Crypto custody services under the microscope: EU regulators turn their attention to compliance with digital operational resilience rules.

By Stuart Davis, Gabriel Lakeman, and Alain Traill

On 8 July 2026, the European Securities and Markets Authority (ESMA) announced the launch of a Common Supervisory Action (CSA) focusing on the digital operational resilience of cryptoasset service providers (CASPs), with a particular emphasis on custody services.

ESMA has framed the initiative as a response to its risk-based supervisory priorities, which

The rules cover trading admission and market abuse, stablecoin issuance, regulated activities, and how prudential and FCA Handbook requirements will apply to cryptoasset firms.

By Stuart Davis, Gabriel Lakeman, Brett Carr, Emma Trankeenan, Cameron Jones, and Imaan Nazir

On 30 June 2026, the FCA published a suite of policy statements setting out the final rules for the UK’s new cryptoasset regime. The publications mark a significant milestone in the UK’s approach to cryptoasset regulation, moving

  • Permitted payment stablecoin issuers would be required to establish and maintain written, risk-based customer identification programs tailored to their size and business models.
  • The proposed requirements would include reasonable procedures for verifying customer identity, maintaining verification records, checking customers against relevant government

Comprehensive regulation to come with further licensing regimes for crypto advisory and asset management services, in addition to crypto dealing and custody.

By Simon Hawkins and Adrian Fong

On 26 May 2026, the Hong Kong Financial Services and Treasury Bureau (FSTB) and the Securities and Futures Commission (SFC) issued consultation conclusions on their legislative proposals to regulate virtual asset advisory (VA advisory) and virtual asset management (VA management) services (Consultation Conclusions).

This follows their December 2025 consultation conclusions on virtual

  • The European Commission is reviewing MiCA’s suitability through a targeted public consultation, open for comment until 31 August 2026.
  • The review focuses on major policy questions, including the treatment of tokenised financial instruments, the regulation of stablecoins, and the adequacy of the framework for cryptoasset service providers.
  • Participants

The guidance defines certain regulated cryptoasset activities broadly, potentially placing onerous authorisation obligations on DeFi and web3 user interfaces and wallets.

By Stuart Davis, Gabriel Lakeman, Brett Carr, Cameron Jones, and Imaan Nazir

On 15 April 2026, the FCA published draft perimeter guidance (in CP 26/13) that, if finalised in its current form, could bring a large segment of global web3 interface providers and wallets within scope of UK cryptoasset licensing requirements. The guidance interprets