DORA

DORA is a horizontal ICT risk management framework, not a crypto-specific rule. It rests on five pillars: ICT governance and risk management, mandatory reporting of major incidents to the competent authority, digital operational resilience testing (including Threat-Led Penetration Testing for significant entities), management of ICT third-party risk through a register of information covering every contract, and an EU-wide oversight framework for critical third-party providers (CTPPs) run by a Lead Overseer appointed by the ESAs (EBA, ESMA, EIOPA).

It forms part of the EU Digital Finance Package alongside MiCA and is accompanied by Directive (EU) 2022/2556, which amends sector directives. It is completed by technical standards (RTS and ITS) drafted jointly by the three ESAs, and applies to roughly twenty categories of financial entities plus their technology providers.

For a tokenization project the implication is direct. Crypto-asset service providers (CASPs) authorized under MiCA fall within DORA's scope. A stablecoin issuer or a tokenization platform complies with both rules in parallel: it manages ICT risk, registers its cloud, custody and oracle providers, and reports incidents on time. Reliance on external oracles and custodians counts as ICT third-party risk.