ESMA starts MiCA review of crypto custody

TLDR

ESMA is launching a coordinated EU-wide review of crypto custody providers under MiCA, focusing on how regulated firms safeguard client assets and manage digital operational risks.

1. ESMA and national regulators will run a Common Supervisory Action on custody through the first half of 2027, assessing key management, governance, and incident response at licensed CASPs.
2. For crypto users and institutions, this puts asset safety and operational resilience in the spotlight, testing whether MiCA custody rules work in practice, not just on paper.
3. The review will feed into broader MiCA evolution and potential enforcement, so CASPs should track ESMA guidance, national findings, and future MiCA updates affecting custody and stablecoins.

Deep Dive

1. Scope Of ESMA Review

ESMA has announced a Common Supervisory Action on custody and digital operational resilience, coordinating national regulators to examine crypto asset service providers across the EU. This is described as a supervisory exercise rather than new rules, targeting firms already authorized under MiCA.

National competent authorities will select a risk based sample of CASPs and review private key and storage management, governance structures, transaction controls, incident detection and response, and reliance on external technology providers, according to ESMA focused coverage on custody controls and custody risks after MiCA transition. The work runs from now until the first half of 2027, with a consolidated ESMA report expected in the second half of 2027.

2. Impact On Users And Firms

Under MiCA, custodial CASPs must segregate client assets, maintain strong cybersecurity and business continuity, and meet governance and disclosure standards. ESMAs review directly probes whether those obligations are being met day to day, especially where custody failures could cause permanent loss.

For users and institutional clients, the practical effect is tighter scrutiny of where and how their coins are held, particularly around key management and operational resilience highlighted in ESMA focused articles on digital operational resilience. Firms that fall short are more likely to face remedial requirements or closer ongoing supervision, even if the exercise is not framed as automatic penalties.

3. What To Watch Next

This custody review sits alongside a broader rethink of MiCA, including consultations sometimes referred to as MiCA 2.0, which look at stablecoins, tokenized payments, and decentralized finance, as noted in MiCA revision coverage on future framework changes. Custody standards are likely to be a central ingredient in any updated rules.

Key milestones to watch are interim ESMA communications, national guidance that may emerge from the reviews, and the final ESMA report in 2027. Over time, this process can shape which custody models, third party tech dependencies, and risk practices are considered acceptable in the EU, influencing which platforms remain attractive for institutional and retail use.

Conclusion

ESMAs MiCA based custody review marks a shift from designing rules to enforcing them, with regulators now testing how EU authorized crypto firms actually protect client assets. For crypto users and institutions, this raises the bar on operational resilience and could gradually push weaker custodians out of favor, while informing the next round of MiCA updates that define how custody and stablecoins are handled in Europes digital asset market.