ESMA launches Common Supervisory Action on CASPs’ digital operational resilience for custody
The European Securities and Markets Authority (ESMA), the EU regulator and supervisor, is launching a Common Supervisory Action (CSA) focusing on the digital operational resilience of Crypto-Asset Service Providers (CASPs), with a specific emphasis on custody services.
The CSA will assess the maturity of CASPs’ digital operational resilience frameworks in relation to custody activities. It will focus on risks inherent to distributed ledger technology (DLT), including governance arrangements, key and storage management, transaction controls, incident detection and response, smart contract risks, and dependencies on third-party providers.
National Competent Authorities (NCAs) will carry out the exercise on a risk-based sample of authorised CASPs. The exercise will run from the second half of 2026 to the first half of 2027.
This initiative responds to ESMA’s risk-based supervisory priorities, which identify both digital operational resilience and CASPs as key areas of risk. ESMA has developed this CSA to enhance supervisory convergence in a rapidly evolving segment of the market.
Next steps
The findings collected from NCAs will be consolidated into a final report, which will be submitted to ESMA’s Board of Supervisors following the conclusion of the exercise in the second half of 2027.
Further information:
Cristina Bonillo
Senior Communications Officer
press@esma.europa.eu