ESMA Shifts Focus to Operational Resilience for Crypto Custodians

Supervisors are examining custody controls, key management, and transaction security to ensure platforms maintain the same standards as traditional financial institutions. This shift signals that obtaining a MiCA license represents only the beginning of regulatory compliance rather than a final stamp of approval. Industry experts note that as digital assets integrate further into the financial sector, the burden of proof for security and accountability has intensified.

Legal and industry observers highlight that this review bridges obligations under MiCA and the Digital Operational Resilience Act. With firms often relying on a concentrated group of technology vendors, regulators are particularly concerned about supply chain vulnerabilities. As the European Commission prepares to revisit the MiCA framework by 2027 in response to evolving international standards like the U.S. GENIUS Act, firms that demonstrate robust, battle-tested operational resilience are likely to secure a stronger competitive advantage in the maturing European market.