Key facts
- ESMA has launched a Common Supervisory Action (CSA) to review the operational resilience of crypto asset service providers (CASPs).
- The review specifically targets custody services under the EU's Markets in Crypto-Assets Regulation (MiCA).
- CASPs will be assessed on their ability to demonstrate security and resilience in areas like key management and incident response.
- This initiative signifies a move from simply obtaining a license to proving operational robustness.
- The review integrates requirements from both MiCA and the Digital Operational Resilience Act (DORA).
The European Securities and Markets Authority (ESMA) has initiated a Common Supervisory Action (CSA) to scrutinize the operational resilience of crypto asset service providers (CASPs) operating under the Markets in Crypto-Assets Regulation (MiCA).
The review, which focuses on custody services, aims to assess whether licensed firms can meet stringent security and resilience standards, moving beyond the initial authorization phase. This marks one of the first major supervisory exercises under the EU's new crypto framework.
Industry executives view this as a significant shift, expecting custody providers to demonstrate their operational controls rather than just claim them. The CSA will examine frameworks for key and storage management, transaction controls, incident response, and third-party dependencies. This development aligns with the increasing integration of digital assets into regulated financial infrastructure, requiring traditional market-level security and accountability.
The review operates under both MiCA, which sets custody obligations, and the Digital Operational Resilience Act (DORA), which outlines technology risk requirements for financial entities. Experts note that the concentration of custody technology in a few vendors presents a challenge, as a single weak supplier could impact many firms. The findings from this review are expected to inform ongoing debates about MiCA's future and the potential for more centralized crypto supervision by ESMA.