ESMA tests crypto custody resilience in 2026–27 supervisory sweep

ESMA's 8 July 2026 notice (available at https://www.esma.europa.eu) launches a Common Supervisory Action requiring national competent authorities to assess the digital operational resilience of authorised crypto-asset service providers, with the exercise focused on custody activities.

The work will run from the second half of 2026 to the first half of 2027, with ESMA's final report due to its Board of Supervisors in the second half of 2027. National competent authorities will select firms on a risk-based basis. The notice does not specify the sample size, the selection criteria beyond that risk-based approach, or whether NCAs will use a common questionnaire, onsite review or document request format. This is a supervisory convergence exercise, not a new rule text.

ESMA said the findings collected from NCAs will be consolidated into a final report for its Board of Supervisors after the exercise concludes, making this a benchmarking exercise between supervisors as well as between firms. The authority said the initiative responds to its risk-based supervisory priorities, which identify both digital operational resilience and CASPs as key risk areas, and that the action is designed to enhance convergence across a fast-moving market segment.

Who is affected is narrower than the headline suggests. The exercise covers only authorised CASPs selected by NCAs for the risk-based sample — the consultation has not disclosed the population size. In the MiCA implementing phase, national divergence has already become the operational reality for CASPs moving from transition regimes into full EU authorisation, which is the context in which supervisory convergence carries practical weight.

At the custody layer, ESMA has narrowed the scope to the operational points that fail first in crypto custody: governance arrangements, key and storage management, transaction controls, incident detection and response, smart contract risks, and dependencies on third-party providers. The pressure point is a familiar obligation mismatch. Key management and storage are internal; smart contract risk can sit with external code; third-party dependencies can run through cloud, wallet infrastructure or other service layers. For CASPs, the immediate task is less about rewriting policy and more about proving the custody framework maps each of those risks to a named owner, a tested control and an incident path.

Firms that bifurcate custody from trading operations will need to show where the custody framework starts and stops. Outsourced wallet or storage arrangements are plainly in scope: ESMA expressly flags third-party-provider dependency risk.

The unresolved question is methodology: whether NCAs will apply a common assessment format or divergent national approaches — and whether that divergence will itself appear in ESMA's final report.