The Cyprus Securities and Exchange Commission will begin on-site inspections and desk-based reviews of authorised crypto-asset service providers in the second half of 2026, as part of a European Securities and Markets Authority exercise running through the first half of 2027.
The Common Supervisory Action 2026 targets digital operational resilience for firms that offer custody services. CySEC will examine governance arrangements, management of digital keys and storage systems, transaction controls, incident detection and response procedures, smart-contract risks, and dependence on third-party service providers.
Only authorised CASPs are in scope. National competent authorities will use a risk-based sample, and CySEC plans to visit a selected group of firms to ensure consistency across the EU.
The exercise follows the full application of the Markets in Crypto-Assets Regulation on 1 July 2026, which ended Cyprus's national transitional regime. By 30 June 2026, CySEC had licensed 22 CASPs under MiCA, with 22 further applications still under review.
ESMA's register shows 25 authorised entities in Cyprus as of early August 2026, compared with 69 in Germany, 34 in France, 29 in the Netherlands and 22 in Malta. Across the EU, custody is the most widely authorised MiCA service, held by 201 of 323 registered providers.
CySEC has already signalled a stricter enforcement posture. In July it issued a circular on money-laundering risks after the transition period ended, and on 7 August it fined 12 listed companies a total of €126,500 for failures to publish 2024 annual financial reports.