MiCA and DORA: How They Work Together for Crypto Firms
Quick answer. MiCA authorizes CASPs and asset-referenced token issuers; DORA sets their ICT rules. MiCA Article 68 points to DORA, and DORA covers MiCA-authorized CASPs. You run one ICT program, report major incidents under DORA and manage vendors under both.
Video transcript
MiCA decides whether a crypto firm may operate in the EU. DORA decides how it runs its ICT once it does.
DORA has applied since January 2025 and covers MiCA-authorized CASPs and asset-referenced token issuers. For ICT, MiCA points to DORA.
MiCA sets custody and outsourcing policy, and defers to DORA for ICT. DORA sets the risk framework, yearly testing and incident reports.
MiCA has no ICT incident report, so major incidents go through DORA. Notify within four hours of classifying one as major, then send intermediate and final reports.
For vendors, the texts stack. MiCA adds an outsourcing policy and sub-custody limits. DORA adds a register of every ICT contract, due diligence, contract terms and tested exit plans.
In November 2025, the European Supervisory Authorities designated 19 critical ICT providers, including AWS, Google Cloud and Microsoft. Your MPC, wallet and RPC vendors are still yours to manage.
Start by mapping critical functions such as custody and signing. Build the register, rewrite critical contracts, write the incident playbook, and schedule yearly tests of every critical system.
Guardian's regulatory assessments map your activities to MiCA by citation. Operational Resilience produces your third-party register. Technical Evidence maps each audit and pentest to the provisions it answers.
Read the full guide, check how it applies with counsel, and talk to Guardian about one program for MiCA and DORA.
Crypto-asset service providers in the EU now need MiCA authorization. The national transitional periods ended on 1 July 2026 at the latest (MiCA Article 143(3)).
Authorization brings DORA with it. DORA has applied since 17 January 2025 and covers CASPs authorized under MiCA and issuers of asset-referenced tokens (Article 2(1)(f)).
This guide shows where the two texts meet: who owns which duty, where incidents are reported, and how vendor rules stack. For the control-by-control list, see our MiCA compliance checklist.
This article explains the technical and security side of MiCA (Regulation (EU) 2023/1114) and DORA (Regulation (EU) 2022/2554). It is not legal advice; confirm how it applies to you with counsel.
MiCA Licenses, DORA Sets ICT Rules
MiCA decides whether you may operate. For ICT, it hands the detail to DORA:
- Continuity: CASPs need "resilient and secure ICT systems as required by" DORA (Article 68(7)).
- Recovery: their continuity policy includes response and recovery plans under DORA Articles 11 and 12.
- Data: data safeguards apply "pursuant to" DORA (Article 68(8)).
- Token issuers: Article 34(10) and (11) tie issuers of asset-referenced tokens (ARTs) to DORA the same way.
DORA issues no license of its own. It attaches to the license you hold:
| Firm | MiCA role | DORA scope | DORA supervisor |
|---|---|---|---|
| CASP | Authorized under Title V | Article 2(1)(f) | Its MiCA authority (Article 46(d)) |
| ART issuer | Authorized under Title III | Article 2(1)(f) | Its MiCA authority (Article 46(d)) |
| E-money token (EMT) issuer | Must be a bank or e-money institution (Article 48) | Article 2(1)(a) or (d) | Its banking or payments authority |
| Bank or investment firm offering crypto services | Notifies under Article 60 | Its existing category | Its existing authority |
Under MiCA, the EBA supervises issuers of significant ARTs, and parts of the rules for significant EMTs from e-money institutions (Article 117).
Which Text Sets Which Duty
| Duty | MiCA | DORA |
|---|---|---|
| Authorization file | ICT documentation (Article 62(2)(j); RTS 2025/305 Article 9) | No license; its controls fill that file |
| ICT risk framework | Defers to DORA (Article 68(7), (8)) | Articles 5 to 15 |
| Continuity | Business continuity policy (Article 68(7)) | Response, recovery and backup (Articles 11, 12) |
| Keys and custody | Custody policy, segregation (Article 75) | Strong authentication, key protection (Article 9(4)(d)) |
| Vendors | Outsourcing policy, exit strategies (Article 73) | Register, due diligence, contract terms (Articles 28 to 30) |
| Testing | Describe any third-party audit (RTS 2025/305 Article 9(b)) | Yearly tests of critical systems (Article 24(6)) |
| Incidents | No ICT report of its own | Major incident reports (Article 19) |
| Clients | Custodian liable for attributable losses (Article 75(8)) | Clients told of major incidents (Article 19(3)) |
RTS 2025/305 Article 9 asks applicants to describe the arrangements and people they have in place to comply with DORA.
Incident Reporting Under Each
MiCA has no ICT incident report of its own. A CASP reports major ICT incidents under DORA Article 19, to the authority designated under MiCA (Article 46(d)).
The clocks are in Delegated Regulation (EU) 2025/301, Article 5:
- Initial notification: within 4 hours of classifying an incident as major, and within 24 hours of becoming aware of it.
- Intermediate report: within 72 hours of the initial notification.
- Final report: within one month of the latest intermediate report.
Clients whose financial interests are hit must be told "without undue delay" (Article 19(3)).
MiCA adds the money. A custodian is liable for losses from an incident attributable to it, capped at the asset's market value when lost (Article 75(8)).
If you also hold a payments license
The EBA has advised that some EMT services are payment services needing PSD2 authorization. See our guide to SCA for EMT wallets.
Incidents still run through DORA. Article 23 extends its incident chapter to payment-related incidents at payment and e-money institutions, and recital 23 says PSD2 incident reporting should cease for them.
Vendors, Custody and Outsourcing
Here the texts stack rather than defer. MiCA Article 73 governs outsourcing; DORA Articles 28 to 30 govern ICT third parties.
Both start in the same place: you remain fully responsible (MiCA Article 73(1); DORA Article 28(1)(a)).
What MiCA adds
- An outsourcing policy with contingency plans and exit strategies (Article 73(2)).
- A written agreement you can terminate (Article 73(3)).
- Sub-custody only with CASPs authorized for custody, disclosed to clients (Article 75(9)).
What DORA adds
- A register of information covering every ICT contract (Article 28(3)).
- A yearly report to your authority on new ICT arrangements (Article 28(3)).
- Timely notice of planned contracts supporting critical or important functions (Article 28(3)).
- Due diligence and concentration checks before signing (Articles 28(4) and 29).
- Contract terms: locations, service levels, incident help, audit rights, exit periods (Article 30).
- Exit plans for critical services, tested and reviewed (Article 28(8)).
The authorization file joins them. RTS 2025/305 Article 9(a)(ii) asks how each critical third-party arrangement complies with MiCA Article 73 and DORA Chapter V.
Critical providers
On 18 November 2025 the European Supervisory Authorities (ESAs) designated 19 critical ICT third-party providers, including AWS, Google Cloud and Microsoft.
The ESAs now oversee those providers directly, and the list is updated yearly (Article 31(9)). All 19 are cloud, data center, telecom, software, IT services or market data firms.
Your MPC, wallet infrastructure, RPC and analytics vendors still go in the register. Their due diligence, contracts and exit plans are yours to run.
Timelines and Supervisors
| Date | What applies | Source |
|---|---|---|
| 30 June 2024 | MiCA rules for ART and EMT issuers | MiCA Article 149(3) |
| 30 December 2024 | MiCA in full, including CASP authorization | MiCA Article 149(2) |
| 17 January 2025 | DORA applies | DORA Article 64 |
| 18 November 2025 | First list of critical ICT providers | ESAs |
| 1 July 2026 | Latest end of CASP transitional periods | MiCA Article 143(3) |
Then the yearly cycle: tests of critical systems (Article 24(6)), a review of the ICT risk framework (Article 6(5)) and the register report (Article 28(3)).
For a CASP, one authority covers both texts: the MiCA authority is also the DORA authority (Article 46(d)). If a firm answers to more than one authority, its member state names one for incident reports (Article 19(1)).
What to Build First
- Map critical or important functions, such as custody, signing, transfers and trading, and the ICT assets behind each (DORA Article 8).
- Build the register of information from every ICT contract, crypto vendors included (Article 28(3)).
- Rewrite critical contracts to Article 30 terms. Write one outsourcing policy that meets MiCA Article 73.
- Write the incident playbook: classification, the 4-hour clock, client notices and who files.
- Schedule yearly tests of every critical system, with each fix validated (Articles 24 and 25).
- Test response, recovery and restores (Articles 11 and 12).
- File evidence by article, so one artifact answers both texts.
For what the tests must cover, see DORA penetration testing requirements. For contracts, see whether smart contract audits count under DORA.
How Guardian Helps
Guardian's Regulatory & Compliance assessments map your activities to MiCA authorization and list every technology, security, custody and resilience provision by citation.
The Operational Resilience assessment maps the people, systems, providers and chain dependencies behind each service. It also produces the third-party register regulators ask for.
Guardian's audits, pentests and Managed Security leave dated artifacts. Technical Evidence maps each one to the provisions it answers.
Frequently Asked Questions
What is the difference between MiCA and DORA?
MiCA authorizes and regulates crypto-asset services and token issuers. DORA sets ICT risk, incident, testing and third-party rules for financial entities, including MiCA-authorized CASPs and issuers of asset-referenced tokens. For ICT, MiCA points to DORA.
Does DORA apply to e-money token issuers?
Yes, through their license. MiCA Article 48 requires EMT issuers to be credit institutions or e-money institutions, and DORA Article 2(1) covers both. Their DORA supervisor is their banking or payments authority.
Who supervises a CASP under DORA?
The competent authority designated under MiCA (DORA Article 46(d)), which also receives its major ICT incident reports. The ESAs separately oversee designated critical ICT providers, which does not reduce the CASP's own third-party duties.
Does DORA apply to crypto firms outside the EU?
Through EU entities. DORA covers a non-EU group's MiCA-authorized EU entity. EU firms may use a non-EU critical provider only if it sets up an EU subsidiary within 12 months of designation (Article 31(12)).
Sources
- Publications Office of the EU: Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA), Official Journal (9 June 2023)
- Publications Office of the EU: Regulation (EU) 2022/2554, Digital Operational Resilience Act (DORA), Official Journal (27 December 2022)
- Publications Office of the EU: Commission Delegated Regulation (EU) 2025/305, RTS on CASP authorization applications (31 March 2025)
- Publications Office of the EU: Commission Delegated Regulation (EU) 2025/301, RTS on major ICT incident reporting (20 February 2025)
- EBA: The European Supervisory Authorities designate critical ICT third-party providers under DORA (18 November 2025)
- ESMA: List of designated critical ICT third-party service providers (November 2025)
- EBA: Opinion on the interplay between PSD2 and MiCA, EBA/Op/2025/08 (10 June 2025)
- Guardian: MiCA Compliance Checklist: Security Controls for CASPs
- Guardian: Regulatory & Compliance Assessments
Run one program for MiCA and DORA
Guardian maps your custody, vendors and incident process to both texts, then tests the systems behind them.