Share on LinkedInShare on LinkedIn

ARTICLE · 17 SEPTEMBER 2026

ESMA Targets CASP Custody Resilience

William Fry LLP
William Fry LLP
Contributor
William Fry LLP

William Fry LLP

William Fry advises leading Irish and international companies, covering both the public and private...

View firm profile
Explore more from William Fry LLP

European securities regulators are launching a comprehensive assessment of crypto-asset service providers' digital operational resilience, with a particular focus on custody activities and distributed ledger technology risks. The exercise will examine how firms manage critical areas including key storage, transaction controls, incident response, and third-party dependencies under the newly enforceable Digital Operational Resilience Act.

IrelandFinance and Banking
John O'Connor
John O'Connor
Shane Kelleher
Shane Kelleher
Louise McNabola
Louise McNabola
Author LinkedIn connections

The European Securities and Markets Authority (ESMA) has announced a Common Supervisory Action (CSA) on the digital operational resilience of crypto-asset service providers (CASPs), with custody services singled out as the priority area.

National Competent Authorities (NCAs), including the Central Bank of Ireland, will carry out the exercise over the second half of 2026 and the first half of 2027, examining a risk-based sample of authorised CASPs.

What does the CSA cover?

The exercise will assess the maturity of CASPs’ digital operational resilience arrangements in relation to custody activities.

ESMA will focus on risks inherent to distributed ledger technology, including governance arrangements, key and storage management, transaction controls, incident detection and response, smart contract risk, and dependencies on third-party providers.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

Final EBA Guidelines On The Sound Management Of Third-party Risk: What Financial Entities Need To Know

The European Banking Authority has published final Guidelines on the sound management of third-party risk regarding non-ICT services, replacing the 2019 Outsourcing Guidelines and introducing a broader regulatory framework. Financial entities will need to navigate expanded scope requirements, enhanced governance standards, and alignment with DORA while managing compliance timelines and contractual obligations.
IrelandFinance and Banking
Arthur Cox
Arthur Cox
Article

Alternative Investment Funds

Ireland offers a sophisticated regulatory framework for Alternative Investment Funds, with structures ranging from ICAVs and Investment Limited Partnerships to Unit Trusts and Common Contractual Funds. The jurisdiction provides flexible options for both retail and institutional investors, with distinct regulatory pathways for RIAIFs, QIAIFs, and ELTIFs, each designed to accommodate different investment strategies and liquidity profiles while maintaining robust investor protections.
IrelandFinance and Banking
K&L Gates
K&L Gates
Article

SFDR 2.0 Trialogue Negotiations: Key Areas Of Focus For Fund Managers

The European Commission's proposed overhaul of the SFDR regime is entering crucial trialogue negotiations, with the Irish Presidency aiming to reach agreement by year-end. While the Council and Parliament have aligned on key issues like professional investor opt-outs, significant divergences remain on exclusion criteria for Transition funds, PAI reporting requirements, and engagement strategy disclosures that will shape the future of sustainable finance regulation.
European UnionFinance and Banking
Dillon Eustace
Dillon Eustace
Article

Government Legislative Priorities For Autumn 2026

The Government has published its Autumn 2026 Legislation Programme, identifying 32 bills for priority publication and 32 bills for priority drafting. This article explores a selection of measures likely to be of interest to businesses, spanning digital economy, strategic infrastructure, litigation reform, financial regulation, competition law, corporate structures, employment, pensions, and healthcare sectors.
IrelandGovernment, Public Sector
William Fry LLP
William Fry LLP
Article

Ireland’s Data Centre Connections: Back Online

Ireland has lifted its data centre connection moratorium and introduced a demanding new framework requiring developers to provide their own generation capacity, source 80% of electricity from new Irish renewables within six years, and meet strict grid stability requirements. The policy creates significant opportunities for developers who can navigate the complex intersection of grid connection, planning permission, and renewable energy procurement, though a pending legal challenge adds uncertainty to the la
IrelandEnergy and Natural Resources
William Fry LLP
William Fry LLP
Article

Time Running Out As AI Transparency Guidelines Published

The European Commission has published comprehensive guidelines on AI transparency obligations under Article 50 of the EU AI Act, with enforcement beginning August 2, 2026. These guidelines establish how organizations must disclose AI systems, mark synthetic content, label deepfakes, and demonstrate compliance, with significant penalties for non-compliance reaching up to €15 million or 3% of global turnover.
IrelandTechnology
William Fry LLP
William Fry LLP
Article

Data For Sale: Can Insolvent Companies Realise The Value Of Corporate Data?

Spirit Airlines' proposed $10 million sale of a massive de-identified corporate dataset to Google in its Chapter 11 bankruptcy proceedings raises fundamental questions about whether operational business data can be treated as a realisable asset in insolvency. The transaction highlights the legal tension between preserving a dataset's commercial utility and ensuring individuals cannot be identified, particularly when the data maintains referential integrity across multiple systems.
IrelandInsolvency/Bankruptcy/Re-Structuring
William Fry LLP
William Fry LLP