ESMA’s Evaluation of Crypto Custodians
The European Securities and Markets Authority (ESMA) is set to evaluate crypto custodians authorized under the Markets in Crypto-Assets (MiCA) regulation, marking a shift from merely issuing licenses to assessing the practical management of operational risks by these firms. This initiative, known as a Common Supervisory Action (CSA), will scrutinize a selection of authorized crypto-asset service providers (CASPs) to ensure they possess robust operational resilience capabilities beyond their regulatory approvals.
Focus on Custody Services
Central to ESMA’s review is a focus on custody services, where supervisors will investigate crucial operational areas such as:
- Handling of private keys
- Asset storage practices
- Transaction oversight
- Incident response strategies
- Reliance on external technology partners
This review follows closely on the heels of MiCA’s transitional period conclusion, representing one of the initial coordinated oversights under the EU’s crypto regulatory framework.
Industry Perspectives
Sebastien Dessimoz, co-founder and managing partner of Taurus, emphasized that securing a MiCA license should be seen as just the beginning for custodians. An essential expectation now is that custody providers must showcase their operational controls’ ability to endure actual market risks instead of merely claiming their systems’ security.
As the integration of digital assets into the broader regulated financial system grows, regulators anticipate that firms will maintain the same rigorous standards of security, responsibility, and resilience found in traditional finance. Jody Mettler, COO of BitGo, corroborated this, asserting that institutional investors are becoming increasingly vigilant about how custodians manage customer asset segregation, access controls, security incident responses, and business continuity amid market fluctuations.
Future of MiCA Oversight
Industry experts recognize this review as a precursor to how MiCA oversight may develop going forward. Markus Levin, co-founder of blockchain infrastructure company XYO, observed that while obtaining MiCA authorization is one challenge, establishing operational resilience presents a separate set of hurdles. Firms capable of demonstrating solid operational controls may find themselves in a favorable position as institutional interest in digital assets increases.
Yuriy Brisov, a legal expert from Digital & Analogue Partners, mentioned that this review unifies the requirements of both MiCA and the Digital Operational Resilience Act (DORA). He noted that the concentration of custody technology providers poses risks, as vulnerabilities in a single vendor could impact multiple firms under regulation, thus highlighting the importance of supply chain resilience in compliance.
Looking Ahead
In tandem with these evaluations, European authorities are contemplating future adjustments to the MiCA framework. A report from Euronews indicates that European Commission officials are planning to revisit certain elements of MiCA by 2027, particularly in light of the United States’ recent introduction of the GENIUS Act. This review aims to clarify how non-EU stablecoin issuers should be regulated as global crypto regulations continue to progress.
Current Landscape of MiCA-Regulated Exchanges
Current data on the MiCA-regulated exchange landscape reveals ongoing growth within this ecosystem. According to DefiLlama’s MiCA exchange dashboard, Kraken has emerged as the largest regulated exchange by liquidity, boasting over $400 million in spot liquidity and more than $220 million in perpetual liquidity, while Coinbase ranks as the second-largest regulated platform. This illustrates the expanding scale of exchanges operating under Europe’s regulatory framework for crypto assets.
