DORA establishes ICT risk-management, governance, incident-reporting and resilience-testing requirements for EU financial entities, including MiCA-authorised crypto-asset service providers (CASPs) and asset-referenced token (ART) issuers. It is cross-sector financial regulation with direct crypto-sector relevance and should not be treated as a MiCA duplicate.
Regulationeffective
Regulation (EU) 2022/2554 of the European Parliament and of the Council on digital operational resilience for the financial sector
Also known as: Regulation (EU) 2022/2554 — Digital Operational Resilience Act (DORA)
European Union European Parliament and Council; ESAs (EBA, ESMA, EIOPA); national competent authorities
Overview
Key Details
Jurisdiction
European UnionRegulator
European Parliament and Council; ESAs (EBA, ESMA, EIOPA); national competent authorities
Law Type
Regulation
Status
In ForceOfficial Law Number
Regulation (EU) 2022/2554
Official Title
Regulation (EU) 2022/2554 of the European Parliament and of the Council on digital operational resilience for the financial sector
Enacted Date
December 14, 2022
Effective Date
January 17, 2025
Topics Covered
Who This Law Applies To
EU financial entities in scope, including MiCA-authorised CASPs and issuers, credit institutions, investment firms, payment institutions and insurance undertakings where specified.
Key Requirements
- Establishes ICT risk-management frameworks and governance requirements.
- Requires major ICT incident reporting, resilience testing and digital operational resilience programmes.
- Creates oversight arrangements for critical ICT third-party service providers (CTTPs).
- Applies directly to MiCA-authorised CASPs and ART issuers.
Official Sources
Exact official documentRelated Laws
RegulationEnacted — Not Yet EffectiveEuropean Union
Regulation (EU) 2024/1624 — Anti-Money Laundering Regulation (AMLR)
Regulation (EU) 2024/1624 of the European Parliament and of the Council on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing
Added August 29, 2026Effective: July 10, 2027Ref: Regulation (EU) 2024/1624
Regulation (EU) 2024/1624 (AMLR) is a directly applicable EU regulation creating AML/CFT obligations for obliged entities, expressly including crypto-asset service providers (CASPs). It works with the AMLA Regulation, AMLD6 and the EU crypto travel rule. Note: the regulation is legally in force, but general application date is 10 July 2027 — it should not be described as currently applicable to CASPs.
AML/KYCExchanges
eur-lex.europa.euView Law Profile
RegulationIn ForceEuropean Union
Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets
Regulation (EU) 2023/1113 of the European Parliament and of the Council
Added August 29, 2026Effective: December 30, 2024Ref: Regulation (EU) 2023/1113
The EU Crypto Travel Rule Regulation extends payer and payee information requirements to covered crypto-asset transfers into, within and from the EU. It is a distinct legal instrument from MiCA and applies to crypto-asset service providers (CASPs) handling covered transfers, requiring originator and beneficiary data to accompany transactions.
AML/KYCExchangesPayments
eur-lex.europa.euView Law Profile
RegulationIn ForceEuropean Union
Regulation (EU) 2022/858 on a pilot regime for market infrastructures based on distributed ledger technology
Added August 26, 2026Effective: March 23, 2023Ref: Regulation (EU) 2022/858; CELEX 32022R0858
The EU DLT Pilot lets authorized market infrastructures trade and settle DLT financial instruments under supervised exemptions from selected MiFID II, MiFIR and CSDR requirements. Current state: Applicable from 2023-03-23; review and later amendments should be monitored
CustodyLicensingExchangesSecurities
eur-lex.europa.euView Law Profile
RegulationIn ForceEuropean Union
Markets in Crypto-Assets Regulation
Regulation (EU) 2023/1114 on Markets in Crypto-Assets
Added August 24, 2026Effective: December 30, 2024Ref: EU 2023/1114
Creates uniform EU rules for crypto-asset issuers, stablecoins, CASPs and market abuse.
LicensingStablecoinsCustodyConsumer Protection+1 more
eur-lex.europa.euView Law Profile
DirectiveIn ForceEuropean Union
EU DAC8 Crypto Reporting
Directive on Administrative Cooperation – DAC8
Added August 24, 2026Effective: January 1, 2026Ref: DAC8
Extends tax transparency and automatic exchange of information to a broad range of crypto assets.
TaxDisclosure
taxation-customs.ec.europa.euView Law Profile
OtherIn ForceJurisdiction unavailable
Decision No. E/35/2023 — VASP Registration and AML/CFT Instructions
Decision No. E/35/2023 on Virtual Asset Service Provider Registration, Cancellation of Registration and AML/CFT Instructions
Added August 29, 2026Ref: Decision No. E/35/2023
Oman's FSA Decision No. E/35/2023 requires registration with the Oman Financial Services Authority (formerly Capital Market Authority) before carrying on covered virtual-asset activities in the Sultanate of Oman. It implements AML/CFT, governance and compliance requirements, and provides registration, cancellation and supervisory procedures. This is a VASP registration/AML regime and should be distinguished from any future full licensing framework.
LicensingAML/KYCExchanges
fsa.gov.omView Law Profile
