ESMA launches resilience review of MiCA crypto asset custodian

The European Securities and Markets Authority launches regulatory review of MiCA crypto custodians

The European Securities and Markets Authority (ESMA) has launched a regulatory review of crypto custodians authorized by MiCA, and its focus has shifted from issuing licenses to testing how institutions respond to operational risks in practice.

Abstract

ESMA has initiated a review of the operational resilience of MiCA-authorized crypto custodians. Regulators will examine custody controls, key management, incident response and third-party risks. This review comes as the European Union prepares to review some provisions of MiCA after the passage of the US GENIUS Act.

According to the European Securities and Markets Authority, the regulator has launched a joint regulatory action to conduct a sampling inspection of a group of crypto asset service providers authorized under the framework of the EU Crypto Asset Markets Act. The review focuses on custody services and aims to assess whether companies have effective operational resilience measures rather than relying solely on regulatory approvals.

ESMA examines custody controls after MiCA license is issued

As ESMA stated, regulators will evaluate digital operations resilience in multiple key areas, including private key and storage management, transaction control, incident response processes, and reliance on third-party technology providers. The review coincides with the end of the MiCA transition period and becomes one of the first coordinated regulatory actions under the EU Cryptography Rulebook.

Sebastian Desimoz, co-founder and managing partner of digital asset infrastructure company Taurus, said in a statement that the message from regulators is that obtaining a MiCA license is just the starting point for custodians. Desimoz said hosting providers now need to prove that their operational controls are resistant to actual risks, rather than just claiming that their systems are secure. He added that as digital assets are further integrated into regulated financial infrastructure, regulators expect them to achieve the same level of security, accountability and resilience as traditional financial markets.

Jody Mettler, chief operating officer of BitGo and president of BitGo Trust, said institutional clients have stepped up their review of custody practices. Mettler noted in a statement that customers are increasingly asking custodians how to isolate customer assets, manage access controls, respond to security incidents, and maintain business continuity during times of market stress. She added that regulators are paying more attention to the operating standards that underpin digital asset services rather than just assessing licensing requirements.

Europe revises crypto rules, MiCA regulation expands

Industry participants also see the review as an early sign of how MiCA regulation may evolve. Marcus Levin, co-founder of blockchain infrastructure company XYO, said that obtaining MiCA authorization and proving operational resilience are two different things. He said companies that can demonstrate strong operational controls before regulatory reviews are over may be in a better position given the increasing involvement of institutions in digital assets.

At the same time, Yuri Brissoff, a lawyer for Digital & Analog Partners, said the review combines obligations under MiCA and the Digital Operations Resilience Act. Brissov believes that centralization among managed technology providers means that the weaknesses of a single supplier can affect multiple regulated agencies at the same time, making supply chain resilience a key compliance issue.

Meanwhile, European regulators are already preparing for the next phase of MiCA. According to reports, European Commission officials plan to review some frameworks starting in 2027 after the implementation of the US GENIUS Act. The review is expected to examine how non-EU stablecoin issuers should be treated under existing rules as international crypto regulation continues to develop.

Current market data also shows that the exchange ecosystem under MiCA supervision continues to expand. According to relevant data, Kraken ranks as the largest regulated trading venue in terms of liquidity, with real-time dashboards showing that its spot liquidity exceeds US$400 million and perpetual contract liquidity exceeds US$220 million. The same data shows that Coinbase remains the second-most liquid regulated exchange, highlighting the growing size of platforms operating under the European licensing framework.