ESMA launches MiCA resilience review for CASPs

TLDR

ESMA is starting a coordinated MiCA supervisory review of crypto-asset service providers, focusing on how resilient their custody and digital infrastructure really are.

1. ESMA and national regulators will run a common supervisory action through mid 2027, testing CASPs custody and digital operational resilience under MiCA.
2. Licensed exchanges and custodians face detailed checks on key management, governance, incident response and third party dependencies, with potential remedial actions for weak setups.
3. Crypto users and firms should watch for ESMAs 2027 report, national guidance, and any follow up enforcement or MiCA 2.0 changes that tighten custody rules further.

Deep Dive

1. How The ESMA Review Works

ESMA has launched a Common Supervisory Action on crypto custody, coordinating national regulators to examine the digital operational resilience of licensed Crypto Asset Service Providers (CASPs) under MiCA, especially around custody services. The exercise focuses on key and storage management, governance, transaction controls, incident detection and response, and reliance on external technology providers, as outlined in ESMA focused coverage on custody scrutiny.

National competent authorities will select a risk based sample of authorized CASPs and run these reviews from now through the first half of 2027, with ESMA later consolidating the findings into a report for its Board of Supervisors. This comes immediately after MiCAs transition period ended on 1 July, when CASPs had to move from national regimes to full MiCA authorization.

2. What It Means For CASPs And Users

The review is framed as supervisory, not a new rule or automatic penalty, but it tests whether MiCA licensed firms actually meet expected standards for safeguarding client assets. ESMA and national regulators plan to scrutinize custody procedures, cybersecurity, business continuity plans and documentation, particularly for institutional grade custody providers, as described in one EU wide overview of the action.

Around a few hundred firms now hold MiCA CASP licenses, while many others exited or restructured, meaning the review will concentrate risk on a relatively small set of custodians that hold most EU client assets. Firms that fall short are likely to face remediation plans, tighter ongoing supervision, or in severe cases pressure on their authorization, while users benefit from clearer expectations on how their assets should be protected.

3. What To Watch Next

ESMAs CSA will generate a final report in the second half of 2027, which is likely to shape future guidance and may feed into broader MiCA revision work often called MiCA 2.0, where officials are already consulting on stablecoins, tokenization and DeFi. Parallel coverage notes that EU institutions are preparing to revisit MiCA from 2027, while ESMAs custody review runs in the same window.

In the nearer term, CASPs should expect detailed data and documentation requests, while national regulators may start publishing jurisdiction specific notices based on early findings. Crypto users can monitor whether their provider holds a MiCA CASP license, how it communicates custody arrangements and incident handling, and whether any regulatory findings trigger changes to services or risk disclosures.

Conclusion

ESMAs MiCA resilience review marks a shift from writing the rules to actively testing how well crypto custodians and service providers follow them, with custody risk at the center. For EU facing platforms, the next year is about proving they can protect client assets under stress, while for users the outcome should be clearer standards and, potentially, a shakeout of weaker providers as MiCA supervision matures.