DORA for Crypto Firms: ICT Risk and Incident Reporting Explained
DORA for crypto firms explained: who it applies to, the five pillars, what CASPs must build, cost and penalties, and how DORA fits alongside MiCA.
3 min read
8 views
MiCA is not the only EU regulation a crypto business must meet. The Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) applies to financial entities, including crypto-asset service providers, from 17 January 2025. It governs how you manage technology risk, report incidents and oversee your ICT vendors. This article explains what DORA requires of crypto firms and what you have to build.
For the obligation checklist see our MiCA compliance checklist, and for the build see our MiCA compliance software development.
What is DORA?
DORA is the EU rulebook for digital operational resilience in financial services. Where MiCA covers conduct and authorisation, DORA covers whether your systems can withstand, respond to and recover from ICT disruptions. The two run in parallel, and a CASP must satisfy both.
Who DORA applies to
DORA applies to a broad set of financial entities, and crypto-asset service providers and issuers of asset-referenced tokens are explicitly in scope. Critical ICT third-party providers to those entities also fall under a dedicated EU oversight framework.
The five pillars of DORA
| Pillar | What it requires |
|---|---|
| ICT risk management | A governance framework to identify, protect, detect, respond and recover |
| Incident management and reporting | Classify ICT incidents and report major ones to the competent authority |
| Digital operational resilience testing | Regular testing, with threat-led penetration testing for significant entities |
| ICT third-party risk | A register of information on ICT providers and contractual safeguards |
| Information sharing | Voluntary sharing of cyber-threat intelligence |
What CASPs must build
- An ICT-risk management framework with clear ownership and policies
- Incident classification and reporting workflows for major ICT incidents
- A maintained register of information for every ICT third-party provider
- Resilience testing schedules and evidence, including penetration testing
- Business continuity and recovery plans tied to your MiCA safeguarding obligations
DORA cost and penalties
DORA is a material budget line. In a Deloitte survey, 64% of financial entities expected to spend 2 to 5 million euro on DORA readiness. Breaches carry penalties of up to 2% of annual worldwide turnover, with personal liability for senior managers in serious cases.
How DORA fits with MiCA
Treat DORA and MiCA as one programme, not two. The incident-reporting, third-party register and resilience-testing evidence DORA wants should write to the same immutable audit trail as your MiCA controls, so a regulator sees one coherent system. Build the gap assessment against MiCA, the Transfer of Funds Regulation and DORA together.
Pharos Production builds MiCA compliance software with DORA ICT-risk and incident-reporting workflows where they apply. See the cost breakdown or request a gap assessment.
FAQ
Quick answers to common questions about custom software development, pricing, process and technology.
Type to filter questions and answers. Use Topic to narrow the list.
Showing all 5
No matches
Try a different keyword, change the topic, or clear filters
-
Yes. The Digital Operational Resilience Act applies to financial entities including crypto-asset service providers and issuers of asset-referenced tokens, from 17 January 2025.
Critical ICT third-party providers to those firms are also in scope.
-
DORA (Regulation (EU) 2022/2554) applies from 17 January 2025. It runs in parallel with MiCA and the crypto Travel Rule, so a CASP must meet all three.
-
ICT risk management, incident management and reporting, digital operational resilience testing, ICT third-party risk management, and information sharing on cyber threats.
-
DORA breaches carry administrative penalties of up to 2% of annual worldwide turnover, with personal liability for senior managers in serious cases. The exact penalty is set by your national competent authority.
-
It varies by size. In a Deloitte survey, 64% of financial entities expected to spend 2 to 5 million euro on DORA readiness.
Building DORA evidence into the same system as your MiCA controls keeps the cost down.
Role: Founder and CTO, Pharos Production
Focus: Architecture, Web3 products, smart contract security, high-load systems
Experience: 23 years in production delivery
