ESMA launches Common Supervisory Action on CASPs’ digital operational resilience for custody

§ 01 Executive Snapshot

• What: ESMA launches a Common Supervisory Action focused on the digital operational resilience of Crypto-Asset Service Providers' custody services.
• Who: European Securities and Markets Authority (ESMA) and National Competent Authorities (NCAs).
• Why it matters: This initiative aims to enhance the supervisory convergence for CASPs in a rapidly evolving market by assessing their digital operational resilience frameworks.

§ 02 Key Developments

• The CSA will specifically assess the maturity of CASPs' digital operational resilience frameworks in relation to custody activities.
• The exercise will focus on risks associated with distributed ledger technology (DLT), including governance arrangements and smart contract risks.
• The exercise will be conducted on a risk-based sample of authorized CASPs by National Competent Authorities (NCAs).

§ 03 Strategic Context

• This CSA responds to ESMA's supervisory priorities that highlight digital operational resilience and CASPs as key risk areas in the financial ecosystem.
• The initiative reflects the need for enhanced oversight in the crypto asset market, particularly as it continues to evolve and mature.

§ 04 Strategic Implications

• Immediate implications include a more rigorous assessment of CASP operational frameworks and potential compliance challenges for these entities.
• Long-term implications may involve improved standards for custody operations among CASPs, potentially leading to increased investor confidence in the crypto market.

§ 05 Risks & Constraints

• Potential risks include regulatory challenges and the complexities involved in assessing digital operational resilience across diverse CASPs.
• Dependencies on third-party providers could introduce additional vulnerabilities that may complicate the assessment process.

§ 06 Watchlist / Forward Signals

• The CSA exercise is expected to run from the second half of 2026 to the first half of 2027, with findings consolidated into a report by the second half of 2027.
• Future developments will signal success or failure based on the findings and recommendations presented to ESMA’s Board of Supervisors after the exercise concludes.