The European Securities and Markets Authority (ESMA) has launched a coordinated review of crypto custody providers after the European Union's Markets in Crypto-Assets (MiCA) transition period ended. Announced on July 8, 2026, the supervisory action will examine how authorized crypto-asset service providers (CASPs) protect client assets through secure custody practices, operational resilience, and risk management.
National regulators across the EU will inspect a risk-based sample of licensed firms during the review, which runs from the second half of 2026 through the first half of 2027. The initiative follows MiCA's full implementation on 1 July and marks a shift from licensing toward ongoing compliance and supervision.
ESMA opened the Common Supervisory Action (CSA) as part of its risk-based supervisory priorities. The regulator identified operational resilience and the activities of crypto-asset service providers as areas requiring closer oversight across the European Union. As a result, national competent authorities will assess selected licensed firms rather than inspect every authorized provider.
The review will examine how firms manage digital asset custody under the MiCA framework. Regulators will evaluate governance arrangements, private key management, storage controls, transaction monitoring, and incident detection procedures. They will also assess smart contract risks and firms' reliance on third-party technology providers that support custody operations.
According to ESMA, distributed ledger technology introduces operational risks that require consistent supervision. Since custody providers safeguard the private keys controlling access to client assets, regulators will examine whether firms have mature operational resilience frameworks capable of protecting those holdings.
The supervisory action comes days after the MiCA transitional period expired on July 1, 2026. From that date, any company offering crypto services in the European Union without MiCA authorization violates EU law. Consequently, ESMA has instructed unauthorized firms to stop providing services and implement orderly wind-down plans.
Those exit plans require firms to notify clients before ending services. They must also allow customers to transfer their crypto-assets either to an authorized provider or to a self-hosted wallet. At the same time, MiCA prevents authorized firms from outsourcing custody services to entities that lack CASP authorization.
Furthermore, ESMA said the review introduces no new custody obligations. Instead, regulators will measure whether licensed firms already comply with the operational standards established under MiCA.
Read More: MiCA Deadline and U.S. Jobs Report Put Crypto Markets on Alert
The custody review covers a market with substantial value. According to CoinPaprika data cited by ESMA, the global cryptocurrency market stood at about $2.25 trillion on July 8, 2026, after declining roughly 2% during the previous 24 hours. Since custodians control the private keys securing client assets, key management remains central to the supervisory exercise.
Under MiCA, custody providers remain liable when incidents attributable to them result in client asset losses. Their liability is capped at the market value of the lost crypto-assets. Therefore, regulators will closely examine whether firms maintain controls capable of reducing operational failures and protecting customer holdings.
The Common Supervisory Action will continue until the first half of 2027. Afterward, ESMA will consolidate the results into a report for its Board of Supervisors during the second half of 2027. The findings will not identify individual firms, but they will guide how national regulators apply MiCA standards and supervise crypto custody providers across the European Union.
ESMA has launched an EU-wide review of licensed crypto custody providers following the end of MiCA's transition period. The assessment will examine operational resilience, key management, governance, and custody controls while helping national regulators apply consistent supervisory standards across the European Union.