ESMA Extends DORA Cyber Resilience Oversight To Crypto Firms In 2027

The European Securities and Markets Authority will extend its cyber resilience oversight framework to crypto-asset service providers starting in 2027, according to the regulatory body's latest digital finance roadmap. The expansion brings CASPs under the same operational resilience scrutiny that traditional financial institutions have faced since the Digital Operational Resilience Act took effect in January 2025. ESMA's move signals that the EU regulator views cyber threats to crypto platforms as a systemic risk requiring direct supervisory attention rather than relying solely on national competent authorities. The 2027 timeline gives CASPs roughly two years to align their internal security frameworks with the expectations ESMA has already established for banks, investment firms, and payment service providers under DORA.

The expanded oversight will cover the full range of crypto-asset service provider activities authorized under the Markets in Crypto-Assets Regulation, including custody and administration of crypto-assets on behalf of clients, operation of trading platforms, exchange services between crypto-assets and fiat currencies, and execution of orders on behalf of third parties. ESMA's framework will also apply to firms providing portfolio management services, transfer services, and advice on crypto-assets, meaning virtually every licensed CASP operating in the EU will face direct cyber resilience examinations.

Industry estimates suggest the 2027 cyber resilience expansion will impose meaningful additional compliance costs on crypto-asset service providers, though ESMA has not yet published specific cost projections or revised capital requirements. CASPs will need to invest in advanced threat detection systems, conduct regular penetration testing, and maintain comprehensive incident response playbooks aligned with ESMA's expectations. The operational expenditure associated with these measures is expected to be proportionally higher for smaller CASPs, which may lack the dedicated security teams that larger exchanges and custodians already employ.

Early reactions from the EU crypto industry suggest that major exchanges and custodians broadly welcome the regulatory clarity, while smaller CASPs express concern about the operational burden. Several large crypto platforms operating in the EU have already begun aligning their security frameworks with DORA standards in anticipation of the 2027 deadline, viewing early compliance as a competitive advantage in attracting institutional clients.