EU supervisors put crypto custody resilience under closer review

-

The European Securities and Markets Authority (ESMA) has begun a coordinated supervisory exercise examining how authorised crypto-asset service providers protect custody operations from technology and operational failures.

Announced on 8 July 2026, the Common Supervisory Action will be carried out by national competent authorities on a risk-based sample of authorised providers. The exercise is scheduled to run from the second half of 2026 through the first half of 2027, with a consolidated report expected to reach ESMA's Board of Supervisors in the second half of 2027.

What supervisors will examine

ESMA identified six broad areas of attention:

  • governance arrangements;
  • cryptographic key and storage management;
  • transaction controls;
  • incident detection and response;
  • smart-contract risks; and
  • dependence on third-party providers.

These controls matter because a custody service can fail even when the underlying blockchain continues to operate. An exchange or custodian may depend on hot and cold wallets, access-control systems, transaction-signing procedures, cloud infrastructure, software suppliers and internal recovery processes. Weakness in any part of that chain can interrupt withdrawals or expose assets and data.

The exercise sits within a broader EU framework. The Digital Operational Resilience Act, generally known as DORA, applies to crypto-asset service providers authorised under the Markets in Crypto-Assets Regulation (MiCA). DORA establishes requirements covering ICT risk management, incident handling, resilience testing and third-party technology risk.

What the announcement does — and does not — establish

The confirmed fact is that ESMA has launched a coordinated review and specified its scope and timetable. The announcement does not say that every authorised provider will be examined, nor does it identify a provider as unsafe or accuse one of misconduct.

It is reasonable to expect the exercise to make supervisory practices more consistent and to increase attention on custody controls. That is an inference from the stated purpose of the review, not a guarantee of a particular enforcement outcome.

Regulatory authorisation also should not be confused with a guarantee. A licence or register entry does not eliminate cyber risk, counterparty risk, insolvency risk, liquidity constraints, software defects or the possibility of human error.

What users can check now

EU users can consult ESMA's current MiCA register and the relevant national regulator to verify the legal entity providing a service. The name on an app or website may not, by itself, identify the entity holding customer assets.

Before depositing funds, users should also review the provider's custody and withdrawal terms, asset-segregation disclosures, incident procedures and available account-security controls. Keeping assets in self-custody can reduce reliance on a provider, but it transfers responsibility for seed phrases, private keys, backups and transaction verification to the user.

The practical lesson is not that one custody model is risk-free. It is that users should understand which risks they are accepting, verify a provider's current status and avoid treating regulatory supervision as insurance against loss.

Primary sources

This article is for general information and education only. It is not financial, investment, legal or cybersecurity advice. Crypto-assets and custody arrangements can involve loss of capital, fraud, operational failure, cyberattack and regulatory risk.

Comments

Post a Comment

Popular posts from this blog

Ethereum's 2026 roadmap: shipped upgrades versus future plans

-
Ethereum's roadmap changed substantially between 2024 and 2026. Dencun activated in March 2024, Pectra followed in May 2025, and Fusaka activated in December 2025. The next named upgrade is Glamsterdam—but users should distinguish completed upgrades from proposals and estimated dates. What has already happened Dencun introduced blob transactions that reduced the cost of posting rollup data. Pectra included changes such as EIP-7702, which allows externally owned accounts to delegate functionality to smart-contract code. Fusaka added further scaling and data-availability improvements. These are historical activations, not future promises. Their practical effects still depend on wallets, applications, network demand and how developers implement the new capabilities. What is planned next Ethereum.org identifies Glamsterdam as the next named upgrade. Block-level Access Lists and enshrined proposer-builder separation have been described as headline items, with an expected activation...
Read more

UK crypto regulation: what changes in October 2027

-
The United Kingdom created a broader cryptoasset regulatory framework in 2026, but the main new authorisation regime is not yet fully in force. HM Treasury says the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 will take effect in October 2027. That timing matters. A company saying it is “registered in the UK” today should not automatically be described as already authorised under the future regime. What the 2026 Regulations establish The Regulations bring specified cryptoasset activities into the UK's regulated-activities framework. When the relevant provisions commence, firms carrying on those activities will generally need authorisation from the Financial Conduct Authority (FCA), unless an exclusion or another applicable status applies. HM Treasury's April 2026 policy note says the framework was made in February 2026 and comes into force in October 2027. The government also proposed amendments dealing with stablecoin payment services and other t...
Read more

What the SEC's 2026 crypto interpretation actually says

-
On 17 March 2026, the US Securities and Exchange Commission issued an interpretation explaining how federal securities laws apply to several types of crypto assets and transactions. The Commodity Futures Trading Commission joined the interpretation with guidance on how its staff would administer the Commodity Exchange Act consistently with it. The headline is important but easy to oversimplify: the SEC said most crypto assets are not themselves securities. That does not mean every sale, distribution, staking service or investment arrangement involving a token falls outside securities law. What the interpretation covers The interpretation provides a taxonomy covering digital commodities, digital collectibles, digital tools, stablecoins and digital securities. It also addresses protocol mining, protocol staking, airdrops and the wrapping of non-security crypto assets. A central distinction is between an asset and the transaction or arrangement through which it is offered. A non-secur...
Read more