ESMA launches Common Supervisory Action on CASPs' custody digital operational resilience
National Competent Authorities must assess authorised CASPs' custody digital resilience on a risk-based sample, producing findings for ESMA's consolidated supervisory report
Change
On 8 July 2026 ESMA launched a Common Supervisory Action requiring National Competent Authorities to assess authorised Crypto-Asset Service Providers' digital operational resilience for custody, focusing on DLT governance, key and storage management, transaction controls, incident detection and response, smart contract risks and third-party dependencies; the exercise runs from the second half of 2026 to the first half of 2027.
Why it matters
The CSA requires NCAs to apply a common assessment approach to custody-related DLT risks, collecting evidence on governance, key and storage management, transaction controls, incident detection and response, smart contract risks and third-party dependencies across a risk-based sample of authorised CASPs. ESMA will consolidate NCA findings into a final report for its Board of Supervisors after the exercise concludes in the second half of 2027, driving supervisory convergence on CASP custody resilience across the EU during the exercise period.
Implications
- — National Competent Authorities must select and assess a risk-based sample of authorised CASPs' custody digital operational-resilience frameworks between H2 2026 and H1 2027 and report findings to ESMA — assessments not completed within the exercise window cannot contribute to ESMA's consolidated CSA report.
- — Authorised CASPs providing custody services that fall into an NCA's risk-based sample must be able to evidence DLT governance, key and storage management, transaction controls, incident detection and response, smart contract risk management and third-party dependency controls during the exercise period — gaps in demonstrable controls will be recorded in NCA findings and feed ESMA's convergence report.
Who is affected
- — National Competent Authorities conducting the CSA assessments
- — Authorised CASPs providing custody services in the EU
What to watch
- — H2 2026 to H1 2027 — NCAs conduct the CSA assessment of sampled CASPs' custody digital operational resilience.
- — H2 2027 — ESMA consolidates NCA findings into a final report submitted to its Board of Supervisors following conclusion of the exercise.