ESMA launches a Common Supervisory Action with NCAs on CASPs’ digital operational resilience for custody

TO : Crypto Asset Service Providers (CASPs) FROM : Cyprus Securities and Exchange Commission DATE : 6 August 2026 CIRCULAR NO. : C794 SUBJECT : ESMA launches a Common Supervisory Action with NCAs on CASPs’ digital operational resilience for custody

1. The Cyprus Securities and Exchange Commission (“the CySEC”) wishes, with this circular, to inform the Crypto Asset Service Providers (CASPs) that the European Securities and Markets Authority (“ESMA”) has launched a Common Supervisory Action for 2026 (“CSA 2026”) with national competent authorities (“NCAs”) on CASPs’ digital operational resilience for custody.

2. The CSA will assess the maturity of CASPs’ digital operational resilience frameworks in relation to custody activities. It will focus on risks inherent to distributed ledger technology (DLT), including governance arrangements, key and storage management, transaction controls, incident detection and response, smart contract risks, and dependencies on third-party providers. National Competent Authorities (NCAs) will carry out the exercise on a risk-based sample of authorised CASPs. The exercise will run from the second half of 2026 to the first half of 2027. This initiative responds to ESMA’s risk-based supervisory priorities, which identify both digital operational resilience and CASPs as key areas of risk. ESMA has developed this CSA to enhance supervisory convergence in a rapidly evolving segment of the market.

3. In the context of the CSA 2026, CySEC is planning to conduct on-site visits and/or desk-based reviews on a sample of CASPs. To ensure a minimum level of consistency in the sample across NCAs, NCAs should select only CASPs that: • have already been authorised and • are authorised to provide custody services (to be consistent with the scope of the CSA described above).

4. The CSA will focus on the following digital operational resilience risks:

• Governance and control framework.
• Management of storage and keys.
• Controls over transactions.
• Threat monitoring, incident detection and response.
• Controls on smart contracts.
• Third party risk management. Therefore, CySEC expects CASPs to adhere to the content of this Circular as it will form part of CySEC’s supervisory review for the purposes of the CSA 2026. Sincerely, George Theocharides Chairman Cyprus Securities and Exchange Commission