meta_id 3381809

On August 6, 2026, the Cyprus Securities and Exchange Commission (CySEC) issued Circular No. C794 to inform Crypto Asset Service Providers (CASPs) that the European Securities and Markets Authority (ESMA) has launched a Common Supervisory Action for 2026 (CSA 2026) in coordination with national competent authorities (NCAs) across the European Union. The CSA will assess the maturity of CASPs' digital operational resilience frameworks specifically relating to custody activities. The supervisory action will evaluate risks inherent to distributed ledger technology (DLT), including governance arrangements, key and storage management, transaction controls, incident detection and response, smart contract risks, and dependencies on third-party providers. CySEC will conduct on-site visits and desk-based reviews on a risk-based sample of authorised CASPs that provide custody services. The exercise will run from the second half of 2026 through the first half of 2027. ESMA developed this CSA to enhance supervisory convergence across the EU in response to identified risks in the rapidly evolving CASP segment, with digital operational resilience designated as a key supervisory priority. CySEC expects CASPs to adhere to the content of the circular, which will form part of the regulator's supervisory review for the CSA 2026. The supervisory focus will encompass governance and control frameworks, storage and key management, transaction controls, threat monitoring and incident response, smart contract controls, and third-party risk management. Authorised CASPs providing custody services should prepare for potential supervisory engagement during this period and ensure their digital operational resilience frameworks align with ESMA's expectations and CySEC's supervisory requirements.