DORA for Crypto-Asset Service Providers (CASPs)

Why DORA applies

DORA (Regulation (EU) 2022/2554) lists among the financial entities it covers "crypto-asset service providers as authorised under" the Markets in Crypto-Assets Regulation, and issuers of asset-referenced tokens (Article 2(1)(f)). MiCA is Regulation (EU) 2023/1114.

Firms that provided crypto services under national law before 30 December 2024 could continue under MiCA's transitional regime until 1 July 2026, or until they were granted or refused a MiCA authorisation, whichever came first, and member states could shorten or skip that period (MiCA Article 143(3)). That window has closed: crypto-asset services in the EU now require MiCA authorisation, and with it DORA applies.

MiCA points to DORA

MiCA itself relies on DORA for ICT. Under Article 68 of MiCA, crypto-asset service providers must:

ensure continuity and regularity of their services using resilient and secure ICT systems as required by DORA (Article 68(7));
have a business continuity policy including ICT business continuity plans and ICT response and recovery plans set up under DORA Articles 11 and 12 (Article 68(7));
have mechanisms, systems and procedures as required by DORA, and systems to safeguard the availability, authenticity, integrity and confidentiality of data (Article 68(8)).

Issuers of asset-referenced tokens have similar requirements under MiCA Article 34(10) and (11).

The DORA obligations to plan for

Area	What it means for a crypto firm	DORA
ICT risk management	A documented framework approved by the management body, covering wallets, key management, trading and custody systems	Art. 5 to 15; RTS 2024/1774
Incident reporting	Classify incidents against the major-incident thresholds and report within 4 hours of classification	Art. 17 to 19; RTS 2024/1772 and 2025/301
Resilience testing	Testing programme with yearly tests of systems supporting critical functions; TLPT if selected by the authority	Art. 24 to 27
Third-party risk	Register of information, Article 30 contract clauses and exit plans for cloud, custody technology, blockchain analytics and other ICT providers	Art. 28 to 30
Information sharing	Optional participation in threat-intelligence sharing arrangements, notified to the authority	Art. 45

Keys and wallets are ICT assets: private key management, signing infrastructure and hot-wallet systems usually support critical or important functions, which brings the strictest DORA requirements, including encryption and cryptographic key management policies (RTS 2024/1774, Articles 6 and 7).

Proportionality

DORA applies proportionately to size, risk profile and the nature, scale and complexity of services (Article 4). Smaller crypto firms still need every element, but documents and tests can be lighter; microenterprises benefit from specific exemptions noted in our DORA compliance checklist. The simplified framework of Article 16 is not available to crypto-asset service providers, as they are not among the entities it lists.

Start with the gaps. The DORA Compliance Checklist pack includes a gap-assessment workbook, an ICT risk management framework template, an incident classification matrix and a third-party provider register.

DORA for Crypto-Asset Service Providers (CASPs)

Why DORA applies

MiCA points to DORA

The DORA obligations to plan for

Proportionality

Sources

Related tools

DORA Compliance Checker

Vendor Risk Assessment