ESMA targets MiCA crypto custodians with resilience review

The European Securities and Markets Authority (ESMA) has launched a supervisory review of MiCA-authorized crypto custodians, moving its focus from licensing to testing how firms handle operational risks in practice.

According to the European Securities and Markets Authority, the regulator has started a Common Supervisory Action (CSA) covering a sample of authorized crypto-asset service providers (CASPs) under the European Union’s Markets in Crypto-Assets (MiCA) framework. 

The review concentrates on custody services and will examine whether firms have effective operational resilience measures rather than relying only on regulatory approval.

ESMA examines custody controls after MiCA licensing

As outlined by ESMA, supervisors will assess digital operational resilience in several critical areas, including private key and storage management, transaction controls, incident response procedures and reliance on third-party technology providers. The review comes soon after MiCA’s transitional period ended, making it one of the first coordinated supervisory exercises under the EU’s crypto rulebook.

In a statement, Sebastien Dessimoz, co-founder and managing partner of digital asset infrastructure company Taurus, said the message from regulators is that obtaining a MiCA licence is only the starting point for custodians.

Dessimoz said custody providers are now expected to demonstrate that their operational controls can withstand real-world risks instead of simply asserting that their systems are secure. He added that as digital assets become more integrated into regulated financial infrastructure, regulators expect the same level of security, accountability and resilience seen in traditional financial markets.

Institutional clients have already increased scrutiny of custody practices, according to Jody Mettler, chief operating officer of BitGo and president of BitGo Trust. In a statement, Mettler said clients increasingly ask how custodians segregate customer assets, manage access controls, respond to security incidents and maintain business continuity during periods of market stress.

She added that regulators are paying closer attention to the operational standards supporting digital asset services rather than limiting their assessment to licensing requirements.

MiCA oversight expands as Europe revisits crypto rules

Industry participants also see the review as an early indication of how MiCA supervision could evolve. Markus Levin, co-founder of blockchain infrastructure company XYO, told Cointelegraph that receiving MiCA authorization and proving operational resilience are separate challenges. He said firms that can demonstrate strong operational controls before supervisory reviews conclude could be better positioned as institutional participation in digital assets increases.

Meanwhile, Yuriy Brisov, a lawyer at Digital & Analogue Partners, said the review combines obligations under both MiCA and the Digital Operational Resilience Act (DORA). According to Brisov, concentration among custody technology providers means weaknesses at a single vendor could affect multiple regulated firms simultaneously, making supply chain resilience a key compliance issue.

At the same time, European regulators are already preparing the next stage of MiCA. According to a Euronews report, European Commission officials are planning a review of parts of the framework from 2027 after the United States enacted the GENIUS Act.

The review is expected to examine how non-EU stablecoin issuers should be treated under existing rules as international crypto regulation continues to develop.

Current market data also shows MiCA’s regulated exchange ecosystem continuing to expand. DefiLlama’s MiCA exchange dashboard, cited by Wu Blockchain, ranked Kraken as the largest regulated venue by liquidity, with more than $400 million in spot liquidity and over $220 million in perpetual liquidity on the live dashboard.

Coinbase remained the second-largest regulated exchange by liquidity, according to the same data, underscoring the growing scale of platforms operating under Europe’s licensing framework.