ESMA Targets CASP Custody Resilience

The European Securities and Markets Authority (ESMA) has announced a Common Supervisory Action (CSA) on the digital operational resilience of crypto-asset service providers (CASPs), with custody services singled out as the priority area.

National Competent Authorities (NCAs), including the Central Bank of Ireland, will carry out the exercise over the second half of 2026 and the first half of 2027, examining a risk-based sample of authorised CASPs.

What does the CSA cover?

The exercise will assess the maturity of CASPs’ digital operational resilience arrangements in relation to custody activities.

ESMA will focus on risks inherent to distributed ledger technology, including governance arrangements, key and storage management, transaction controls, incident detection and response, smart contract risk, and dependencies on third-party providers.

A consolidated report will go to ESMA’s Board of Supervisors once the exercise concludes, expected in the second half of 2027.

Custody, in this context, means holding crypto-assets or the means of accessing them on behalf of clients. It is considered one of the highest-risk CASP services because a failure is often irreversible. If a private key is lost, stolen, or mismanaged, the underlying assets can be permanently inaccessible or transferred without recourse.

The areas being covered under the CSA are all related to a CASP’s compliance with the Digital Operational Resilience Act (DORA). DORA governs the resilience of the technology underpinning the custody function. It requires financial entities, among other things, to maintain an internal governance and control framework; to have mechanisms in place for ICT risk identification and protection, and for incident detection and response; and to oversee ICT third-party providers. DORA has been enforceable as mandatory law since January 2025, with supervisory expectations having previously detailed that compliance with DORA is expected once a CASP receives authorisation.

What should CASPs be doing now?

CASPs should be aware that they may be contacted directly by their NCA as part of the exercise, but which CASPs will be contacted and the precise form that engagement takes is a matter for each NCA.

However, CASPs should use this time to prepare themselves to respond to the queries likely to be raised by NCAs. In practical terms, that means reviewing operations and documentation to ensure material compliance with DORA is demonstrable, as this will cover many of the areas identified under the CSA.