EU MiCA and DORA: what a withdrawal-path review can evidence
EU crypto-asset service providers authorised under MiCA are also in scope of DORA. Neither text asks for a “withdrawal-path review” by name. They ask for secure ICT systems, controlled outsourcing, safe custody and independent testing. This page sets out what the texts say and where a review can supply evidence. It is a plain summary, not legal advice.
Sources: texts as published in the Official Journal and ESMA pages, read on 11 and 12 November 2026. We have not checked consolidated versions or later amendments. Confirm with counsel before relying on any of this.
What the texts say
| Provision | What it says | Source |
|---|---|---|
| MiCA Art. 68(7) | A crypto-asset service provider (CASP) must have “resilient and secure ICT systems as required by Regulation (EU) 2022/2554” (DORA), and a business continuity policy. | Regulation (EU) 2023/1114, OJ 9.6.2023 |
| MiCA Art. 73 | Outsourcing: the CASP “remain fully responsible”, must keep the expertise to supervise the outsourced service, and must have an outsourcing policy with contingency plans and exit strategies. | Regulation (EU) 2023/1114 |
| MiCA Art. 75(3) | The custody policy must minimise the risk of losing clients’ crypto-assets or the means of access to them “due to fraud, cyber threats or negligence”. | Regulation (EU) 2023/1114 |
| MiCA Art. 76(7) | Trading-platform systems must be resilient, handle peak volumes, reject erroneous orders, and be “fully tested”. | Regulation (EU) 2023/1114 |
| Authorisation RTS, Art. 9(b) | An application includes, “if available”, a description of a cybersecurity audit by a third-party auditor “having sufficient experience”, ideally covering penetration tests of assets supporting critical or important functions and, where smart contracts are used, a source-code review. | Delegated Regulation (EU) 2025/305, OJ 31.3.2025 |
| DORA Art. 24(4) | Financial entities other than microenterprises must ensure that resilience tests “are undertaken by independent parties, whether internal or external”. | Regulation (EU) 2022/2554, applies from 17 January 2025 |
| DORA Art. 26(1) | Threat-led penetration testing (TLPT) at least every three years, but only for entities identified by the competent authority. CASPs are not on the default list in the TLPT standard. | Regulation (EU) 2022/2554; Delegated Regulation (EU) 2025/1190, Art. 2 |
| DORA Art. 28(3) | The entity keeps a register of information on all contractual arrangements for ICT services from third-party providers, distinguishing those that support critical or important functions. | Regulation (EU) 2022/2554 |
| ESMA supervisory action | A common supervisory action on CASPs’ digital operational resilience, with emphasis on custody: governance, key and storage management, transaction controls, incident detection and response, smart-contract risks and third-party dependencies. National authorities apply it to a risk-based sample, from the second half of 2026 to the first half of 2027. | ESMA press release, 8 July 2026 |
Where a withdrawal-path review fits
A review does not satisfy any of these provisions. It produces evidence that a firm can use when it answers its regulator or builds an authorisation file.
| What the review covers | What it produces | Texts it may help evidence |
|---|---|---|
| The route from request to signature: who can start, approve and change a withdrawal; what the signer sees | Evidence on transaction controls and key management | The ESMA custody action focus areas; MiCA Art. 75(3) |
| Vendor and contractor access into the path | Evidence on third-party dependencies, access and exit | MiCA Art. 73; input for the DORA Art. 28(3) register |
| Limits, holds, detection and the ability to stop withdrawals | Evidence on incident detection and response | ESMA custody action; the ICT security duty in MiCA Art. 68(7) |
| Ledger and matching-engine invariants, with a test harness the client keeps | Evidence that the systems have been tested against written business rules | MiCA Art. 76(7) for trading platforms |
| An independent party doing the testing | A report from someone who did not build the system | DORA Art. 24(4); the “if available” audit in Art. 9(b) |
What it is not
- It is not a mandatory audit. The authorisation standard asks for the third-party audit “if available”, so it is not a stated condition of authorisation.
- The same text asks for an auditor “having sufficient experience” under the criteria of the TLPT standard. Where a national authority or a form requires specific accreditations or certifications, deebug says so up front and proposes a certified partner. deebug holds no certifications and does not claim any.
- It is not threat-led penetration testing or red-teaming. We refer those to partners. Under DORA, TLPT applies only to entities the competent authority identifies, and we have found no published list of CASPs identified.
- It is not a regulatory opinion. A report is evidence for your own compliance work and does not mean a regulator approves anything.
Dates and limits
MiCA has applied since 30 December 2024. Its transitional period for existing CASPs lasted no later than 1 July 2026, and Member States could shorten it, so end dates differ by country. DORA has applied since 17 January 2025. Which national authority supervises a given CASP, and how DORA applies to firms notified under MiCA Art. 60 rather than authorised under Art. 63, are questions for counsel.
Preparing an authorisation file or a supervisory review?
Tell us what you run and what your authority has asked for. We reply with questions, and say plainly where a partner is needed. See also scope and method and the vendor access checklist.