The European Securities and Markets Authority (ESMA) has directed National Competent Authorities to launch a Common Supervisory Action assessing crypto-asset service providers’ (CASPs) digital operational resilience for custody, running from 8 July 2026.
NCAs will examine a risk-based sample of authorised CASPs for the maturity of their digital operational resilience frameworks around custody, focusing on distributed ledger technology risks including governance arrangements, key and storage management, transaction controls, incident detection and response, smart contract risks, and dependencies on third-party providers.
The exercise runs through the first half of 2027, after which NCAs’ findings will be consolidated into a final report for ESMA’s Board of Supervisors.
