Mark RadarMARK RADAR
EN

EU’s ESMA to Review Crypto Custody Risks

2 reports · First detected 2026-07-08 · Last active 2026-07-10

All crypto companies in the European Union must fully comply with the Markets in Crypto-Assets Regulation, or MiCA, following the end of its transition period on July 1, 2026. The world’s first comprehensive crypto regulatory framework shifts the European Securities and Markets Authority’s role from rulemaking to active supervision. Reviewing custody risks is critical to addressing weaknesses in private-key management and reliance on third parties, protecting investor assets and preserving financial stability.

ESMA has announced a joint supervisory action with regulators in all 27 EU member states to examine the digital operational resilience and custody activities of crypto-asset service providers, or CASPs. The review began in mid-July 2026 and is expected to run through the first half of 2027, with a final report due in the second half of 2027. It will focus on private-key management, responses to cybersecurity incidents and reliance on third-party technology.

All Coverage

2 original reports

The Backstory

The history behind this event
EU Weighs Centralized Crypto Oversight as Malta Opposes Transfer of Powers to ESMA2026-04-13 · 4 reports · similarity 0.81

The European Union's Markets in Crypto-Assets Regulation, or MiCA, entered into force on June 29, 2023. Its stablecoin rules began applying on June 30, 2024, and the regulation became fully applicable on December 30 that year. Crypto-asset service provider licenses and enforcement are currently handled by the EU's 27 member states. Differences in cross-border standards have prompted France and Italy to advocate direct ESMA supervision of large providers.

The European Central Bank recently backed a reform under consideration by the European Commission that would centralize oversight of large crypto-asset service providers, or CASPs, under the European Securities and Markets Authority. The Malta Financial Services Authority opposed the proposal, arguing that it was too soon to restructure responsibilities only about a year and a half after MiCA became fully applicable on December 30, 2024. It said the EU should first improve existing coordination and consistent enforcement.

Mark Radar|MARK RADAR