The European Securities and Markets Authority isn’t done tightening things up now that MiCA’s transition period is over. ESMA just launched a common supervisory action — that’s official jargon for a coordinated review — aimed directly at crypto custody providers across the EU.
What’ll they be looking at? Key management, storage practices, incident response, and how much these firms rely on outside tech vendors. Basically, the boring operational stuff that matters most when you’re holding other people’s crypto.
National regulators in each EU country will run these reviews between now and mid-2027. They’re picking a risk-based sample of authorized CASPs — crypto-asset service providers — and digging into their governance, transaction controls, and how they handle external dependencies.
BitGo already jumped ahead of this. Last month they launched a Europe-focused crypto-as-a-service platform aimed at helping exchanges keep their market access while working through MiCA compliance.
The findings get consolidated into a final ESMA report in the second half of 2027. So don’t expect quick results. But the message is clear: custody isn’t just a checkbox anymore. EU regulators want to see the receipts.
