ESMA's new innovation priority says tokenisation. The CASP exposure sits under DORA.

Sep 24

4 min read

ESMA has named tokenisation as an initial focus of a new EU-wide supervisory priority. The factsheet that sets it out does not mention MiCA, and does not mention crypto-assets as such. Crypto-asset service providers do appear once, but somewhere else: in the continuing cyber and operational resilience priority, where supervisory work under DORA is being expanded to cover more of them.

That split is the story. The headline points one way, and the operative text points another. For CASPs, the nearer supervisory pressure comesmore from resilience, not innovation.

What ESMA announced

On 23 September 2026, ESMA announced a new Union Strategic Supervisory Priority (USSP) on digital innovation, titled "Innovation with investor safeguards" in the accompanying factsheet, to start in 2027. It will run alongside the cyber and operational resilience USSP, in place since 2025. The ESG disclosures USSP, launched in 2023, closes this year.

USSPs are ESMA's convergence tools. Every three years ESMA identifies up to two priorities, which national competent authorities (and ESMA, in its direct supervision) work on each year. They are supervisory, not rule-making, instruments. What they change is where supervisors spend their time.

For 2027, the factsheet commits authorities to map "how firms already use or plan to use AI/tokenisation in processes and products that directly impact clients’ outcomes (i.e. beyond back-office tasks)", and to run "initial checks on a subset of the most impacted firms". The press release says the initial focus "will be on how supervised entities use artificial intelligence and tokenisation".

Where the CASP reference actually sits

The one mention of crypto-asset service providers is in the cyber priority's 2027 next steps. There, authorities will "further expand the number of entities covered by supervisory work, including smaller supervised entities and crypto-asset service providers (also via the relevant common supervisory action (CSA))".

The factsheet does not name the CSA. The most likely candidate, and it is our identification rather than ESMA's, is the common supervisory action on CASPs' digital operational resilience for custody, launched in July 2026. The same section names "registers of information and incidents" as data-quality targets.

DORA's legal scope is not changing. Supervisory coverage under it is, and CASPs are named as part of that expansion.

Business model impact

A USSP redirects supervisory attention; it is not a rule-making instrument. For CASPs, the practical effect in 2027 is examination intensity under DORA, especially for firms with custody operations. For firms that distribute tokenised products to clients, it is a mapping exercise followed by checks.

What does not change: nothing in the announcement alters MiCA authorisation requirements, DORA obligations or national supervisory powers. The priority adds scrutiny, not obligations.

Product impact

The innovation text names firms generally rather than CASPs, so any CASP read-across is inference. By illustration, products that would plausibly fall inside the mapping include tokenised fund units and tokenised securities distributed through a CASP or an investment-firm partner, and AI used in onboarding, suitability or client communications. The mapping targets uses "beyond back-office tasks". Internal tooling that never touches a client outcome is a lower priority for the exercise.

Revenue impact

In our view, nothing moves on the P&L this quarter from the innovation priority. Mapping begins in 2027, and we expect initial checks to arrive first as information requests rather than findings. The direction is higher supervisory cost for firms with client-facing tokenisation or AI. We would put it in the 2027 compliance budget, not in a 2026 forecast.

The UK in the same week

The comparison is instructive. According to the FCA's published text of a speech its chief executive delivered on 22 September, the FCA intends "to consult on safeguarding rules for relevant tokenised investment assets", and pointed to an "upcoming joint tokenisation roadmap with the Bank of England". Neither commitment carrie“ a date.

The UK has already moved on tokenisation in other respects. The same speech cites the FCA's April fund tokenisation policy statement and the first fully native tokenised fund authorised in June. But the UK has not yet consulted on safeguarding rules for tokenised investment assets, while EU supervisors will start mapping tokenised products under existing law in 2027. Our inference, not either regulator's statement, is that firms operating in both should expect the EU supervisory questions to arrive before the UK safeguarding rules are settled.

What can reasonably be done now?

An inventory of client-facing AI and tokenisation. Drawn on ESMA's own back-office line, it can be prepared before a national authority asks for one.
A test of DORA data quality. Registers of information and incident records are named targets. CASPs with custody operations can test that data now rather than under examination.

The case against

A USSP is a convergence tool, not a rulebook. National authorities set the depth of the work, and the tokenisation strand may land mainly on traditional investment firms and fund managers rather than on CASPs. Read that way, the CASP relevance of the innovation priority is modest. The resilience priority is where the named exposure sits.

Timeline

8 Jul 2026 — ESMA. Common supervisory action on CASPs' digital operational resilience for custody launched.
22 Sep 2026 — FCA. Chief executive's speech (published 23 Sep): intention to consult on safeguarding for tokenised investment assets. No date given.
23 Sep 2026 — ESMA. Innovation USSP announced; ESG USSP closing.
2027 — EU national authorities. Innovation USSP starts: mapping and initial checks. How each authority applies it is not yet published.