[Analysis] MiCA License is Just the Beginning: The Era of High-Intensity Oversight and Constant Supervision for the Crypto Custody Industry

As of July 10, 2026, the transition period granted to crypto-asset firms in the European Union (EU) has officially ended. With the full implementation of the Markets in Crypto-Assets (MiCA) regulation on July 1, the market exit of unlicensed firms has begun, and licensed custody providers are realizing that obtaining a license is not the end, but the start of a new regulatory battle.

As the European Securities and Markets Authority (ESMA) signals in-depth risk reviews and prepares to implement new professional standards later this month, the era of 'loose oversight' in the crypto market has come to a complete end. A license is now merely a minimum requirement for market entry, not a certificate guaranteeing operational safety.

With the July 1 deadline passed, the regulatory landscape of the EU market has been rapidly reshaped. ESMA has made it clear there will be no extensions, and unlicensed Crypto-Asset Service Providers (CASPs) must immediately stop acquiring new customers and begin 'orderly wind-down' procedures to liquidate or transfer existing positions. This acts as a practical cease-and-desist order for firms that have delayed regulatory compliance.

Unlicensed crypto-asset service providers must wind down their businesses immediately, stop marketing, and take measures to protect the interests of their customers.

The situation is not easy for licensed firms either. CASP authorization is not a one-time event; ongoing compliance obligations, such as maintaining own funds, quarterly reporting to National Competent Authorities (NCAs), and annual audits to maintain operational status, arise immediately. Regulators are now looking beyond paperwork requirements to scrutinize the actual soundness of operations in real-time.

ESMA's 2026-2027 Custody Risk Inspection Notice

ESMA and national NCAs plan to conduct extensive risk inspections of crypto-asset custody providers from the second half of 2026 to the first half of 2027. This inspection focuses on testing whether custody providers can actually meet the required security and resilience standards. It is expected to go beyond a simple document review and become a stress test of the actual operating environment.

• Inspection of the safe segregation and storage status of custodial assets
• Evaluation of response resilience against cyberattacks and system failures
• Verification of the adequacy of control and access rights management for customer assets
• Verification of operational risk management systems and internal control processes

Regulations on human resources will also be further strengthened. According to Article 81(7) of MiCA, which takes effect on July 28, 2026, new standards for the knowledge and expertise of employees of authorized firms will be applied. This demonstrates the regulatory authorities' intention to directly supervise not only the technical infrastructure of companies but also the capabilities of the personnel operating it.

Even in this strict environment, major companies are continuing their strategic moves. A representative example is Ripple's acquisition of a CASP license from the Luxembourg Financial Sector Supervisory Commission (CSSF) on July 6. This is evaluated as a case showing the determination of large players to solidify their dominance in the European market by meeting the high standards of the post-MiCA era.

Complex Regulatory Compliance Challenges with DORA and PSD2

Companies must comply not only with MiCA but also with the Digital Operational Resilience Act (DORA), which has been applicable since January 2025. In particular, for e-money token (EMT) custody services, companies may face a 'dual licensing' situation where they are required to have both MiCA authorization and a license under the Payment Services Directive (PSD2). This signifies a sharp increase in compliance costs for companies.

Ultimately, this multi-layered surveillance system and constant audit environment are expected to accelerate market restructuring. Only companies with the capital strength and operational resilience to withstand the risk inspections and human expertise regulations that will begin in earnest in the second half of 2026 will remain as key players in the European crypto-asset market.

Regulatory authorities are advising customers to verify whether their service providers are listed on the ESMA register and to transfer their assets immediately if they are using unauthorized firms. This is increasing market transparency while simultaneously leading to a further narrowing of the space for non-compliant firms.