Cyprus Securities Regulator to Conduct On-Site Audits of Crypto Custodians in 2026-2027

Aug 7, 2026

The Cyprus Securities and Exchange Commission (CySEC) will conduct on-site inspections and desk-based reviews of authorized crypto asset service providers offering custody services from late 2026 through mid-2027. Coordinated by the European Securities and Markets Authority (ESMA) under the 2026 Common Supervisory Action, the audits will evaluate operational resilience, governance, private key security, and smart contract risks to promote regulatory convergence across the European Union.

CySEC crypto custody audits 2026-2027

▪The Cyprus Securities and Exchange Commission will conduct on-site inspections and desk-based reviews of authorized crypto asset service providers offering custody services.
▪The Cyprus Securities and Exchange Commission audits of authorized crypto asset service providers are scheduled to run from the second half of 2026 through the first half of 2027.
▪Cyprus Securities and Exchange Commission chairperson George Theocharides announced in a circular that the regulator will audit a representative sample of local crypto entities approved to provide digital asset custody.
▪The Cyprus Securities and Exchange Commission issued a consultation paper in late 2025 proposing a new directive on prudential information reporting for crypto asset service providers.
▪The Cyprus Securities and Exchange Commission warned local crypto firms that failure to meet the prescribed standards could affect their standing and authorization to offer custody services.

ESMA Common Supervisory Action coordination

▪The European Securities and Markets Authority and national competent authorities have identified digital asset custody and operational resilience as high-risk areas for financial stability and investor protection.
▪The Cyprus Securities and Exchange Commission audits are part of the 2026 Common Supervisory Action coordinated by the European Securities and Markets Authority in cooperation with European Union national competent authorities.
▪The Cyprus Securities and Exchange Commission will only include crypto asset service providers that have already been authorized and licensed to provide custody services in its audit sample.

Operational resilience assessment criteria

▪The Cyprus Securities and Exchange Commission stated that compliance readiness with the standards outlined in its circular will serve as the baseline for selecting firms for the upcoming audits.
▪The Cyprus Securities and Exchange Commission reviews will examine governance and control frameworks, key and storage management, and security protocols for private keys, wallet storage, and access controls.
▪The Cyprus Securities and Exchange Commission audits will assess transaction controls, threat monitoring, incident detection and response, smart contract security, and third-party risk management.
▪The Cyprus Securities and Exchange Commission inspections will focus on the maturity of crypto firms' operational security, technical infrastructure, and risks tied to distributed ledger technology.

EU crypto regulatory convergence

▪The Cyprus Securities and Exchange Commission described the audit campaign as part of its remit to align national supervision in Cyprus with the risk-based priorities of the European Securities and Markets Authority.
▪The European Securities and Markets Authority's 2026 Common Supervisory Action aims to promote supervisory convergence across European Union member states and ensure uniform security expectations as crypto services integrate with traditional finance.