Do crypto firms need both MiCA and DORA?

Yes, once licensed. MiCA covers the licence and how licensed crypto firms must behave. DORA sets how they handle IT risks, incidents and recovery.

What does the regulator ask about IT in a MiCA application?

Expect questions on how your systems are built, who can access client assets, your security policies, test results, recovery plans and IT suppliers. We prepare the answers with your team.

Can we keep serving EU clients without a MiCA licence?

The last MiCA transition periods ended across the EU on 1 July 2026. Most providers need CASP authorisation; certain already-regulated financial institutions can use MiCA’s notification route for eligible services. Your legal advisers should confirm which route applies before you continue operating.

Does an ISO 27001 certificate cover MiCA?

No. A certificate shows you run a security management system, which helps with the work. MiCA and DORA still need their own documents and checks.

Who submits a crypto licence application?

Your firm does, and the regulator decides. We handle the IT and security part with your staff and legal advisers.

Crypto and digital assets

Crypto security, from MiCA licensing to daily operations

Your security arrangements need to support both your licence application and the business that follows. We prepare the IT and security part of your MiCA application, test your platform and support ongoing security and DORA work.

Plan your MiCA security work Find your crypto business

Our clients in crypto

They are among the 15+ crypto companies we have worked with.

Relevant regulations and standards

Which rules apply to your crypto business

Your crypto services decide which MiCA rules apply, and your legal advisers confirm the licence position. DORA follows once you hold the licence.

Your business	Rules that usually apply	Where to start
Crypto exchange or trading platform with EU customers	A MiCA licence for crypto-asset service providers (CASP). DORA once licensed.	Fintech licensing: IT and security
Firm holding crypto-assets for clients	A MiCA licence (CASP), with access to client assets under close review. DORA once licensed.	Fintech licensing: IT and security
Firm that was already operating before MiCA	The last MiCA grace periods for existing firms ended across the EU on 1 July 2026.	A free call to check
Issuer of a stablecoin or other token	Separate MiCA duties that depend on the token. Your legal advisers confirm them first.	A free call to check
Licensed crypto service provider	DORA covers your IT risks, incidents, testing and IT suppliers. MiCA conduct rules continue.	DORA Compliance & ICT Risk Assessment
Software or IT supplier to crypto firms	DORA reaches you through your licensed customers’ contracts.	Technology & SaaS

ISO 27001 can organise the security work behind both laws, but a certificate replaces neither.

Common challenges

Decisions behind your licence documents

Your application describes planned systems
The documents must match how your platform, wallets and suppliers will work once you go live.
Withdrawals need named approvers
You need to record who can approve withdrawals and who can change access to client assets.
The regulator asks follow-up questions
Answers about systems, responsibilities and recovery must stay consistent across every document and meeting.
Licence commitments need ongoing oversight
Once licensed, your staff must run the access reviews, tests and recovery checks your application described.

How we help

Help at each stage of your crypto licence

Common questions

Free 30-minute call

Plan the IT side of your MiCA licence

Discuss your crypto services, licensing stage and security priorities in a free 30-minute call to plan the IT and security support you need.

Plan your MiCA security work hello@guardera.tech