Are Smart Contract Audits Required by Law? 8 Rules Compared

Video transcript

Is a smart contract audit legally required? Rarely by name. But many rules expect code review, testing or audit evidence.

The eight rules split three ways. Two Hong Kong texts name an audit. Brazil, DORA and the OCC require testing. Others treat audits as evidence.

The HKMA is clearest. It expects licensed stablecoin issuers to get a qualified third-party audit at least yearly, and on every upgrade.

Brazil requires crypto providers to test systems, including smart contracts, with independent review. DORA lists source code reviews where feasible. The OCC's GENIUS Act rule requires smart contracts to operate as intended.

MiCA asks applicants to describe a third-party cybersecurity audit, if available. The FCA expects token disclosures to cover audits. An audit that does not exist cannot be weighed.

Together, the texts describe a regulator-grade review: independent reviewers, checks against intended function with high confidence, validated fixes, repeat reviews, and a qualified provider.

Guardian's audit has three passes: a design review, an invariant suite, and a manual audit by senior researchers. Vanguard runs two independent teams, one driven by Helix, Guardian's AI auditor.

Guardian maps each report and fix review to provisions like DORA Article 25. Its audit portfolio holds 320 public reports.

Read the full article, and confirm with counsel how it applies. For an audit that holds up in every file, talk to Guardian.

The question comes up before launches, listings and bank partnerships.

The answer is neither a clean yes nor a clean no. Few texts name a smart contract audit outright, but many expect code review, testing or audit evidence in specific settings.

Below is what eight texts say, and their status on November 6, 2026.

This article explains the technical and security side of eight regulatory texts on smart contract review. It is not legal advice; confirm how it applies to you with counsel.

At a Glance

Rules That Name an Audit

Hong Kong: stablecoin issuers

The HKMA's Guideline on Supervision of Licensed Stablecoin Issuers took effect with the Stablecoins Ordinance on August 1, 2025.

Paragraph 6.5.5 says a licensee should "engage a qualified third party entity to audit" its smart contracts, for example by formal verification or security review.

That is due "on at least an annual basis", and whenever contracts are deployed, redeployed or upgraded.

The audit should show the contracts are implemented correctly, match their intended functions, and are "to a high level of confidence" free of vulnerabilities.

In this guideline, "should" marks the HKMA's regulatory expectations and "must" a statutory requirement.

Hong Kong: tokenised funds

The SFC's tokenisation circular, revised April 20, 2026, covers SFC-authorised investment products issued on a blockchain.

Providers should confirm, and on request demonstrate, "the integrity of the smart contracts". On request, they should also "obtain third party audit or verification".

A footnote sets the bar: contracts "not subject to any contract vulnerabilities or security flaws with a high level of confidence". Our SFC tokenisation post covers what that takes.

Rules That Require Testing

Brazil: every VASP

Resolution BCB 520, in force since February 2, 2026, sets security rules for virtual asset service providers.

Article 48, VIII requires tests of systems and programs, "inclusive contratos inteligentes" (including smart contracts) that affect the provider's activities. The tests must include:

• Vulnerability analysis of systems, programs and the computing environment.
• Performance review of systems and programs by independent analysts.
• Robustness and security testing.

For banks and brokers entering crypto, IN BCB 701 makes an independent certifier cover Article 48. See our IN BCB 701 guide.

EU: DORA

DORA has applied since January 17, 2025. It covers crypto-asset service providers (CASPs) authorized under MiCA.

Article 25(1) lists "source code reviews where feasible" among the appropriate tests a testing program provides for.

For all but microenterprises, Article 24 requires independent testers, and tests at least yearly on all systems supporting critical or important functions.

No article says "smart contract audit". Our DORA source code review post shows where one fits, under DORA and MiCA.

US: the OCC's GENIUS Act rule

The OCC's final rule for the permitted stablecoin issuers it supervises takes effect January 18, 2027.

Section 15.13(b)(3) requires processes "to ensure that key information technology systems and controls, including smart contracts, are operating as intended".

It also requires "periodic independent testing". It names no audit and no method.

Where Audits Count as Evidence

Other texts treat audits as evidence, or ask about the technology, without requiring an audit. An audit that does not exist cannot be weighed.

EU: MiCA authorization

The closest MiCA text is RTS 2025/305, on CASP authorization applications. Under Article 9(b), applicants shall provide, "if available", a description of a third-party cybersecurity audit.

Its ideal coverage ends with "a cybersecurity source code review" of smart contracts the applicant uses or develops.

UK: token admissions

The FCA's admission rules, made in PS26/9, come into force on October 25, 2027.

A retail platform's admission criteria must take into account known risks in a token's "smart contracts" (CRYPTO 3.2.5R(2)(c)).

The FCA also expects the disclosure document to cover "any audits of the technology" (CRYPTO 3.3.10G). See our UK listing due diligence guide.

Brazil: asset selection

Article 64 says VASPs must also consider an annex of minimum asset selection requirements. Item I(o) lists "auditorias de segurança, de códigos" (security and code audits), as applicable.

DIFC: token suitability

Since January 12, 2026, DIFC firms judge each token's suitability themselves. The technology criterion, GEN 3A.2.1(3)(d), names no audit.

The DFSA's guidelines ask how well a token can respond to incidents, including cyber attacks, through patching or updates. See our DFSA suitability post.

What These Texts Ask of an Audit

Read together, they describe a regulator-grade review:

• Independent reviewers: DORA Article 24(4), Brazil's independent analysts, the HKMA's qualified third party.
• Correctness against intent: the HKMA's "intended functionalities"; the OCC's "operating as intended".
• High confidence: the HKMA and the SFC both use the phrase.
• Fixes validated: DORA Article 24(5) wants weaknesses "fully addressed".
• Repeated: the HKMA yearly and on every deployment or upgrade; DORA yearly for critical systems.
• A qualified provider: the HKMA weighs size, capabilities, expertise, track record, reputation and Hong Kong presence.

One audit can serve several files if it is documented for each: scope, commit, deployed bytecode match and fix review.

How Guardian Helps

Guardian's smart contract audit runs in three passes: a design review, an invariant suite around the safety properties, and a manual audit by senior researchers.

Vanguard puts two independent teams on the same scope, one manual and one driven by Helix, Guardian's AI auditor. Its invariant suite outlives the audit as a regression harness.

Guardian's regulatory compliance work maps each audit report, with its fix review, to provisions including DORA Article 25, OCC 12 CFR 15.13(b) and HKMA 6.5.5.

Browse Guardian's 320 public reports in the audit portfolio.

Frequently Asked Questions

Is a smart contract audit legally required?

Rarely by name. Hong Kong's HKMA expects licensed stablecoin issuers to get a qualified third-party audit at least yearly and on every deployment or upgrade. Elsewhere, rules require testing or independent review, or treat audits as evidence.

Does MiCA require a smart contract audit?

Not in terms. The CASP authorization standard, RTS 2025/305 Article 9(b), asks applicants to describe a third-party cybersecurity audit if one is available. Its ideal coverage includes a source code review of smart contracts they use or develop.

Does the GENIUS Act require a smart contract audit?

Not by name. The OCC's final rule for the issuers it supervises, effective January 18, 2027, requires processes to ensure smart contracts operate as intended, plus periodic independent testing. It sets no method.

Do listing venues have to consider audits?

Some do. From October 25, 2027, retail UK platforms' admission criteria must take into account known smart contract risks, and the FCA expects disclosure documents to cover audits. Brazil's asset selection annex lists security and code audits, as applicable.

Sources

• HKMA: Guideline on Supervision of Licensed Stablecoin Issuers (August 2025)
• HKMA: Implementation of regulatory regime for stablecoin issuers (July 29, 2025)
• SFC: Circular on tokenisation of SFC-authorised investment products, 26EC22 (revised April 20, 2026)
• Banco Central do Brasil: Resolução BCB n° 520 (November 10, 2025, as amended)
• Banco Central do Brasil: Instrução Normativa BCB n° 701 (January 22, 2026)
• Official Journal of the EU: Regulation (EU) 2022/2554 (DORA) (December 27, 2022)
• Official Journal of the EU: Commission Delegated Regulation (EU) 2025/305, RTS on CASP authorization applications (March 31, 2025)
• Federal Register: OCC, Implementing the GENIUS Act for the Issuance of Stablecoins, final rule, 91 FR 67000 (October 23, 2026)
• FCA: PS26/9 Admissions and Disclosures and Market Abuse Regime for Cryptoassets, with made rules FCA 2026/37 (June 2026)
• DFSA Rulebook: GEN 3A.2.1, Only Suitable Crypto Tokens to be used in the DIFC
• DFSA Rulebook: Supervisory Guidelines on Assessing the Suitability of Crypto Tokens