The European Securities and Markets Authority (ESMA) has launched a large-scale inspection of crypto-asset service providers (CASPs), with a particular focus on custodial services. This is not just a formal inspection — it is a deep audit of digital operational resilience that will cover all key aspects of digital asset custody.

The regulator's focus is on managing operational risks in cryptocurrency custody. ESMA intends to assess how effectively companies are addressing challenges related to distributed ledger technology. The inspection will cover six key areas:

  • management and internal control;
  • key and vault management;
  • transaction control and monitoring;
  • incident detection and handling procedures;
  • risk management related to smart contracts;
  • dependencies on third-party providers.

The sample of CASPs for inspection will be formed based on a risk-oriented approach. This means that companies with high volumes of assets under custody or vulnerabilities in operational processes may face the greatest scrutiny. The review is scheduled from the second half of 2026 to the first half of 2027.

Upon completion of the program, ESMA will prepare a final report with summarized findings and submit it to the board of supervisory authorities. This will be an important signal for the market: the regulator intends to systematically strengthen oversight of custodial infrastructure.

Recall that from July 1, the transition period for crypto platforms under the MiCA regulation ended in the EU. The European Parliament has already approved an official position on expanding regulation to DeFi, lending, staking, and NFTs. It is clear that ESMA is increasing pressure on the industry, and custodians are just the first stage. The market should prepare for stricter requirements regarding operational reliability and transparency.

As an analyst, I believe this initiative is a logical step following MiCA's full implementation. Custodians are the "circulatory system" of the crypto market, and their vulnerabilities could create systemic risks. Although the ESMA inspection is scheduled for 2026-2027, it is already prompting companies to review their security procedures. This is a positive signal for institutional investors seeking reliable and regulated platforms for asset custody.