MiCA and DORA are two halves of one rulebook.
MiCA answers who may offer crypto-asset services in the EU, under which authority. DORA, the Digital Operational Resilience Act, answers whether their systems hold up when something goes wrong. It has applied since 17 January 2025, with no phase-in.
Where they meet: crypto-asset service providers authorised under MiCA are financial entities under DORA, and MiCA Article 68 requires them to run "resilient and secure ICT systems as required by" DORA, with business continuity plans built on DORA Articles 11 and 12. Issuers of asset-referenced tokens are in DORA's scope too, and e-money token issuers are as credit or e-money institutions.
DORA asks for four things:
- a board-accountable ICT risk management framework
- major ICT incidents reported to the regulator: first notice within 4 hours of classification and at most 24 hours from awareness, an update within 72 hours, a final report within a month
- resilience testing, including threat-led penetration testing for larger firms
- oversight of third-party ICT dependencies, which OpenZeppelin points out includes the smart contracts and libraries a firm relies on
A completed MiCA authorisation file does not satisfy DORA. They are checked separately, which gives anyone judging a crypto project two useful questions instead of one.
SDA is a token on Solana, supervised under MiCA with FIN-FSA as competent authority, issued by a team in Helsinki/Finland.
Source: OpenZeppelin, "If You're Regulated Under MiCA, You're Also Regulated Under DORA", 23 Sep 2026
https://www.openzeppelin.com/news/if-youre-regulated-under-mica-youre-also-regulated-under-dora
Primary texts: Regulation (EU) 2022/2554 (DORA), Article 2(1)(f); Regulation (EU) 2023/1114 (MiCA), Article 68(7)-(8); Delegated Regulation (EU) 2025/301 (incident timelines)