ESMA Launches Common Supervisory Action on Digital Operational Resili…

ESMA launched a Common Supervisory Action (CSA) on 8 July 2026 targeting digital operational resilience of cryptoasset service providers (CASPs), particularly custody services, with national regulators conducting risk-based reviews from H2 2026 through H1 2027. The action focuses on DLT governance, key management, transaction controls, incident response, smart contracts, and third-party dependencies under MiCA and DORA frameworks. If you hold customer crypto in Europe, national regulators will audit your key management, smart contract code, and incident response between now and mid-2027—and they're looking for failures, not boxes ticked. DORA compliance is no longer a future problem; it's being tested now against live custody operations.