Cyprus’s financial regulator is turning its attention to how crypto firms protect the assets they hold on behalf of clients. The Cyprus Securities and Exchange Commission (CySEC) has confirmed it will participate in a European Securities and Markets Authority (ESMA) exercise. Its purpose is to examine the digital resilience of crypto-asset custody providers, with inspections due to begin in the second half of 2026.
What the Review Covers
The initiative, known as the 2026 Common Supervisory Action (CSA 2026), was launched by ESMA in cooperation with national regulators across the EU. It targets crypto-asset service providers (CASPs) that offer custody services and assesses the maturity of their digital operational resilience frameworks.
Supervisors will focus in particular on risks tied to distributed ledger technology (DLT), the infrastructure most crypto assets run on. Areas under review include:
- Governance arrangements and internal control frameworks
- Management of digital keys and storage systems
- Transaction controls
- Incident detection and response procedures
- Risks linked to smart contracts
- Firms’ dependence on third-party service providers
Why Custody Is the Focus
Custody sits at the centre of crypto’s operational risk. It’s where digital keys, wallets and client funds are actually held. This is the point where a single security lapse can cause outsized damage. ESMA has flagged both digital operational resilience and CASPs more broadly as priority areas for supervision, and the CSA is designed to bring a consistent approach to how national regulators assess that risk across the bloc.
Timeline and Scope in Cyprus
CySEC has outlined how the exercise will run locally:
- Duration: Second half of 2026 through the first half of 2027
- Method: A risk-based sample of authorised CASPs, selected for on-site inspections and desk-based reviews
- Eligibility: Only firms already authorised and licensed to provide custody services will be included, keeping the local sample consistent with reviews run by other national authorities
- Alignment: The exercise reflects ESMA’s wider supervisory priorities for what it considers a rapidly evolving segment of the financial market
- Reporting: Findings from national regulators will feed into a consolidated report for ESMA’s Board of Supervisors once the exercise wraps up
What It Means for Crypto Firms in Cyprus
For CASPs operating locally, the message is straightforward: the expectations set out in CySEC’s circular on the CSA 2026 exercise are not optional guidance. According to the circular, compliance with its provisions will form part of CySEC’s supervisory review of each firm under the Common Supervisory Action. In other words, a provider’s level of preparedness at this moment will directly shape how it fares once inspectors arrive.
In practice, custody providers are expected to have:
- documented governance processes
- tested incident-response plans
- clear oversight of any third parties involved in safeguarding client assets.
All these should be in force well ahead of any on-site visit or desk-based check.
The Bigger Picture
This upcoming review is just one more item on a growing list of EU-level checks on the crypto sector, together with MiCA and the Digital Operational Resilience Act (DORA).
Since Cyprus has positioned itself as a hub for fintech and crypto-related business, participation in the CSA shows an effort to keep pace with supervisory standards applicable at the EU level. At the same time, it is meant to reassure regulators and clients alike that locally licensed custody providers can withstand real operational stress, not just pass a paper review.
For an island economy where licensing crypto firms has become a significant part of the financial services offering, the outcome of this review could shape how CySEC approaches custody supervision and develops future guidance and licensing expectations for the sector.
