become an increasingly sensitive issue for supervisors as institutional custody arrangements grow more complex, often involving layered technology stacks and outsourced key-signing services. ESMA’s decision to name dependency on outside providers as a distinct line of inquiry signals that regulators intend to trace operational risk through the full custody chain rather than treating custodians as self-contained entities.

Timing follows the end of MiCA’s transition window

The review’s launch shortly after MiCA’s transitional arrangements expired is unlikely to be coincidental. With firms now required to hold full authorisation to operate across the bloc, attention has shifted from whether providers have secured licences to whether their internal controls match the standards MiCA was designed to enforce. ESMA’s action effectively begins that scrutiny in earnest, targeting one of the areas most exposed to catastrophic failure: the safekeeping of client assets.

The consolidated findings from national authorities will be compiled into a final report submitted to ESMA’s Board of Supervisors once the exercise concludes in the second half of 2027, giving the regulator an EU-wide picture of custody resilience rather than a patchwork of national assessments.

Custody providers adapt to the new landscape

The review lands as some custody specialists have already been repositioning to meet MiCA’s requirements. Crypto custody firm BitGo launched a Europe-focused crypto-as-a-service platform last month, aimed at helping trading platforms retain market access while working through MiCA-related compliance obligations, a move that underscores how quickly infrastructure providers are adjusting to the bloc’s tightened rulebook.

Separately, Cointelegraph noted that Belgium’s regulator has already flagged six unauthorised crypto providers operating past the MiCA deadline, an early indication that enforcement gaps are emerging even as the formal transition period ends. ESMA’s custody review is likely to add further pressure on firms operating in legal grey areas, particularly those relying on third-country technology partners without clear contractual accountability.

Read more: Coinbase Wins UK MiFID Licence, Bridging Crypto Into Regulated Securities Markets