Regulatory news · European Union

ESMA launches supervisory action on crypto custody resilience

By Mardo Soo, Founder & CEO, Consulting24 · Published 22 July 2026

The European Securities and Markets Authority is launching a Common Supervisory Action focusing on the digital operational resilience of Crypto-Asset Service Providers, with a specific emphasis on custody services.

Primary source: European Securities and Markets Authority (ESMA). Consulting24 reports what the source states and labels its own reading separately. See our editorial policy.

The European Securities and Markets Authority (ESMA) is launching a Common Supervisory Action (CSA) focusing on the digital operational resilience of Crypto-Asset Service Providers (CASPs), with a specific emphasis on custody services. The initiative aims to assess the maturity of CASPs’ digital operational resilience frameworks in relation to custody activities.

Scope and focus

The CSA will focus on risks inherent to distributed ledger technology (DLT), including governance arrangements, key and storage management, transaction controls, incident detection and response, smart contract risks, and dependencies on third-party providers. National Competent Authorities (NCAs) will carry out the exercise on a risk-based sample of authorised CASPs.

Timeline

The exercise will run from the second half of 2026 to the first half of 2027. This initiative responds to ESMA’s risk-based supervisory priorities, which identify both digital operational resilience and CASPs as key areas of risk. ESMA has developed this CSA to enhance supervisory convergence in a rapidly evolving segment of the market.

Next steps

The findings collected from NCAs will be consolidated into a final report, which will be submitted to ESMA’s Board of Supervisors following the conclusion of the exercise in the second half of 2027.

What this means: EU rules set the floor for anyone serving EU clients, so a change here usually changes the sequencing of an application rather than the destination. Consulting24 delivers CASP-track company and licensing work directly in Estonia and Lithuania, and the binding constraint is normally the regulator's queue rather than the incorporation.

Does this change your licensing route?

We deliver directly in Estonia, Lithuania and Panama, and advise on the rest. Ask what this means for your setup.

💬 Talk to an expert Contact us

General guidance, not legal advice. Regulations change, and we confirm current requirements for your case.