EU Regulators Turn Focus to Crypto Custody Resilience After MiCA Licensing

Getting licensed under the European Union’s Markets in Crypto-Assets Regulation is turning out to be just the first step for crypto custodians. The European Securities and Markets Authority launched a Common Supervisory Action this week to examine how well crypto asset service providers can withstand operational risks, with custody services at the center of the review.

Sebastien Dessimoz, co-founder of digital asset infrastructure firm Taurus, said the message to custodians is clear: a license marks the start of scrutiny, not the end of it. The review comes shortly after MiCA’s transitional period wrapped up, making it one of the first major supervisory exercises under the bloc’s crypto framework.

Regulators Want Proof, Not Just Claims

According to ESMA, the review will look at how mature these firms‘ digital resilience frameworks are, covering key management, storage, transaction controls, incident response, and reliance on outside vendors. Dessimoz described the shift as moving from asserting security to actually demonstrating it. BitGo Trust president Jody Mettler said institutional clients are already asking harder questions about asset segregation, access controls, and business continuity during market stress.

Two Regulations, One Supply Chain Problem

Lawyer Yuriy Brisov noted the review falls under both MiCA and the EU’s Digital Operational Resilience Act at the same time, and warned that custody technology is concentrated among a small number of vendors, meaning one weak link could affect many firms. He added the findings could shape debate over shifting crypto supervision from national regulators to ESMA directly.