ESMA launches MiCA custody resilience reviews

TLDR

ESMA has begun an EU-wide review of crypto custody providers under MiCA, testing how resilient their systems are for safeguarding client assets.

1. ESMA launched a common supervisory action on custody and digital operational resilience, coordinated across national regulators and running through the first half of 2027.
2. The review drills into key management, storage, governance, and incident response, raising the bar for how licensed crypto firms protect user assets under MiCA.
3. Firms should expect detailed data requests and potential remedial measures, while users can watch for ESMAs 2027 findings and any stricter custody expectations that follow.

Deep Dive

1. Scope Of The New ESMA Reviews

The European Securities and Markets Authority (ESMA) has initiated a Common Supervisory Action on crypto-asset service providers (CASPs) operating under Markets in Crypto-Assets (MiCA). The exercise is a coordinated review, not a new rule, with national regulators assessing a risk-based sample of authorized firms across the EU.

According to ESMAs announcement, the CSA focuses on digital operational resilience for custody activities, including how providers manage keys, storage, and other operational risks tied to client asset safeguarding under MiCAs custody rules. The reviews start now and are scheduled to run until the first half of 2027, followed by a consolidated report to ESMAs Board of Supervisors later in 2027, as outlined in this coordinated review notice.

2. Impact On Custody Firms And Users

Custody sits at the most sensitive layer of crypto infrastructure, because failures in private key management, segregation of funds, or disaster recovery can lead to permanent loss of client assets. ESMAs action targets hundreds of MiCA-authorized firms and asks whether their internal controls meet the operational standards implied by the new regime.

Regulators will examine governance, transaction controls, incident detection and response, reliance on external technology providers, and business continuity plans, as described in this CSA summary. While the action is framed as supervisory rather than punitive, firms that fall short could face remediation plans or heightened ongoing supervision. For users, stronger and more consistent custody controls should reduce the risk of black box operational failures at EU-licensed platforms.

3. What To Watch Through 2027

National competent authorities will send questionnaires and request detailed documentation on custody arrangements, IT risk frameworks, and emergency procedures, so CASPs should prepare for intensive supervisory engagement. ESMAs final report, expected in the second half of 2027, will likely highlight common weaknesses and shape future supervisory expectations.

If the CSA reveals significant gaps, regulators could respond with stricter guidance, tighter interpretations of MiCA custody rules, or more frequent follow-up inspections. Users and institutions relying on EU-based custody should watch for any firm-specific notices, as well as ESMA publications that may signal which controls are becoming must-haves for compliant custody.

Conclusion

ESMAs MiCA custody resilience reviews mark a shift from designing rules to testing how well crypto firms actually implement them. Over the next couple of years, the exercise can tighten standards for safeguarding assets, expose weaker operators, and push custody practices closer to traditional finance benchmarks, with user protection and operational robustness as the core drivers.

Confidence: high, based on multiple ESMA-focused regulatory summaries published on 8 Jul 2026.