ESMA Reviews Crypto Custody Resilience Through First Half of 2027

The European Securities and Markets Authority (ESMA) has launched a review of crypto custody resilience at authorized firms. The Common Supervisory Action, which started on July 8, 2026, will assess how these companies manage operational and technology risks.

ESMA has selected a risk-based sample of crypto-asset service providers that offer custody services. National competent authorities will evaluate governance, cryptographic keys, storage systems, transaction controls, incident detection and response, smart-contract risks, and dependencies on outside technology providers.

The review aims to ensure these firms meet requirements under the European Union's Markets in Crypto-Assets Regulation and the Digital Operational Resilience Act. ESMA plans to combine national findings into a final report for its Board of Supervisors by the second half of 2027.