The European Securities and Markets Authority (ESMA) launched its first supervisory sweep of licensed crypto firms on July 8, putting custody resilience under EU-wide review. It comes days after MiCA took full effect and popular crypto exchange AscendEX (formerly BitMax) collapsed.

ESMA has not connected the two events. However, the timing hands regulators a live example of what failed crypto custody costs users.

ESMA Custody Review Targets Crypto’s Weakest Point

In its July 8 release, ESMA said the Common Supervisory Action (CSA) will assess how crypto-asset service providers (CASPs) manage custody risks. National regulators will examine a risk-based sample of authorized firms from late 2026 into early 2027.

The exercise targets risks specific to distributed ledger technology (DLT). Reviewers will test governance, key and storage management, transaction controls, incident detection, smart contract risk, and reliance on third-party providers.

ESMA has used such sweeps on fund managers for years, and extending the tool to crypto folds the sector into mainstream EU supervision. The review also builds on the Digital Operational Resilience Act (DORA), which has been in force for financial firms since January 2025.

Findings will feed a consolidated report to ESMA’s Board of Supervisors in the second half of 2027. Industry lawyers already call enforcement the real test for Europe’s newly licensed market.

Subscribe to our YouTube channel to watch leaders and journalists provide expert insights

AscendEX Collapse Shows What the Review Wants to Prevent

Crypto exchange AscendEX said in its July 6 announcement that it ceased operations on July 1, citing MiCA, a failed financing deal, and market pressure. Every withdrawal now faces manual review, with no assurances on timing or amounts.

AscendEX rebranded from BitMax.io back in March 22, 2021.

Investigator ZachXBT had flagged the exchange on June 26. He said its hot wallets appeared to lack large-cap tokens such as ether (ETH), Tether (USDT), and Solana (SOL), while deposits stayed open and withdrawals froze.

“Their public hot wallets still do not have liquid assets to process withdrawals for the multiple 7 figures in user claims I have verified,” ZachXBT wrote on Telegram.

Follow us on X to get the latest news as it happens

He urged affected users to file reports with law enforcement and regulators, naming co-founder George (Jing) Cao.

AscendEX sits outside the new review, which covers only authorized firms. Yet it breaches the standard ESMA set for everyone else.

In a June 23 statement, the regulator told unauthorized platforms to wind down in an orderly way. Custody could continue only as long as strictly necessary, with clear exit timelines communicated to clients.

ESMA also urged users of unlicensed platforms to move assets to authorized providers or self-hosted wallets, warning they hold no MiCA protections.

AscendEX’s frozen withdrawals make that advice impossible to follow. Its stranded users now illustrate the exact custody failure regulators want licensed firms to prove they can withstand.

The exchange has been here before. A December 2021 hot wallet hack cost it $77.7 million, according to security firm PeckShield. It pledged full compensation then. Today, it offers no assurances at all.

From Licensing Shakeout to Enforcement Phase

MiCA’s cutoff already thinned the field. Only about 210 of more than 1,200 previously registered crypto firms secured authorization. Just 14 platforms reportedly hold an EU-wide exchange license.

The giants retreated in order. Binance logged its highest weekly outflows in over three years as it left the EU, while Bybit began restricting European users. Both kept processing withdrawals.

History suggests scrutiny of collapse narratives pays. Celsius blamed extreme market conditions before its 2022 bankruptcy, and BlockFills froze client withdrawals this year before disclosing a $75 million shortfall. AscendEX blamed regulation while its wallets sat thin.

ESMA’s consolidated findings will not land until late 2027. Until then, the open question is whether custody rules written on paper can stop the next AscendEX from happening inside the regulated perimeter.

Источник: BeInCrypto