EU DORA & MiCA Compliance Rules: ICT Incident Reporting, CTPP Oversight & CASP Licensing (2026)

EU DORA mandates major ICT incident reporting within 4 hours (Source: EU Reg 2022/2554, 2025-01-17), while MiCA ended CASP transitional regimes on July 1, 2026 (Source: ESMA, 2026-07-01).

The Digital Operational Resilience Act (DORA) refers to Regulation (EU) 2022/2554, a binding European Union prudential cybersecurity framework governing over 22,000 financial entities across 27 EU member states since January 17, 2025 (Source: EUR-Lex CELEX:32022R2554, 2025-01-17). The Markets in Crypto-Assets Regulation (MiCA) is defined as Regulation (EU) 2023/1114, establishing harmonized authorization, stablecoin reserve, and conduct rules across the European Economic Area, with all national grandfathering periods expiring on July 1, 2026 (Source: ESMA MiCA Timeline, 2026-07-01).

Core Regulatory Takeaways (DORA & MiCA 2026 Convergence)

• Major ICT Incident SLA: Regulated entities must file initial supervisory notifications within 4 hours of classifying an incident as major and within 24 hours of detection (Source: Joint ESAs RTS on DORA Art. 19, 2025-01-17).
• MiCA Transitional Cliff: National transitional regimes capped at 18 months ended on July 1, 2026, requiring unauthorized Crypto-Asset Service Providers (CASPs) to execute orderly client wind-down plans (Source: ESMA Supervisory Statement, 2026-07-01).
• CTPP Financial Penalties: Designated Critical ICT Third-Party Providers (CTPPs) face daily penalty payments up to 1% of average daily worldwide turnover for up to 6 months (Source: Regulation EU 2022/2554 Art. 35, 2025-01-17).
• Stablecoin Reserve Floors: Issuers of significant Asset-Referenced Tokens (ARTs) and E-Money Tokens (EMTs) must hold at least 60% of reserve assets in segregated bank deposits across credit institutions (Source: Regulation EU 2023/1114 Art. 38, 2024-06-30).

EU DORA & MiCA Statutory Thresholds and Compliance Matrix

Five Pillars of EU DORA Operational Resilience

1. ICT Risk Management & Governance (Articles 5–16)

An ICT Risk Management Framework refers to the board-approved internal governance, asset inventory, and business continuity architecture mandated under DORA Articles 5 through 16 (Source: EUR-Lex CELEX:32022R2554, 2025-01-17). Management bodies bear direct legal liability for approving digital resilience budgets, reviewing annual ICT audit findings, and maintaining recovery time objectives (RTO) and recovery point objectives (RPO) across 100% of critical or important functions (Source: EBA DORA Guidelines, 2025-01-17).

2. ICT-Related Incident Classification & Reporting (Articles 17–23)

Financial entities must evaluate anomalous cyber events against 7 materiality criteria, including client impact exceeding 10% of total users or value exceeding EUR 100,000 in direct economic losses (Source: Joint ESAs RTS on Incident Classification, 2025-01-17). Once classified as major, the entity has 4 hours to submit the initial alert, 72 hours to submit the intermediate update, and 30 calendar days to file the comprehensive root-cause analysis with its National Competent Authority (Source: ESMA DORA Portal, 2025-01-17).

3. Digital Operational Resilience Testing & TLPT (Articles 24–27)

Threat-Led Penetration Testing (TLPT) is defined as a controlled, intelligence-driven red-team simulation executed on live production systems at least once every 3 years under the ECB TIBER-EU methodology (Source: EU Reg 2022/2554 Art. 26, 2025-01-17). All non-exempt financial entities must perform annual vulnerability scans and source-code reviews across 100% of internet-facing systems (Source: ESMA DORA Technical Standards, 2025-01-17).

4. ICT Third-Party Risk & Register of Information (Articles 28–44)

A Register of Information refers to the standardized machine-readable ledger of all contractual arrangements with ICT third-party service providers required under DORA Article 28(3) (Source: EBA ITS on Register of Information, 2025-01-17). Contracts supporting critical functions must specify 100% unrestricted audit rights for regulators, mandatory exit strategies, and data localization locations across all sub-contractors (Source: EU Reg 2022/2554 Art. 30, 2025-01-17).

MiCA Authorization & Prudential Capital Rules for CASPs

A Crypto-Asset Service Provider (CASP) refers to any legal person authorized under MiCA Article 59 to provide one or more regulated crypto-asset services professionally across the European Union (Source: EU Reg 2023/1114, 2024-12-30). Under Annex IV of MiCA, CASPs must hold permanent minimum capital equal to the higher of one-quarter (25%) of fixed overheads of the preceding year or the statutory class floor: EUR 50,000 for Class 1 (order reception, transmission, advice), EUR 125,000 for Class 2 (custody and administration, exchange of crypto-assets for funds), and EUR 150,000 for Class 3 (operation of a trading platform) (Source: EUR-Lex CELEX:32023R1114 Annex IV, 2024-12-30).

Following the expiration of the 18-month maximum grandfathering window on July 1, 2026, ESMA initiated a Common Supervisory Action (CSA) across 27 National Competent Authorities to audit CASP cryptographic key custody, distributed ledger technology (DLT) incident logs, and DORA compliance (Source: ESMA Supervisory Convergence Work Programme, 2026-07-01). When reviewing institution licence records on RegTech Codex, note that imported database entries reflect unverified source snapshot classifications and must be cross-checked directly against ESMA's official interim MiCA register before confirming current authorization status (Source: ESMA MiCA Register, 2026-07-01).

Frequently Asked Questions

Q1: What are the exact ICT incident reporting timelines under EU DORA?

Under the Regulatory Technical Standards (RTS) on DORA Article 19, financial entities must submit an initial notification within 4 hours of classifying an ICT incident as major and no later than 24 hours from detection, followed by an intermediate report within 72 hours and a final root-cause report within 1 month (Source: ESMA/EBA/EIOPA Joint RTS, 2025-01-17).

Q2: How do MiCA and DORA interact for Crypto-Asset Service Providers (CASPs) after July 1, 2026?

MiCA Article 62 and DORA Article 2 classify authorized CASPs as regulated financial entities, meaning a CASP cannot maintain its MiCA passporting license after the July 1, 2026 transitional deadline without a board-approved DORA ICT risk framework and Register of Information (Source: ESMA, 2026-07-01).

Q3: What penalties apply to Critical ICT Third-Party Providers (CTPPs) for DORA non-compliance?

Under DORA Article 35, the appointed European Supervisory Authority (EBA, ESMA, or EIOPA) acting as Lead Overseer can impose daily periodic penalty payments of up to 1% of the CTPP's average daily worldwide turnover in the preceding business year for up to 180 days (Source: Regulation EU 2022/2554, 2025-01-17).