ESMA launches Common Superviso... Note

ESMA launches Common Supervisory Action on CASPs’ digital operational resilience for custody

The European Securities and Markets Authority is initiating a Common Supervisory Action (CSA) for Crypto-Asset Service Providers (CASPs). This action specifically targets their digital operational resilience, with a focus on custody services. The CSA aims to evaluate how well CASPs manage risks associated with distributed ledger technology in their custody operations. Key areas of assessment will include governance, key and storage management, and transaction controls. Incident detection, response mechanisms, and smart contract risks are also under scrutiny. Furthermore, the CSA will examine CASPs' reliance on third-party providers. National Competent Authorities will conduct this assessment using a risk-based selection of authorized CASPs. The supervisory exercise is scheduled to take place from the latter half of 2026 through the first half of 2027. This initiative aligns with ESMA's identified risk priorities concerning digital operational resilience and CASPs. ESMA seeks to foster greater supervisory consistency across the EU in this dynamic market sector. A comprehensive report summarizing the findings will be presented to ESMA's Board of Supervisors in the second half of 2027.