Operational Compliance

DORA Compliance for Crypto-Asset Firms and CASPs

Does DORA apply to your CASP? The five DORA pillars for crypto firms — ICT risk, incident reporting, resilience testing and the Register of Information.

If MiCA is the licence, DORA is the operational backbone behind it. The Digital Operational Resilience Act has applied to EU financial entities — crypto-asset service providers included — since 17 January 2025. Where MiCA governs whether you may offer crypto services, DORA governs whether your technology can withstand, respond to and recover from disruption. Authorised CASPs are squarely in scope, and supervisors increasingly expect to see DORA evidence as part of the same conversation as MiCA.

DORA rests on five pillars. First, an ICT risk-management framework owned at board level — not delegated and forgotten. Second, ICT incident reporting on a strict cadence: for a major incident, an initial notification within four hours of classification (and no later than 24 hours from detection), an intermediate report within 72 hours, and a final report within one month of the intermediate report. Third, digital operational resilience testing of critical systems. Fourth, ICT third-party risk management — knowing, and contractually controlling, the cloud and software vendors your business depends on. Fifth, a maintained Register of Information cataloguing those ICT third-party arrangements, which competent authorities can request.

For a crypto firm, the practical gaps usually show up in the same places: incident detection and a tested 24-hour reporting path, a vendor register that is actually current, and resilience testing that has genuinely been run rather than planned. These are exactly the items on our Treasury & Compliance Readiness Checklist — the DORA section is built for operators, not lawyers.

The key takeaway: obtaining a CASP licence is not the finish line. DORA is a continuing obligation that runs in parallel, and the firms that treat it as a board-level resilience programme — rather than a one-off document — are the ones that pass supervision without drama. If you are still mapping whether MiCA (and therefore DORA) applies to you, start with the MiCA Exposure Checker.