ESMA launched a coordinated EU-wide review of crypto custody operations on July 8, 2026, moving MiCA supervision from the licensing question to the harder question of whether crypto firms can actually protect client assets under stress.
The action is called a Common Supervisory Action, or CSA. That is regulator language for a coordinated inspection carried out at the same time, using the same checklist, by the national regulator in each EU country under ESMA’s direction. It is not a case against one firm. It is a synchronised sweep of many.
Key Takeaways
- EU crypto supervision moves from licensing checks to real operational stress testing.
- National regulators inspect a risk-based sample of authorised crypto firms across the EU.
- Custody controls, private keys, incident response, smart contract risks, third-party dependencies.
From Rulebook to Real-World Testing
The market consensus reads July 1, 2026 as the end of the MiCA transition. Everyone had to be licensed or gone. The July 8 CSA is the answer to what happens next. Having the licence is now the floor, not the ceiling. ESMA wants to see whether the licensed firms have the systems to back it up.
Two acronyms carry most of the weight here. MiCA, the Markets in Crypto-Assets Regulation, is the EU’s crypto rulebook that took full effect this month. DORA, the Digital Operational Resilience Act, is a parallel EU law that requires financial firms to prove their tech infrastructure can survive cyberattacks, outages, and third-party failures. Under MiCA, crypto service providers are treated as financial entities for DORA purposes, so both laws apply to them at the same time. The CSA is essentially a live test of how well those two frameworks are being implemented in the one area of crypto business where failures hurt clients most directly: custody.
Custody in this context means the systems and controls a firm uses to hold client crypto on their behalf. That covers the private keys, the wallets, the transaction approval workflow, the incident playbook, and every outside provider the firm depends on to keep any of it running. If any one of those layers breaks, client assets can move or disappear before anyone notices. That is the risk ESMA is trying to measure across the entire EU market at once.
What the Reviews Are Actually Looking At
The reviews will be carried out by each country’s national regulator, called a National Competent Authority (NCA). Examples include BaFin in Germany, the AMF in France, and CNMV in Spain. Each NCA will select a risk-based sample of the licensed crypto firms in its jurisdiction. That means bigger custodians, cross-border operators, and firms handling the most client assets are more likely to be inspected first.
The inspection checklist has seven focus areas, all of them well-known failure points in past crypto custody incidents:
Key Management
How private keys are generated, stored, backed up, and used to sign transactions. This is the single most sensitive layer in any custodian’s stack.
Storage Management
The split between cold storage (offline, harder to attack) and hot wallets (online, faster to move funds from), plus the controls around each.
Transaction Controls
The rules around who can approve a client withdrawal, how many signatures are required, and what safeguards catch suspicious transfers before they settle.
Governance
Who inside the firm is responsible for custody decisions, whether risk and compliance are actually independent, and how the board sees what is happening.
Incident Detection and Response
Whether the firm can detect a breach, contain it, block malicious transactions in real time, and notify clients and regulators inside the required window.
Smart Contract Risks
Exposure to the on-chain code used for staking, bridging, or DeFi integrations, and whether the firm has audited and monitored what it interacts with.
Third-Party Dependencies
Every outside provider the custodian relies on, from cloud infrastructure to key-management vendors, and the risk of one supplier taking the whole service down.
The exercise runs from the second half of 2026 through the first half of 2027. ESMA will then consolidate the findings into a final report for its Board of Supervisors, the body made up of the heads of each national regulator, with publication expected in the second half of 2027. That report will set the tone for how European crypto custody is supervised in the years after.
What Could Go Wrong for the Firms Being Inspected
The counter-argument to reading this as a routine sweep is what happens when NCAs actually start pulling apart custody stacks. Crypto custody has grown fast, and much of it was built on infrastructure that predates MiCA or DORA. Legacy setups that worked commercially can still fail a resilience audit if the documentation, testing evidence, or incident logs are not there. A firm can be safe in practice and still fail on paper, and MiCA-era supervision will lean on paper.
Concentration risk sits underneath that first problem. A large share of European crypto custody runs on a small number of underlying providers, whether that is cloud infrastructure, hardware security modules, or specialised key-management vendors. If NCAs flag the same third party across many firms, the fix can force expensive migrations across the whole market at once. That is exactly the kind of systemic single point of failure DORA was written to expose.
Asymmetric enforcement is the quieter concern. NCAs vary in how aggressively they interpret operational resilience rules, and a custodian licensed in one member state could face a heavier review than a competitor licensed in another purely because of local supervisory culture. ESMA’s coordination across the exercise is meant to narrow that gap, but narrowing it and closing it are different things.
The technical reality suggests the July 8 CSA is the moment MiCA stops being a licensing story and becomes an operational one. Firms with mature custody controls could benefit from the clarity, since supervisors reward what they can verify. Weaker platforms may need to upgrade systems, governance, or third-party arrangements before the 2027 report lands. The market has been told the rules for two years. Now it finds out how they are actually enforced.
This article is for informational purposes only and does not constitute financial advice. Consult a professional before making investment decisions.
Be the first to comment