ESMA launches its first coordinated review of crypto asset custody under the MiCA framework

The grace period for EU crypto custodians has ended

With the full entry into force of the Crypto Asset Markets Regulation, the European Securities and Markets Authority has moved from the rule-making stage to proactive supervision. Its first joint regulatory action against crypto asset service providers has placed custody businesses under direct review. Regulators in various countries will conduct risk-oriented assessments from now on until 2027, focusing on governance structures, key management, transaction control, event response, smart contract risks and third-party dependence.

This joint supervision is not a one-time inspection. It represents a structured coordinated action covering all member states to test the resilience of digital operations of institutions holding client cryptoassets. The European Securities and Markets Authority\'s choice of custody as its first regulatory target fully illustrates the areas where regulators believe risks are most concentrated. Poor management of private keys, flawed transaction approval processes, and reliance on outsourcing infrastructure-these issues have long been weak links in the crypto industry. Today, they will face regulatory standards similar to traditional financial market infrastructure.

What exactly is covered by the review

The governance review will assess whether the board truly oversees the custody business rather than just writing policies. The key management assessment will take an in-depth look at the generation, storage, rotation and recovery of private keys-often the most difficult part of a custody system. Transaction controls will test how institutions authorize and monitor external transfers to prevent internal fraud or external intrusion. Incident response plans are still immature among many crypto companies, so they will face greater pressure. Smart contract risks have also been included in the list because custody business increasingly involves on-chain programmatic controls rather than just offline storage.

Third-party dependence adds another layer of complexity. Many EU custodians rely on sub-custodians, cloud service providers or specialized blockchain infrastructure companies. The European Securities and Markets Authority wants to ensure that these partnerships do not create hidden concentration risks or compliance gaps. The scope of this comprehensive review echoes the operational resilience framework applicable to banks and central securities depositaries under the Digital Operations Resilience Act and other EU regulations. For crypto-native companies that have developed outside traditional regulatory frameworks, these expectations are both unfamiliar and uncomfortable.

At the same time, institutional pledge and custody businesses are converging-for example, a Nasdaq-linked company provides pledge services for Sui Networks, reflecting a broader trend: institutional pledge and custody have been placed under the same operational requirements as traditional asset services.

Comprehensive law enforcement changes the rules of the game

The MiCA regulation is being implemented in phases, but full enforcement means that the European Securities and Markets Authority now has the legal authority to carry out joint regulatory actions like it does for securities markets. The tool aims to ensure that the same set of rules is applied consistently in all countries, from Lisbon to Helsinki. Without such a mechanism, regulators in various countries may have different interpretations of custody requirements, thus triggering regulatory arbitrage. The 2027 timetable suggests that this is not a one-time snapshot review, but will adjust as risks evolve and may lead to follow-up action or binding technical standards.

While European regulators have coordinated inspections, the United States is still wrangling over basic crypto legislation. Banks are trying to kill a landmark crypto bill on the eve of a Senate vote, plunging the U.S. custody environment into uncertainty. This comparison sends a clear signal to companies operating across jurisdictions: regulatory clarity in the EU is translating into specific regulatory pressures, and the gap with the United States is widening.

Unclear aspects

The European Securities and Markets Authority has not disclosed which custodians will be reviewed or how the samples will be sampled. The joint regulatory action is risk-oriented, so larger, systemically important custodians may face more in-depth assessments, but small businesses should not take chances either. The real question is what happens after the review results come out. Joint regulatory actions typically issue public reports that point out shortcomings without naming specific agencies, but may also trigger enforcement procedures if serious negligence is found. For custodians that previously operated under looser national regulatory regimes, the shift could be unexpected.

Cost burden is another unknown factor. Small crypto start-ups may have difficulty meeting governance and operational requirements without making significant investments. This may accelerate industry consolidation and concentrate custody business towards more capitalized participants. At the same time, the demand for compliant custody is growing rapidly. The tokenization of real-world assets has exceeded $20 billion on the chain, which means that secure, regulated custody infrastructure is no longer an option of the future, but an urgent real-world need.

This review is a clear benchmark for EU crypto market participants. The era of informal regulation is coming to an end. Custody resilience is no longer just a competitive advantage-it has become a mandatory regulatory requirement.