Services
DORA & MiCA Compliance
Protect your business and strengthen DORA and MiCA readiness with CertiK. Our experts provide end-to-end security testing across applications, infrastructure, smart contracts, and critical supporting systems.
Overview
Why DORA and MiCA matter
DORA and MiCA are raising the bar for digital asset businesses in the EU. Together, they strengthen expectations around operational resilience, cybersecurity, incident readiness, and regulatory accountability.
Digital Operational Resilience Act
Focuses on ICT risk management, operational resilience, incident reporting, testing, and third-party oversight.Markets in Crypto-Assets Regulation
Establishes a regulatory framework for crypto-asset issuers and service providers, with strong expectations around governance, security, and transparency.
Scope
Who must comply
Crypto and digital asset entities in the EU that fall under the categories below are required to register and comply with operational and security standards. These requirements are designed to ensure transparency and protect digital assets.
Centralized exchange
Centralized exchanges are platforms where users trade cryptocurrencies and act as intermediaries to maintain custody of user funds.Trading platforms
Provide users with access to crypto markets through advanced trading tools, liquidity aggregation, and protocol integration.Crypto wallet
A self-custody crypto wallet lets users store, send, and receive cryptocurrencies while retaining full control of their funds and responsibility for their assets.Crypto custodians
A custody solution provides enterprise-grade services to help users hold and manage their crypto wallets securely using advanced security measures.DeFi protocols
Provide decentralized financial services such as lending, staking, and on-chain trading through smart contracts on blockchain networks.Layer 1 & Layer 2 chains
Core blockchain infrastructure includes nodes, validators and consensus mechanisms that support secure and reliable distributed ledgers while maintaining transaction integrity.Token issuers
Token issuance creates digital assets such as stablecoins and tokenized real-world assets which can be digitally owned and exchanged on the blockchain.Cross-chain bridges
A cross-chain bridge is a technology that enables the transfer of cryptocurrencies across different blockchain networks.
Compliance
What compliance requires
Digital asset entities are required to uphold rigorous operational and cybersecurity standards to ensure resilient and secure services. Achieving compliance involves a comprehensive approach to risk management, incident handling, system testing, and oversight of third-party providers and provides a clear framework for maintaining operational and technological resilience.
ICT risk management
Build and maintain a resilient ICT and cybersecurity risk framework.- How CertiK helpsRisk assessments, threat modeling, security reviews, remediation support, and CertiK SkyInsights platform.
Incident reporting
Establish processes for detecting, handling, documenting, and reporting material incidents.- How CertiK helpsIncident response support, incident investigation, and regulatory compliance reporting.
Operational resilience testing
Test critical systems, applications, and infrastructure on an ongoing basis.- How CertiK helpsPenetration testing, source code review, smart contract audits, and infrastructure assessments.
Third-party risk management
Monitor and manage dependencies on critical providers and external partners.- How CertiK helpsThird-party risk assessment, due diligence support, and control reviews for external dependencies.
Solutions
CertiK's DORA & MiCA compliance solutions
Explore how our services map to DORA requirements in practice and deliver detailed actionable security and compliance solutions.
Smart contract auditing
- RequirementIf smart contracts are used or developed, they should be reviewed by experienced third-party auditors using a structured methodology.
- CertiK solutionSmart contract and Layer 1 chain auditing leverages expert analysis and mathematical techniques to verify and test smart contracts for resilience against blockchain attacks that could result in significant financial loss, while validating that underlying blockchain protocols operate securely and as intended.
- MiCA Article 4.bIf the applicant uses and/or develops smart-contracts, a cybersecurity source code review of them.
Application penetration testing
- RequirementFinancial entities shall ensure that digital operational resilience tests on all critical applications supporting important functions are conducted by independent parties, perform annual tests, and carry out vulnerability assessments before deploying or redeploying any new or existing applications.
- CertiK solutionCertiK performs application penetration testing using OWASP-aligned methodologies to identify vulnerabilities and provide prioritized remediation guidance. Scenario-based testing simulates real-world attack conditions and evaluates how the application behaves under realistic threats.
- DORA Article 24.6Financial entities, other than microenterprises, shall ensure, at least yearly, that appropriate tests are conducted on all ICT systems and applications supporting critical or important functions.
- MiCA Article 4.bPenetration tests on the ICT assets supporting critical and important functions as defined in Article 3(22) of Regulation (EU) 2022/2554, in accordance with all the following audit test approaches: black box, grey box phase, and white box phase.
Source code review
- RequirementFinancial entities shall perform source code reviews of applications where feasible to detect vulnerabilities and security weaknesses, including open-source analyses and secure software development lifecycle assessments.
- CertiK solutionSource code reviews are conducted to identify security flaws, logic errors, and potential vulnerabilities in application code, providing actionable recommendations to strengthen security and maintain compliance with regulatory standards.
- MiCA Article 4.b (penetration tests)White box phase: auditors have as much technical information as possible (architecture, source code, telephone contacts, identifiers, etc.) before starting the analysis.
- MiCA Article 4.b (smart contracts)If the applicant uses and/or develops smart-contracts, a cybersecurity source code review of them.
Infrastructure penetration testing
- RequirementFinancial entities shall perform annual tests on all critical infrastructure components supporting important functions, including network and physical security assessments, and conduct vulnerability assessments before deploying or redeploying new or existing infrastructure components.
- CertiK solutionInfrastructure penetration testing is performed using PTES and NIST SP 800-115 methodologies to identify vulnerabilities across networks, servers, and critical systems, with scenario-based simulations that approximate real-world attack behaviors.
- DORA Article 24.6Financial entities, other than microenterprises, shall ensure, at least yearly, that appropriate tests are conducted on all ICT systems and applications supporting critical or important functions.
- DORA Article 24.4Financial entities, other than microenterprises, shall ensure that tests are undertaken by independent parties, whether internal or external.
- DORA Article 25.2Central securities depositories and central counterparties shall perform vulnerability assessments before any deployment or redeployment of new or existing applications and infrastructure components.
- MiCA Article 4.bA cybersecurity audit covering vulnerability assessments and scans, network security assessments, and configuration reviews of ICT assets supporting critical and important functions.
Infrastructure configuration review
- RequirementFinancial entities shall conduct configuration reviews of ICT assets supporting critical and important functions to ensure that system and network settings comply with operational resilience requirements.
- CertiK solutionConfiguration review evaluates servers, endpoints, and network devices to verify secure settings and tactical hardening capabilities. The service identifies gaps or misconfigurations and provides guidance to help clients remediate issues and align with regulatory requirements.
- MiCA Article 4.bA cybersecurity audit covering configuration reviews of ICT assets supporting critical and important functions as defined in Article 3(22) of Regulation (EU) 2022/2554.
Web3 incident response
- RequirementFinancial entities must promptly report major ICT-related incidents, including initial, updated, and final reports, and implement early warning indicators to detect issues.
- CertiK solutionProvides specialized support for Web3 incident investigations using our own built tools, helping organizations analyze, assess, and respond to security issues in decentralized environments.
- DORA Article 19.4Financial entities shall submit initial notification, intermediate reports, and final reports on major ICT-related incidents to the relevant competent authority.
- DORA Article 17.3.aThe ICT-related incident management process shall put in place early warning indicators.
- DORA Article 19.5Financial entities may outsource the reporting obligations to a third-party service provider, though the financial entity remains fully responsible.
Enforcement
Penalties for non-compliance
Understanding the serious consequences of failing to meet DORA and MiCA requirements.
Operational restrictions
- MiCATemporary bans (up to 10 years) on management members from exercising functions in CASPs. Authorization can be suspended or withdrawn. Non-regulated entities subject to assessor appointments.
- DORATemporary suspension from using critical ICT third-party service providers if risks are not addressed, potentially disrupting operational continuity.
Monetary fines
- MiCA
- Standard crypto-assets: €5M or 3% of annual turnover
- ARTs and EMTs: €5M or 12.5% of annual turnover
- CASPs: €5M or 5% of annual turnover
- Market abuse: €2.5M to €15M or 2% to 15% of turnover
- Natural persons: up to €1M plus profit-based multipliers
- DORAUp to 2% of total global annual turnover for non-compliance.
Resources
Learn more from our resources
How a Global Payments Provider Assessed a Settlement Token Infrastructure With CertiKA global payments provider developed a token-based settlement platform to support digital-asset settlement in the European market. CertiK conducted an independent, multi-layer security assessment covering the in-scope applications, APIs, private-blockchain environment, and smart contract.
Policy pulseHow Central Banks Secure Digital Currency before Launch: Inside the CertiK and NBKR DealKyrgyzstan’s central bank is developing a digital version of its national currency, the Digital Som. On 9 September 2026, it signed a Memorandum of Understanding with CertiK, the largest Web3 security services provider, on Digital Som security and broader digital asset oversight. The partnership spans security assessment, formal verification, operational resilience, and ongoing risk monitoring, connecting technical security with longer-term risk management and regulatory oversight.
Policy pulseNavigating "Regulation Crypto Assets": What the SEC's Proposed Framework Means for Web3 ProjectsThe regulatory landscape for Web3 in the U.S. is undergoing a significant transformation, even in the absence of the long awaited CLARITY Act. On August 18, 2026, the U.S. Securities and Exchange Commission (SEC) issued a notice of proposed rulemaking titled Regulation Crypto Assets (Release No. 33-11434; File No. S7-2026-27).
Technical insightsWhat Is a Crypto-Asset Service Provider (CASP)?A crypto-asset service provider (CASP) is any business offering any regulated “‘crypto-asset service” as defined under the EU's MiCA framework. Learn what qualifies, what compliance requires, and how to meet it.
Research reportsStablecoin Regulations in Europe and Singapore: Single Fiat Currency Pegged StablecoinsThe last year has seen an unprecedented number of institutions turning their attention to onchain opportunities, and there are many financial organizations eager to offer a variety of Web3 products and services to these investors. However, an omnipresent hurdle is the lack of unified global regulation of crypto-assets.
Research reportsMiCA’s Benefits and Limitations: An Auditing Perspective on EU Stablecoin RegulationThe global regulatory landscape for cryptocurrencies varies widely, from countries fully embracing the financial technology for its innovation and economic potential to those completely banning its use. This article examines the EU's approach to regulating stablecoins, emphasizing the role of auditors in security and risk assessments under these regulations.