For EU crypto custodians, the grace period is over. With the Markets in Crypto-Assets regulation now fully enforced, the European Securities and Markets Authority has moved from rulemaking to active supervision. Its first Common Supervisory Action on crypto-asset service providers puts custody operations under direct scrutiny, according to the original report. National regulators will begin risk-based reviews that continue into 2027, focusing on governance, key management, transaction controls, incident response, smart contract risks, and third-party dependencies.
The CSA is not a one-off check. It is a structured, coordinated effort across all member states to test the digital operational resilience of firms holding client crypto assets. ESMA’s decision to make custody the first target highlights where regulators see the greatest risks. Private key mismanagement, flawed transaction approval processes, and reliance on outsourced infrastructure have long been weak points in crypto. Regulators will now measure them against the same supervisory expectations applied to traditional financial market infrastructures.
What the Review Actually Covers
Governance reviews will examine whether boards have real oversight of custody operations, rather than just paper policies. Key management assessments will examine how private keys are generated, stored, rotated, and recovered—often the most difficult part of any custody setup.
Transaction controls will test how firms authorize and monitor outgoing transfers to prevent internal fraud or external breaches. Incident response planning, which remains immature at many crypto firms, will face particular pressure. Smart contract risks are also included, recognizing that custody increasingly involves programmatic controls on-chain, not just offline storage.
Third-party dependencies add another layer. Many EU custodians rely on sub-custodians, cloud providers, or specialized blockchain infrastructure firms. ESMA wants assurance that these relationships do not create hidden concentration risks or compliance gaps.
This broad scope mirrors the operational resilience frameworks applied to banks and central securities depositories under DORA and other EU regulations. For crypto-native companies that grew up outside that system, the expectations will be new and, in some cases, uncomfortable.
This is happening as institutional staking and custody converge, as shown by a Nasdaq-linked firm offering staking services for Sui. The development is part of a broader shift that places institutional staking and custody under the same operational demands as traditional asset servicing.
MiCA’s Full Enforcement Changes the Game
MiCA was phased in over several stages, but full enforcement gives ESMA the legal authority to run common supervisory actions, as it does for securities markets. The CSA is designed to ensure that the same rulebook is applied consistently from Lisbon to Helsinki.
Without it, national regulators might interpret custody requirements differently, creating regulatory arbitrage. The 2027 timeline shows that this is not a snapshot review. It can adapt as risks change and may lead to follow-up actions or binding technical standards.
While Europe’s regulators are already conducting coordinated inspections, the U.S. is still debating foundational crypto legislation. Banks are trying to kill a landmark crypto bill days before a Senate vote, leaving the American custody market in limbo.
That contrast sends a clear message to firms operating in both jurisdictions: EU regulatory clarity is becoming direct supervisory pressure, while the gap with the U.S. is widening.
What’s Still Unclear
ESMA has not disclosed which custodians will be examined or how sampling will work. The CSA is risk-based, so larger, systemically important custodians are likely to face deeper assessments. Smaller firms should not assume they will avoid scrutiny.
The next question is what happens after the findings. Common supervisory actions often lead to public reports that describe deficiencies without identifying specific firms. They can also trigger enforcement proceedings if regulators find serious lapses. For custodians that have operated under light-touch national regimes, the shift could be jarring.
The cost burden is another unknown. Smaller crypto startups may struggle to meet the governance and operational requirements without significant spending. That could accelerate consolidation and push custody into the hands of better-capitalized players.
At the same time, demand for compliant custody is growing quickly. Tokenization of real-world assets just crossed $20 billion on-chain, as detailed in the latest tokenization roundup. Safe, regulated custody infrastructure is therefore becoming an urgent need, not a future option.
For EU crypto market participants, the review provides a clear benchmark. The era of informal oversight is ending. Custody resilience is no longer just a competitive differentiator; it is a regulatory requirement with teeth.
