CySEC Targets On-Site Inspections for Crypto Custodians in 2026
The Cyprus Securities and Exchange Commission (CySEC) is gearing up to launch on-site inspections and desk-based reviews of authorized crypto asset service providers, starting from the second half of 2026. The regulator aims to assess the operational resilience of these firms, particularly in relation to risks tied to distributed ledger technology.
The enforcement initiative, part of a broader European effort, is coordinated by the European Securities and Markets Authority (ESMA). CySEC will examine six core operational risk areas, including governance and control frameworks, key and storage management, security protocols governing private keys, wallet storage and access controls, transaction controls, monitoring and incident response, smart contract security, and third-party risk management.
The regulator has warned local firms that the standards outlined in the circular are mandatory, and compliance readiness will serve as the baseline for selecting CASPs for upcoming inspections. The initiative aligns with ESMA's risk-based supervisory priorities and responds to concerns about operational resilience and digital asset custodians identified by EU regulators.