DORA vs MiCA: How the Two Overlap for Crypto Firms
MiCA (Regulation (EU) 2023/1114) governs the authorisation and conduct of crypto-asset markets; DORA governs the digital operational resilience of the ICT systems those same firms rely on. A MiCA-authorised crypto-asset service provider is a financial entity under DORA, so the two apply together and address different risks, not competing ones.
Two regulations, one firm
MiCA and DORA are both part of the EU's digital-finance package. MiCA decides whether and howa firm may offer crypto-asset services; DORA decides how resilient that firm's technology must be. For a crypto-asset service provider, both bite at once.
Side-by-side
| Aspect | MiCA | DORA |
|---|---|---|
| Primary focus | Crypto-asset market authorisation & conduct | ICT operational resilience |
| Applies to | CASPs, token issuers | CASPs plus ~20 other financial-entity types |
| Core obligations | Authorisation, disclosures, market-abuse rules, safeguarding | ICT risk framework, incident reporting, testing, third-party risk |
| Applies since | 30 December 2024 (CASP provisions) | 17 January 2025 |
Where they overlap in practice
Both regimes care about safeguarding client assets, business continuity, and outsourcing. A CASP can reuse much of its MiCA governance and risk-management work when building its DORA ICT risk-management framework and third-party register, but DORA adds specific ICT testing, incident-classification, and contractual requirements that MiCA does not cover.
ESMA's 2026 custody supervisory action
Custody is where the two regimes overlap most directly, and ESMA moved to test that overlap in practice. On 8 July 2026, ESMA launched a Common Supervisory Action directing national regulators to review CASPs' digital operational resilience for custody operations, running from the second half of 2026 into the first half of 2027. Competent authorities are assessing a risk-based sample of authorised CASPs against governance of custody operations, key and storage management for distributed-ledger assets, transaction controls, incident detection and response, and dependencies on ICT third-party providers supporting custody, the same territory MiCA's safeguarding rules and DORA's third-party risk pillar both touch, examined together rather than separately. Findings feed a consolidated ESMA report expected in the second half of 2027. For CASPs, the practical takeaway is that custody-specific ICT dependencies (wallet infrastructure, key-management providers, custody sub-processors) need to be in the register of information now, not once a supervisory letter arrives. See our full coverage of the CSA for what to prepare.
Frequently asked questions
Do crypto firms have to comply with both MiCA and DORA?
Yes. A MiCA-authorised crypto-asset service provider is a financial entity under DORA Article 2, so it must meet DORA's ICT resilience rules in addition to MiCA's authorisation and conduct requirements.
Is ESMA actively supervising DORA compliance for crypto firms yet?
Yes. On 8 July 2026 ESMA launched a Common Supervisory Action directing national regulators to review CASPs' digital operational resilience for custody operations, running from the second half of 2026 into the first half of 2027. See our coverage of the supervisory action.
What is the difference between MiCA and DORA?
MiCA regulates the crypto-asset market itself, authorisation, disclosures, market abuse, and conduct. DORA regulates the digital operational resilience of the ICT systems those firms run. They address different risks for the same entities.
Which applied first, MiCA or DORA?
Both are part of the EU digital-finance package. MiCA's provisions for CASPs applied from 30 December 2024, and DORA applied from 17 January 2025, so most CASPs face both within weeks of each other.