EU's Digital Operational Resilience Act (DORA), Regulations to Add Risk Management to MiCA

EU’s Digital Operational Resilience Act (DORA) Begins: What It Means for Crypto

The European Union’s Digital Operational Resilience Act (DORA) officially took effect on January 17, introducing new cybersecurity regulations for cryptocurrency businesses across the region.

Key Impacts of DORA on Crypto

Broader Scope Under MiCA:
- DORA expands the scope of the EU’s Markets in Crypto-Assets Regulation (MiCA), focusing on operational resilience and investor protection.
- All MiCA-licensed Virtual Asset Service Providers (VASPs) are now required to comply with DORA’s cybersecurity and risk management standards.
Mandatory Vendor Oversight:
- Firms must maintain a detailed register of third-party IT service providers and ensure robust infrastructure to mitigate risks like cyberattacks and IT disruptions.
Increased Resilience and Transparency:
- DORA aims to enhance market integrity by ensuring continuity and security in financial services, including cryptocurrency operations.

Industry Response

Enhanced Internal Measures

MoonPay:
- The company mobilized teams to update vendor relationships, compile a DORA-compliant register, and ensure ongoing adherence to the new regulations.
Gemini Exchange:
- Implemented a Digital Operational Resilience Strategy, complete with ICT risk frameworks, governance structures, and best practices for operational continuity.

Impact on Third-Party Providers

Smaller service providers, especially startups, may face challenges meeting DORA’s rigorous standards, potentially leading to market consolidation.
VASPs are generally well-prepared due to the high cybersecurity requirements inherent in the crypto industry, but third-party vendors will need to strengthen their practices.

Expert Insights

Cathy Yoon (General Counsel, Wormhole Foundation):
- Smaller service providers may struggle with the capital required to comply, potentially leading to consolidation of vendors with robust security measures.
Chris Denbigh-White (Head of Security, Elwood Technologies):
- The focus on cybersecurity, risk management, and incident response will enhance operational resilience, ultimately benefiting investors and the overall market.

Future Implications

DORA’s enforcement marks a significant step in aligning crypto businesses with traditional financial standards. By mandating rigorous cybersecurity measures and operational transparency, the regulation aims to bolster investor confidence and market stability across the EU.