Crypto Incident Reporting Requirements by Jurisdiction

By Owen Thurm Published November 6, 2026 6 min read

Quick answer. DORA: 4 hours from classifying a major incident, 24 from awareness at most. NYDFS: 72 hours. SEC 8-K: four business days after materiality. VARA: 72 hours. UK FCA: expects 24 hours from the threshold call, from March 2027.

Watch: Crypto Incident Reporting Requirements by Jurisdiction 1:41

Video transcript

One hot wallet drain can start several regulatory clocks at once, and each one starts at a different moment.

MAS counts from discovery, VARA from detection, DORA from classification, and NYDFS from a determination. Know the trigger, not just the hours.

In the EU, DORA allows four hours from classifying a major incident, and twenty four from awareness at most. The UK FCA expects twenty four hours, from March 2027.

In the US, NYDFS wants notice within seventy two hours. SEC registrants file within four business days of a materiality call, and the OCC allows thirty six hours.

The fastest fixed clock is in Singapore. Digital payment token service providers must notify MAS within one hour of discovery.

Dubai's VARA allows seventy two hours from detection, and Kenya twenty four hours from discovery. Hong Kong's SFC asks platforms for notice immediately.

So build one playbook around the fastest clock. Map every rule, log each start, rehearse the fastest notice, and pre-fill your templates.

Guardian's Operational Resilience Assessment maps your clocks and rehearses filing on time. Managed Security watches contracts on every block, and notification packs gather the facts each first notice asks for.

Guardian is not a law firm, and works alongside your counsel. Read the full matrix, or talk to Guardian at guardian.security.

One hot wallet drain can start several regulatory clocks at once. Each starts at a different moment: discovery, detection, classification or a materiality call.

This matrix puts them side by side, checked against each text in November 2026.

This article explains the technical and security side of the incident reporting provisions compared below. It is not legal advice; confirm how it applies to you with counsel.

How to Read the Matrix

Each row is one provision. The columns:

Covers: who the provision reaches.
Trigger: the event that starts the duty.
First notice: the deadline, and what starts its clock.
Verb: how firmly the text asks, in its own words.
Status: what kind of text it is, and since when.

The start point matters as much as the hours. MAS counts from discovery, VARA from detection, DORA from classification and NYDFS from a determination.

Europe and the UK

Provision	Covers	Trigger	First notice	Verb	Status
DORA Art. 19; RTS 2025/301 Art. 5	EU financial entities, including MiCA CASPs	Major ICT-related incident	4 hours from classification; 24 hours from awareness at most	shall	Applies since Jan. 17, 2025
Cyber Resilience Act Art. 14	Manufacturers of products with digital elements on the EU market	Actively exploited vulnerability or severe incident	Early warning within 24 hours of awareness	shall	Applies since Sept. 11, 2026
GDPR and UK GDPR Art. 33	Controllers of personal data	Personal data breach, unless unlikely to risk individuals	Without undue delay; 72 hours from awareness, where feasible	shall	In force
FCA SUP 15.18 (PS26/2)	UK firms with a Part 4A permission	Operational incident that meets a reporting threshold	As soon as practicable; FCA expects 24 hours from the threshold call	must; "expect"	Final rules; apply from Mar. 18, 2027

DORA reaches CASPs authorized under MiCA and issuers of asset-referenced tokens (Article 2(1)(f)). After the initial notice, an intermediate report is due within 72 hours and a final report within one month.

Clients whose financial interests are hit must be told without undue delay (Article 19(3)). Our DORA guide covers what makes an incident major.

The CRA's early warning is followed by a notification within 72 hours of awareness. Final reports follow within 14 days of a fix for vulnerabilities, or one month after notification for incidents.

Which wallets, nodes and SDKs count is in our CRA reporting post.

In the UK, SUP 15.18 covers every firm with a Part 4A permission, so a crypto firm is in scope once authorized. FG26/3 says firms should not default to waiting the full 24 hours.

Payment service providers keep 4 hours from first detection. More in our PS26/2 post.

United States

Provision	Covers	Trigger	First notice	Verb	Status
NYDFS 500.17(a)	Firms licensed under NY banking, insurance or financial services law	Cybersecurity incident, including at affiliates and third-party providers	As promptly as possible; 72 hours after determining one occurred	shall	In force; current text since Dec. 1, 2023
NYDFS 500.17(c)	The same covered entities	An extortion payment	24 hours after paying; written reasons within 30 days	shall	In force; current text since Dec. 1, 2023
SEC Form 8-K Item 1.05	SEC registrants	Incident the registrant determines is material	Four business days after that determination	"is to be filed"	In force; in the current Form 8-K
OCC 12 CFR 53.3	National banks, federal savings associations, federal branches of foreign banks	Incident that materially disrupts or degrades operations, or likely will	As soon as possible; 36 hours after determining one occurred	must	Final rule, in force

NYDFS's definition reaches further than it looks. A cybersecurity event that hits you and requires notice to any government body or supervisor is an incident (500.1(g)).

So a duty to notify elsewhere can start the 72-hour clock too. Covered entities must also update DFS on material changes (500.17(a)(2)).

The SEC wants the materiality call made "without unreasonable delay after discovery". The Attorney General can delay a filing on national security or public safety grounds (Item 1.05(c)).

UAE, Asia and Africa

Provision	Covers	Trigger	First notice	Verb	Status
VARA Rule I.K.1	VASPs licensed by VARA in Dubai	Material cybersecurity event, or a BCDR trigger that materially hits operations	As soon as reasonably practicable; 72 hours from detection	shall	Rulebook; current version since June 19, 2025
MAS FSM-N13 paras. 7, 8	Licensed digital payment token service providers	Relevant incident: severe and widespread, or material to customers	1 hour from discovery; root cause report within 14 days	must	Notice; applies to them since Nov. 6, 2024
SFC VATP Guidelines 16.7	Licensed virtual asset trading platforms	Material service interruption, or material failure of trading or custody systems	Immediately; incident report without undue delay	should	Guidelines, June 2023
HKMA Guideline 6.8.20	Licensed stablecoin issuers	Incident, continuity or exit plans triggered, or likely to be	In a timely manner	should	Guideline, August 2025
Kenya VASP Regulations, 2026, reg. 99	VASPs licensed in Kenya	Cybersecurity incident, loss of keys or unauthorized transaction	24 hours from discovery; detailed report within five working days	shall	Regulations; gazetted July 22, 2026

VARA's report covers the event's nature, scope and impact, the mitigation steps, and whether other authorities were told.

MAS's root cause report covers the cause, the impact on compliance, operations and customers, and the fixes (paragraph 8).

SFC platforms should also have written policies for escalating a suspected or actual cyber incident to clients and the SFC (12.14).

The HKMA also expects issuers to have procedures to inform it when key recovery is triggered (6.5.7).

Kenya's detailed report covers the impact on critical functions and licensed services, any malicious unauthorized access, and remedial actions (99(2), (3)). More in our Kenya post.

One Playbook for Every Clock

A firm licensed in several places needs one playbook, built around the fastest clock that applies.

Map your clocks: every row that reaches you, with its trigger and start point.
Log each start: when you discovered, detected, classified and determined, and who decided.
Rehearse the fastest: if MAS applies, file a mock notice inside one hour.
Pre-fill notices: templates holding the facts each first notice asks for.
Watch onchain: unexpected mints, role changes, upgrades and large outflows.
Count vendors: NYDFS counts incidents at affiliates and third-party providers.
Track follow-ups: DORA at 72 hours and one month, MAS at 14 days, Kenya at five working days.
Tell clients: DORA wants affected clients told without undue delay.

The onchain triggers are our suggestion. The HKMA already lists smart contract exploits and lost or unauthorized key access among its incident indicators (6.8.3).

How Guardian Helps

Guardian's Operational Resilience Assessment covers incident classification and reporting. It maps the clocks you face, the criteria that start each one, and a rehearsed path to file on time.

Managed Security monitors contracts on every block and watches domains, DNS, certificates, cloud and code hosts. When something fires, a Guardian engineer responds, around the clock.

Its incident timelines and regulator notification packs gather the facts each first notice asks for, ready for you to file.

Guardian is not a law firm. It works alongside your counsel.

Frequently Asked Questions

Which crypto incident reporting deadline is the shortest?

Of the fixed deadlines, Singapore's. Digital payment token service providers must notify MAS within 1 hour of discovering a relevant incident (Notice FSM-N13). The SFC asks platforms to notify it immediately, with no set hours.

When does the NYDFS 72-hour clock start?

When the covered entity determines a cybersecurity incident has occurred, at itself, an affiliate or a third-party service provider. Notice is due as promptly as possible, and no later than 72 hours after that determination (500.17(a)).

When does UK incident reporting apply to crypto firms?

SUP 15.18 applies from March 18, 2027 to every firm with a Part 4A permission, so a crypto firm is in scope once authorized. The FCA's new cryptoasset rules are expected to start on October 25, 2027.

Do SEC rules require crypto companies to report hacks?

Those that file Form 8-K must disclose a material cybersecurity incident under Item 1.05, within four business days of determining it is material. That determination must be made without unreasonable delay after discovery.

Sources

Be ready for every clock

Guardian maps the reporting clocks you face, rehearses the path to file, and watches your systems so you know in time.

Talk to Guardian Explore regulatory compliance