Key Takeaways
- CySEC and ESMA announced joint digital resilience audits for crypto custody providers under CSA 2026.
- EU crypto custodians must prove strict compliance across 6 core operational risk areas.
- CySEC will execute on-site and desk reviews on a sample of firms from H2 2026 to H1 2027.
Targeting Custody and Infrastructure Risks
The Cyprus Securities and Exchange Commission (CySEC) will launch a wave of on-site visits and desk-based reviews targeting authorized crypto asset service providers (CASPs) as part of a broader European effort to strengthen operational resilience in digital asset custody.
In a circular issued to regulated firms, CySEC chairperson George Theocharides said the regulator is preparing to audit a representative sample of local crypto entities under the Common Supervisory Action for 2026, coordinated by the European Securities and Markets Authority (ESMA).
The enforcement initiative, scheduled to run from the second half of 2026 through the first half of 2027, marks a significant increase in direct regulatory scrutiny for crypto firms operating in Cyprus.
The inspections will focus on authorized CASPs approved to offer digital asset custody services. Regulators aim to assess the maturity of these firms’ operational security and technical infrastructure, with particular attention to risks tied to distributed ledger technology.
CySEC said the supervisory reviews will examine key operational resilience areas, including governance and control frameworks, as well as key and storage management. The regulator will also review security protocols governing private keys, wallet storage and access controls.
Other areas under review include transaction controls, monitoring and incident response, smart contract security and third-party risk management.
The initiative aligns CySEC with national competent authorities across the European Union and responds directly to ESMA’s risk-based supervisory priorities. EU regulators have repeatedly identified operational resilience and digital asset custodians as high-risk focal points for financial stability and investor protection.
By establishing a standardized framework for on-site visits and desk audits, ESMA and national regulators aim to promote supervisory convergence across member states and ensure uniform security expectations as the crypto ecosystem continues to integrate with traditional finance.
CySEC, which issued a consultation paper in late 2025 proposing a new directive on prudential information reporting for crypto asset service providers, warned local firms that the standards outlined in the circular are mandatory. The regulator said compliance readiness will serve as the baseline for selecting CASPs for upcoming inspections.
