Cyprus regulator plans on-site crypto custody audits

TLDR

Cypruss securities regulator will begin on-site audits of licensed crypto custody providers from late 2026, raising the bar for how digital assets are safeguarded in the EU.

1. The Cyprus Securities and Exchange Commission (CySEC) will audit a sample of crypto asset service providers under ESMAs CSA 2026 program from late 2026 to mid 2027.
2. Audits will focus on operational resilience in custody, including private key security, wallet controls, smart contract risks, and third party dependencies.
3. For users, this should mean stricter standards and potential enforcement, with Cyprus positioning itself as a more tightly supervised crypto hub in the EU.

Deep Dive

1. Scope And Timeline

CySEC will carry out on-site inspections and desk based reviews of authorized crypto asset service providers that offer digital asset custody from the second half of 2026 through mid 2027, as part of ESMAs Common Supervisory Action (CSA 2026) on custody risk.

The regulator plans to audit a representative sample of local crypto firms rather than every provider, aligning its work with ESMAs risk based priorities for operational resilience and investor protection. A prior CySEC circular makes clear that firms must already be compliance ready, and that readiness will influence who is selected for inspection.

CySEC has also proposed a directive on prudential reporting for CASPs in late 2025, showing that these audits are one pillar in a broader tightening of oversight for Cyprus based crypto businesses.

2. What Audits Will Check

The supervisory reviews will focus on how custodians manage digital asset security in practice, particularly around distributed ledger technology risks. Key areas flagged include:

1. Private key and storage management, including wallet storage and access controls.
2. Transaction controls, monitoring, and incident response for suspicious or failed transfers.
3. Smart contract security and third party risk management where custody relies on external infrastructure.

Firms will need to show robust policies, technical safeguards, and clear escalation procedures in each of these areas. Weaknesses could translate into remediation demands, higher capital or risk requirements, or in serious cases restrictions on custody permissions.

3. Impact And What To Watch

For retail and institutional users, stricter custody audits should reduce the risk of loss from operational failures, though they may also increase costs as providers upgrade systems and controls. The standardized audit framework is designed to promote supervisory convergence across the EU, so expectations in Cyprus are likely to resemble those in other ESMA coordinated jurisdictions.

The most important things to watch next are: which firms CySEC selects, whether any material deficiencies or enforcement actions are reported, and whether the EU expands similar initiatives beyond custody into staking, lending, or tokenization services. If audits uncover systemic weaknesses, it could accelerate further rulemaking around crypto custody at the European level.

Conclusion

CySECs plan for on-site crypto custody audits signals that regulators now view operational resilience and key management as central to financial stability in digital asset markets. For crypto users, the near term impact is more scrutiny on custodians and potentially slower or more expensive services, but the longer term effect is a safer and more standardized custody environment across the EU. Watching how these audits play out will offer early clues about which platforms can meet institutional grade safeguards and which may struggle under the new regime.