The European Securities and Markets Authority (ESMA) has launched a program of mandatory inspections targeting Crypto Asset Service Providers (CASPs). The main focus is on custodial services that ensure the storage of clients' cryptocurrency assets.

Under this initiative, national competent authorities of EU countries will conduct a detailed audit of how companies manage operational risks. The regulator has highlighted key areas: digital operational resilience of custodians, including key management, transaction control, and incident detection mechanisms.

What exactly will regulators check?

ESMA will focus on six critical areas:

  • Management and internal control;
  • Management of cryptographic keys and vaults;
  • Transaction control and validation;
  • Procedures for identifying and handling security incidents;
  • Risk management related to smart contracts;
  • Dependencies on third-party providers and management of these risks.

Inspections will be conducted based on a risk-oriented sample among already authorized CASPs. The timeframe covers the period from the second half of 2026 to the first half of 2027.

Upon completion of the program, ESMA will systematize the results into a final report, which will be submitted to the board of supervisory authorities for further analysis and possible regulatory adjustments.

Context: MiCA and regulatory expansion

This initiative is a logical continuation of the entry into force of the MiCA regulation. It is worth recalling that on July 1, 2023, the transition period for cryptocurrency platforms in the EU expired. The European Parliament has already approved an official position on further expanding regulation to DeFi, lending, staking, and NFTs.

My comment: This step by ESMA is not just a bureaucratic formality. It is a signal to the market that the regulator intends to strictly control the custodial infrastructure, which is the foundation of trust in digital assets. Given the growth of institutional interest, transparency and operational resilience of custodians will become a key factor for the further development of the market in Europe. Companies that fail to pass such an inspection risk losing their license and access to the European market.