Regulation · MiCA · DORA · 8 JUL 2026
ESMA CSA Targets CASP Custody Resilience
ESMA has launched a Common Supervisory Action focused on digital operational resilience for CASPs providing custody services. National competent authorities will conduct coordinated reviews across the EU under this exercise.
ESMA announced on 8 July 2026 that it is running a Common Supervisory Action examining digital operational resilience at CASPs, with custody services as the primary focus. The CSA coordinates national competent authorities, meaning firms can expect NCA-led reviews rather than direct ESMA engagement. CASPs offering custody should anticipate scrutiny of ICT risk management frameworks, business continuity arrangements and incident response procedures as they apply to custodial operations. A CSA typically concludes with supervisory feedback or follow-up requirements at firm level. Priority actions include reviewing ICT documentation, third-party contracts covering custody infrastructure and incident notification processes against DORA requirements.