DORA Certifications Bundle
399 € excl. VAT
DORA Sector Guide
DORA for Crypto-Asset Service Providers (CASPs)
DORA operational resilience for MiCA-authorised crypto firms, built for 24/7 markets, custody and on-chain dependencies.
DORA operational resilience for MiCA-authorised crypto firms, built for 24/7 markets, custody and on-chain dependencies.
What is your role under MiCA?
Applies whatever your size, calibrated by proportionality (Article 4): CASPs are not on the closed list of Article 16. Your competent authority decides whether you must also perform threat-led penetration testing (TLPT) at least every 3 years (Article 26); risk-based resilience testing applies either way (Articles 24 and 25).
Next step: TLPT Readiness CheckerLighter expectations than a multi-asset exchange come from proportionality, not from an exemption: the simplified framework of Article 16 is not available to CASPs. Incident reporting, resilience testing and ICT third-party risk rules also apply, proportionately (Article 4(2)).
Next step: DORA Gap AnalysisArticle 2(1)(f) names issuers of asset-referenced tokens alongside CASPs, so DORA applies to you as a financial entity in your own right, whether or not you also provide crypto-asset services. Your MiCA operational and reserve requirements run alongside DORA, not instead of it.
Next step: DORA Compliance ChecklistNot sure your entity is a financial entity at all? Run the free scope determination.
Crypto-asset service providers authorised under MiCA are explicitly listed as financial entities under DORA (Regulation (EU) 2022/2554, Article 2(1)(f)), so the same digital operational resilience rules that apply to banks and investment firms also apply to exchanges, custodians, brokers and crypto advisers. DORA has applied since 17 January 2025, and MiCA authorisation now goes hand in hand with demonstrable ICT risk management, incident reporting, resilience testing and third-party oversight.
For CASPs this is not a paperwork exercise. Trading venues match orders around the clock, custodians hold private keys that cannot be reissued if compromised, and most firms depend on cloud platforms, blockchain nodes, oracles and market-data feeds they do not control. DORA forces these operational realities into a governed framework: a board-owned ICT risk strategy, a tested incident response capability, threat-led testing for the most critical firms, and contractual control over the third parties that keep the platform online.
All CASPs authorised under MiCA Title V are DORA financial entities under Article 2(1)(f), covering custody and administration of crypto-assets, operation of a trading platform, exchange, execution, placement, reception/transmission of orders, advice and portfolio management. DORA applies proportionately under Article 4, so a small portfolio-management CASP carries lighter expectations than a large multi-asset exchange, but no CASP is exempt from the core ICT risk, incident-reporting and third-party rules. Issuers of asset-referenced tokens (ART) are financial entities under the same point (f); issuers of e-money tokens (EMT) are credit institutions or e-money institutions and in scope as such. Both face MiCA-specific operational and reserve requirements alongside DORA.
National Competent Authorities (NCAs) designated under MiCA authorise and supervise CASPs and are their competent authorities for DORA (Article 46(d)). ESMA keeps the EU register of CASPs, and the EBA supervises issuers of significant asset-referenced tokens.
MiCA already imposes operational-resilience duties on CASPs (Article 68 on systems and security access protocols, custody safekeeping under Article 75, and business-continuity obligations), and DORA acts as the cross-sectoral lex specialis that deepens and standardises the ICT dimension of those duties. Rather than running two parallel programmes, firms should map MiCA's security, custody-segregation and continuity clauses onto DORA's five pillars so a single control set satisfies both: DORA's ICT risk framework operationalises MiCA Article 68, and DORA incident reporting feeds the same evidence base NCAs expect under MiCA. The practical challenge unique to crypto is applying these requirements to 24/7 markets and to private-key custody, where downtime and key compromise have no banking-hours grace period and no chargeback to fall back on.
Six obligations that play out differently in your sector. Open a card for the detail.
Private keys are the irreplaceable crown jewels of a CASP: lose or leak them and the assets are gone irreversibly. DORA's ICT risk framework (Articles 6-8) requires documented key-lifecycle controls, hardware security modules or MPC, dual control and segregation of duties over signing, mapped to MiCA's safekeeping duties under Article 75.
Most exchanges keep the bulk of assets in cold storage and a working float in hot wallets. DORA asks firms to identify these as critical ICT assets, assess the concentration and single-points-of-failure in the signing and withdrawal path, and document protection and recovery measures so a hot-wallet breach cannot cascade into total loss.
A trading platform's matching engine and order-management stack are critical functions whose failure stops the market. DORA requires capacity, redundancy and tested failover for these systems, plus monitoring that can detect latency spikes, degraded order routing or partial outages before they become a market-integrity event.
CASPs rely on full nodes, RPC providers, indexers and price oracles to confirm deposits, broadcast withdrawals and value assets. DORA's third-party rules (Articles 28-30) require these to be inventoried, risk-assessed and contractually governed even when a provider is a decentralised or non-traditional vendor, with fallback nodes to avoid a single chain dependency.
Heavy reliance on one or two hyperscalers for compute, storage and KMS creates concentration risk that DORA (Articles 28-29) treats as a board-level concern. CASPs must hold an information register of ICT contracts, assess substitutability, secure audit and access rights, and document a tested exit and portability plan for critical cloud services.
Crypto markets never close, so DORA's incident management (Articles 17-19) must be staffed and tooled for round-the-clock detection, escalation and reporting. CASPs need on-call rotations, automated alerting on abnormal withdrawals or chain reorganisations, and runbooks that distinguish a hack from market volatility within minutes, not hours.
8 questions drawn from the requirements above. Each gap you declare comes back with the course that covers it and the tool that does the work. Your answers stay in this browser.
Has your management body approved an ICT risk management framework that covers custody, signing and trading systems, including the protection of private keys across their whole lifecycle?
Are your hot and cold wallets and the signing and withdrawal path mapped as critical ICT assets and covered by a business impact analysis with RTO and RPO targets?
Do you test matching-engine failover and withdrawal-path disruption under a documented, risk-based programme, and have you recorded whether TLPT applies to you?
Is your incident desk staffed around the clock to classify ICT-related incidents against Delegated Regulation (EU) 2024/1772 and file the initial notification within 4 hours of classifying one as major?
Do your alerts on abnormal withdrawals, chain reorganisations and node outages feed runbooks that tell a wallet compromise or exploit from market volatility?
Are the cloud, node, RPC and oracle providers you contract with recorded in your Register of Information, with those supporting critical or important functions identified?
Do your contracts with ICT third-party service providers, wallet and signing providers included, contain the Article 30 clauses, with a tested exit plan for the services you cannot replace quickly?
Does your management body follow specific ICT risk training on a regular basis, and do all staff, on-call teams included, complete digital operational resilience training?
You declared 0 areas to work on, gaps first. Each one names what to learn and what to use.
Indicative self-assessment based on your own answers, not a compliance opinion. Prices exclude VAT.
Your score and your priorities, each with the course and the tool that cover it. The newsletter only if you tick the box.
Three reports to your competent authority, each with its own clock. Enter two times to see your deadlines.
Within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it.
Enter the classification timeWithin 72 hours of submitting the initial notification, and updated when the situation changes.
Follows the initial notificationWithin one month of the latest intermediate report, once the root cause analysis is complete.
Follows the intermediate reportDelegated Regulation (EU) 2025/301, Article 5; classification under Delegated Regulation (EU) 2024/1772. The later deadlines assume each report goes in at its latest permissible time. A deadline falling on a weekend or bank holiday moves to noon of the next working day (Article 5(4)), except for the initial notification and intermediate report of credit institutions, central counterparties, operators of trading venues and essential or important entities under NIS2, or where your competent authority has decided otherwise (Article 5(5) and (6)); the dates shown do not apply that extension.
For CASPs the most consequential ICT incidents are wallet compromises, exchange hacks, smart-contract or bridge exploits, and chain-level events such as reorganisations or a major node-provider outage; market-manipulation enabled by an ICT failure (for example a frozen order book or manipulated price feed) can also qualify. DORA (Article 19 and the related RTS/ITS) requires major incidents to be classified against thresholds such as clients and amounts affected, duration, geographic spread, data losses, criticality of services and economic impact, then reported to the NCA on a strict clock: an initial notification, an intermediate report, and a final root-cause report. Because crypto operates 24/7 and exploits drain funds in minutes, detection and classification have to run around the clock: the initial notification is due within 4 hours of classifying the incident as major and no later than 24 hours after becoming aware of it (Delegated Regulation (EU) 2025/301, Article 5), so on-call coverage and pre-drafted templates are essential.
The engineer on call at the weekend decides whether an abnormal withdrawal is a hack or market volatility, and classifying it as major starts the 4-hour notification clock. Your custody lead sets who may sign and how keys are generated, stored and recovered. Your outsourcing manager puts cloud, node and RPC providers under Article 30 contracts with an exit plan. Your management body approves the ICT risk management framework and keeps its own knowledge current. Each role needs to know what DORA expects of it on a 24/7 platform, and to show it.
Members of the management body must “actively keep up to date with sufficient knowledge and skills” to understand and assess ICT risk, including by following specific training on a regular basis.
Regulation (EU) 2022/2554, on EUR-Lex Article 13(6) · All staffICT security awareness programmes and digital operational resilience training are “compulsory modules” of staff training, for all employees and senior management, at a level that matches each function.
Regulation (EU) 2022/2554, on EUR-LexOwns the DORA programme, maps MiCA custody and security duties onto the five pillars, and keeps the evidence file your competent authority will ask for.
The first lesson is open to read before you buy.
Runs key-lifecycle controls, signing segregation and matching-engine failover, and the tests that evidence them.
The first lesson is open to read before you buy.
Classifies wallet compromises, exploits and node outages against Delegated Regulation (EU) 2024/1772, at any hour, and drafts the initial, intermediate and final reports.
The first lesson is open to read before you buy.
Handles cloud, node, RPC and oracle providers: Register of Information, Article 30 clauses, concentration and exit plans.
The first lesson is open to read before you buy.
Approves the ICT risk management framework and must keep its ICT risk knowledge current, including through specific training (Article 5(4)).
The first lesson is open to read before you buy.
For crypto-asset service providers: compliance, ICT risk, threat-led testing and incident reporting for a security-first sector.
Several people to train? Team seats cost less per learner from 2 seats, on one invoice: see team pricing.
Starting out? DORA Fundamentals is free, certificate included.
The tools that matter most for your sector, and what each one does for you.
Draft the initial notification for a wallet compromise or platform outage, with the reporting deadlines computed.
Open FreeTest a past hot-wallet incident or exchange outage against the major-incident criteria of Delegated Regulation (EU) 2024/1772.
Open Free to build · export licence €249 a yearEnter cloud, node, RPC and oracle providers in the ITS templates and run the validation rules before the annual collection.
Open FreeScore your ICT third-party service providers, from cloud platforms to RPC providers, and see which ones need an exit plan first.
Open €149Set MTPD, RTO and RPO for the matching engine, wallets and signing services in one workbook.
Open FreeMeasure your position on the five pillars, custody and trading included, and get a prioritised list of gaps.
OpenAll tools: browse the full list. Prices exclude VAT.
Everything tailored to your sector, ready to use on day one.
Yes. CASPs authorised under MiCA are named as financial entities in DORA Article 2(1)(f), so all of DORA applies. MiCA gives you market authorisation; DORA governs the operational resilience and ICT risk side of running the business, and your NCA will expect evidence of both.
Treat DORA as the detailed ICT framework that operationalises MiCA's high-level security, custody and continuity obligations (notably MiCA Articles 68 and 75). Map a single control set to DORA's five pillars and reuse it as evidence for both regimes rather than building two separate programmes.
Only a subset of firms is. TLPT under DORA Articles 26-27 applies to entities designated by their authority based on systemic importance and ICT risk profile, on roughly a three-year cycle. Many smaller CASPs will not be designated, but every CASP must still run a proportionate testing programme including vulnerability scans, penetration tests and scenario-based resilience tests.
Yes, where you depend on them to deliver your service they fall within DORA's third-party rules (Articles 28-30). They must appear in your register of information, be risk-assessed for concentration and substitutability, and ideally be backed by fallback providers, even though decentralised or non-traditional vendors make traditional contracting harder.
The initial notification is due within 4 hours of classifying the incident as major and no later than 24 hours after becoming aware of it, the intermediate report within 72 hours of that notification and the final report within one month of the latest intermediate report. Where a deadline falls on a weekend or bank holiday, Delegated Regulation (EU) 2025/301 (Article 5(4)) lets you file by noon of the next working day, except for the initial notification and intermediate report of an essential or important entity under NIS2, or where your competent authority has decided otherwise (Article 5(5) and (6)). Classification itself cannot wait for Monday, so 24/7 crypto operations still need on-call staffing and pre-approved templates.
No. Outsourcing custody or signing to a sub-custodian or wallet provider does not transfer accountability. Under DORA the CASP remains responsible for managing that third-party ICT risk: due diligence, contractual audit and access rights, monitoring, and a documented exit plan, all recorded in your information register.
Need the full risk view? See the Risk Assessment Toolkits or compare all kits. All prices exclude VAT; an EU VAT invoice is issued at checkout. Professional templates, not legal advice.
Built around the CASP sector pack above: go deeper with the incident playbook, run a full crypto risk assessment, get everything in one kit, or have us determine your scope.
Incident taxonomy (exchange hack, key compromise, bridge exploit, chain reorg), DORA Art. 17-19 classification & 24/7 reporting clock, ready-to-fill NCA report templates and runbooks.
A 30-question crypto risk assessment (wallets & custody, matching engine, nodes/oracles, smart contracts, 24/7 incidents) with maturity & risk scoring, a 5x5 heatmap and a live dashboard, plus a methodology guide.
Everything for a MiCA-authorised CASP, in one purchase:
Not sure how MiCA and DORA apply to your crypto business? We classify your services, map MiCA Art. 68/75 onto the five DORA pillars and deliver a written memo for your board or NCA (3-6 pages, 5 business days).
Workbooks, playbooks and certifications built for EU financial entities. Add several to your cart: volume discounts apply automatically.
Take our free 5-minute assessment and get an instant DORA compliance score with personalised recommendations.