The Cyprus Securities and Exchange Commission (CySEC) is preparing to intensify its oversight of crypto-asset service providers through a series of on-site inspections and desk-based reviews. These supervisory activities form part of a coordinated European initiative and will specifically target firms authorised to deliver digital asset custody services.
The reviews align with the 2026 Common Supervisory Action organised by the European Securities and Markets Authority.
National regulators across the European Union will examine a risk-based selection of authorised providers between the second half of 2026 and the first half of 2027.
In Cyprus, CySEC intends to evaluate a representative sample of local entities that hold the necessary licenses for custody operations.
The primary objective is to determine the strength of each firm’s digital operational resilience framework as it applies to custody functions.
Supervisors will pay close attention to risks associated with distributed ledger technology.
Key areas under scrutiny include governance structures and internal control systems, the secure management of storage solutions and cryptographic keys, controls over transactions, procedures for detecting and responding to incidents, safeguards related to smart contracts, and the handling of risks stemming from reliance on external service providers.
Only already-authorised firms that are licensed to provide custody will be included in the sample.
This approach ensures consistency among participating national authorities. CySEC has indicated that the relevant standards represent mandatory requirements, and the degree of preparedness demonstrated by firms may influence decisions on which entities undergo more detailed examination in subsequent phases.
The exercise reflects broader European supervisory priorities that place digital operational resilience and the crypto-asset sector among the areas requiring enhanced attention.
By coordinating these reviews, authorities aim to promote greater uniformity in oversight practices across the rapidly developing digital asset market.
Findings gathered by national competent authorities will later be compiled into a consolidated report for consideration by ESMA’s Board of Supervisors after the exercise concludes in the second half of 2027.
For crypto firms operating in Cyprus, the forthcoming inspections signal a shift toward more hands-on verification of operational safeguards.
Providers of custody services are expected to demonstrate that their systems and processes can effectively protect client assets against technological and operational threats.
The emphasis on practical resilience rather than purely documentary compliance underscores the maturing regulatory environment for digital assets under frameworks such as the Markets in Crypto-Assets Regulation and the Digital Operational Resilience Act.
Market participants should therefore review their internal arrangements covering key management, access controls, monitoring capabilities and third-party relationships well ahead of the scheduled review period.
Proactive strengthening of these controls will position firms to respond effectively when selected for inspection.
This coordinated supervisory effort marks an important step in building consistent standards for the secure custody of crypto-assets throughout the European Union, with Cyprus playing an active role through CySEC’s planned on-site and remote examinations.