Digital-asset technology is not like other technology. Custody is irreversible, the ledger is public, and the regulatory perimeter moved under the industry the moment MiCA came into force.
MiCA is in force for crypto-asset service providers. DORA applies to CASPs as financial entities. A CASP authorisation is, in large part, a statement about technology: how keys are held, how the platform resists failure, and how third-party dependencies are governed.
The technology function of a CASP is not the back office. It is the custody, the compliance perimeter and the operational resilience of the business at once. It must be architected, governed and maintained accordingly.
What regulated digital-asset technology requires
Custody infrastructure. Private-key management that meets MiCA’s security and resilience requirements. Not aspirationally secure — architecturally designed for the purpose, with segregation and recovery built in.
Operational resilience under DORA. Recovery capability designed into the architecture and tested against defined objectives. Real-time incident detection, not retrospective reconciliation.
ICT risk management framework. An operational framework with clear ownership, continuous review and demonstrable operation. DORA requires this, and requires evidence that it works.
Transaction integrity and monitoring. On-chain and off-chain reconciliation, travel-rule compliance and transaction monitoring that meet regulatory expectations and survive scrutiny.
Third-party risk management. Wallet infrastructure, node providers, market-data feeds and cloud infrastructure — every material dependency mapped, assessed and governed.
- MiCA CASP Operational Readiness
- MiCA Technology Compliance
- DORA ICT Third-Party Risk
- Technology Due Diligence
- Consultancy
Free interactive tool
Website compliance checklist
What your site has to do, based on what it actually does
Answer as much or as little as you like — the list builds as you go. Nothing is stored against your name and no email is required.
Everything that applies
Ordered by what to do first: legal requirements you can close quickly, then larger pieces of work, then what is expected rather than required. Not exhaustive, and not a legal audit.
Dated PDF, yours to keep or circulate.
Free interactive tool
Interactive deadline calculator
Check which regulations apply to you and when
Regulation across the EU, UK, US and Asia-Pacific has moved considerably in the past eighteen months, and several headline dates have shifted more than once. Twelve questions, about three minutes.
Results are shown on screen — no email required. A dated summary is available to download, and can be sent on if that's more useful. What we do with your answers.