ESMA Launches EU Review of Crypto Custody Providers

The European Securities and Markets Authority (ESMA) has launched a Common Supervisory Action (CSA) with EU regulators to assess how well crypto asset service providers (CASPs) protect digital assets held in custody.

The review, announced by the Cyprus Securities and Exchange Commission (CySEC) on August 6, will run from the second half of 2026 to the first half of 2027. It will include both on-site inspections and document reviews.

Regulators will examine firms’ cybersecurity measures, internal controls, private key management, transaction monitoring, incident response, and third-party risk management.

Only authorized CASPs offering custody services will be included. The initiative aims to strengthen consistent supervision across the EU and ensure crypto firms can better protect client assets from cyber threats and operational risks.