ESMA Launches First EU-Wide Crypto Custody Check Under MiCA

The European Securities and Markets Authority has kicked off an EU-wide examination of how crypto custody providers handle client assets. It is the first coordinated supervisory review under the Markets in Crypto-Assets Regulation, known as MiCA, and it shifts the regulatory focus from rulemaking to active compliance checks.

The review targets authorized Crypto-Asset Service Providers, or CASPs. It centers on segregation of client funds and risk management. The regulator is assessing compliance with MiCA's Article 75, which requires firms to keep client Bitcoin, ether, and other crypto assets separate from their own holdings and to prove they can survive operational disruptions without losing client money.

No specific CASPs or protocols have been named. ESMA designed this as a broad thematic review, meaning the regulator is evaluating the entire sector rather than picking off individual bad actors. The goal is supervisory convergence – a bureaucratic term for ensuring that a crypto custodian in Estonia faces the same standards as one in France.

The July 2026 Deadline

MiCA's transitional period ends July 1, 2026. After that date, any CASP operating without proper authorization must stop providing services to EU clients. The only exception is for orderly wind-downs, where unauthorized providers can maintain custody solely to help existing clients exit their positions. No new onboarding is allowed.

ESMA has also closed a potential loophole. Unauthorized CASPs are explicitly barred from outsourcing custody obligations to other unlicensed entities. A firm without authorization cannot park client assets with another unauthorized provider and claim compliance by proxy.