On July 8 ESMA launched its first MiCA common supervisory action to assess custody resilience of crypto-asset service providers, testing DLT-specific risks such as governance, key and storage management, transaction controls, smart contract vulnerabilities and reliance on third-party providers, with national reviews starting late 2026 and consolidated findings due in H2 2027. The sweep follows the collapse of CEX AscendEX (ceased operations July 1; announced July 6) with frozen withdrawals and a prior $77.7 million 2021 hot-wallet hack, underscoring custody and security failures as MiCA authorizations remain scarce (about 210 of 1,200 firms and 14 EU-wide exchange licenses) and prompting regulators to urge migration to authorized providers or self-custody.

Bearish

Predictions Markets

See what traders are focused on

View analytics →

In Brief

ESMA launched its first MiCA supervisory review, targeting CASP custody resilience.
Regulators will probe key management, smart contracts, and third-party risks into 2027.
AscendEX's collapse days earlier shows the custody failures ESMA wants to prevent.

The European Securities and Markets Authority (ESMA) launched its first supervisory sweep of licensed crypto firms on July 8, putting custody resilience under EU-wide review. It comes days after MiCA took full effect and popular crypto exchange AscendEX (formerly BitMax) collapsed.

ESMA has not connected the two events. However, the timing hands regulators a live example of what failed crypto custody costs users.

ESMA Custody Review Targets Crypto’s Weakest Point

In its July 8 release, ESMA said the Common Supervisory Action (CSA) will assess how crypto-asset service providers (CASPs) manage custody risks. National regulators will examine a risk-based sample of authorized firms from late 2026 into early 2027.

The exercise targets risks specific to distributed ledger technology (DLT). Reviewers will test governance, key and storage management, transaction controls, incident detection, smart contract risk, and reliance on third-party providers.

ESMA has used such sweeps on fund managers for years, and extending the tool to crypto folds the sector into mainstream EU supervision. The review also builds on the Digital Operational Resilience Act (DORA), which has been in force for financial firms since January 2025.

Findings will feed a consolidated report to ESMA’s Board of Supervisors in the second half of 2027. Industry lawyers already call enforcement the real test for Europe’s newly licensed market.

Subscribe to our YouTube channel to watch leaders and journalists provide expert insights

AscendEX Collapse Shows What the Review Wants to Prevent

Crypto exchange AscendEX said in its July 6 announcement that it ceased operations on July 1, citing MiCA, a failed financing deal, and market pressure. Every withdrawal now faces manual review, with no assurances on timing or amounts.

AscendEX rebranded from BitMax.io back in March 22, 2021.

Investigator ZachXBT had flagged the exchange on June 26. He said its hot wallets appeared to lack large-cap tokens such as ether (ETH), Tether (USDT), and Solana (SOL), while deposits stayed open and withdrawals froze.

“Their public hot wallets still do not have liquid assets to process withdrawals for the multiple 7 figures in user claims I have verified,” ZachXBT wrote on Telegram.

He urged affected users to file reports with law enforcement and regulators, naming co-founder George (Jing) Cao.

AscendEX sits outside the new review, which covers only authorized firms. Yet it breaches the standard ESMA set for everyone else.

In a June 23 statement, the regulator told unauthorized platforms to wind down in an orderly way. Custody could continue only as long as strictly necessary, with clear exit timelines communicated to clients.

Hello,Sorry for your loss AscendEX suspended withdrawals for many other users as well.I have just DM’d the AscendEX co-founders personal phone number so you can call him yourself to try to get your funds back.I published warnings on Telegram about the CEX.Regards,ZachXBT pic.twitter.com/KTOSAuamk9
— ZachXBT (@zachxbt) July 6, 2026

ESMA also urged users of unlicensed platforms to move assets to authorized providers or self-hosted wallets, warning they hold no MiCA protections.

AscendEX’s frozen withdrawals make that advice impossible to follow. Its stranded users now illustrate the exact custody failure regulators want licensed firms to prove they can withstand.

The exchange has been here before. A December 2021 hot wallet hack cost it $77.7 million, according to security firm PeckShield. It pledged full compensation then. Today, it offers no assurances at all.

From Licensing Shakeout to Enforcement Phase

MiCA’s cutoff already thinned the field. Only about 210 of more than 1,200 previously registered crypto firms secured authorization. Just 14 platforms reportedly hold an EU-wide exchange license.

The giants retreated in order. Binance logged its highest weekly outflows in over three years as it left the EU, while Bybit began restricting European users. Both kept processing withdrawals.

History suggests scrutiny of collapse narratives pays. Celsius blamed extreme market conditions before its 2022 bankruptcy, and BlockFills froze client withdrawals this year before disclosing a $75 million shortfall. AscendEX blamed regulation while its wallets sat thin.

ESMA’s consolidated findings will not land until late 2027. Until then, the open question is whether custody rules written on paper can stop the next AscendEX from happening inside the regulated perimeter.

Read the article at BeInCrypto