European Regulators Launch Joint Cyber Resilience Check for Crypto Custodians

Highlights:

• The ESMA has initiated a project to jointly review crypto custodians in the EU to assess their cybersecurity and operational resilience.
• National regulators will study governance issues, major storage controls, transaction controls, smart contracts and cyber response plans.
• The findings will help ESMA to evaluate risks, enhance investor protection and harmonise crypto supervision across Europe.

The European Securities and Markets Authority (ESMA) announced a new joint supervisory action on July 8 to evaluate the cybersecurity and operational stability of crypto firms across the European Union. According to ESMA, this initiative specifically targets Crypto-Asset Service Providers (CASPs) that offer custody services. The goal is to ensure these companies can safely hold and manage digital assets for their clients.

JUST IN: ESMA launches first coordinated crypto custody review after MiCA enters full enforcement

The European Securities and Markets Authority (ESMA) has launched its first Common Supervisory Action (CSA) on crypto-asset service providers (CASPs) since MiCA entered full… pic.twitter.com/n4s3DwsprY

— Wu Blockchain (@WuBlockchain) July 8, 2026

ESMA Examines How Custodians Handle Cyber Risks

This Common Supervisory Action (CSA) will assess how effectively crypto firms manage digital operational risks. National regulators from different EU countries will conduct the assessments on a selected group of authorized crypto businesses. They will look closely at how these companies use distributed ledger technology (DLT), which is the underlying database system behind most cryptocurrencies. 

The reviews will cover several critical areas, including internal governance, the storage of cryptographic keys and assets, transaction controls, and smart contract vulnerabilities. Regulators will also check how quickly firms can detect and respond to cyber incidents, ensuring they have solid recovery plans in place.

Custody services play a significant role in the crypto market by holding digital tokens on behalf of investors. When a crypto firm manages these assets, any weakness in their digital defenses could lead to severe financial losses. By focusing heavily on custody providers, European regulators aim to protect everyday investors from hacks, system failures, and operational mistakes. 

The exercise will also examine how much these crypto companies rely on outside technology vendors. If a third-party provider experiences a major outage, the crypto firm must still be able to operate smoothly and keep client funds secure.

ESMA Sets Timeline for EU-Wide Crypto Custody Review

Prior to this, various European nations may have been more or less rigorous in regulating cryptocurrency companies. This is a joint effort that unites all national regulators. With this standardized approach, ESMA aims to establish a level playing field for the European market. The assessments will take place from the second half of the year to the first half of 2027. The national authorities will then return the collected data to ESMA for further analysis once the national authorities have completed their review.

The European regulator will then merge all the results into a final report. This document will be submitted to the ESMA Board of Supervisors in the second half of 2027. The move marks a wider European Union drive to bring in tougher regulations for digital finance.

The EU Digital Operational Resilience Act requires financial institutions, including cryptocurrency businesses, to have effective technology risk management frameworks in place. This new action will allow crypto custodians to be fully compliant with these strict European standards. In the end, these synchronized security sweeps will help foster trust in the digital asset market by demonstrating the resilience of European crypto companies against today’s cyber threats.