DORA for CASPs in France
Since 17 January 2025, the Digital Operational Resilience Act (DORA) has applied to crypto-asset service providers (CASPs) authorised under MiCA. The AMF (Autorité des marchés financiers, the French financial markets regulator) examines it from the review of the authorisation application, in a separate ICT section, and throughout the provider’s life.
Part of the requirements is technical and belongs to a cybersecurity provider. The rest is legal: governance, classification of functions and providers, contracts, the register of information, incident reporting and answers to the regulator.
ORWL Avocats handles this legal side of digital operational resilience, at the authorisation stage and afterwards: overhaul of the framework, changes in business, acquisitions and buy-side due diligence. The firm works alongside its clients’ cybersecurity provider, which keeps the technical analysis, testing and system monitoring.
Which crypto firms does DORA apply to?
Regulation (EU) 2022/2554 of 14 December 2022 on digital operational resilience for the financial sector sets a common framework for managing ICT risk. Its Article 2 covers, among others:
- crypto-asset service providers authorised under MiCA;
- issuers of asset-referenced tokens;
- payment institutions and electronic money institutions, including exempted ones;
- account information service providers.
The competent authority follows the authorisation (Article 46): the AMF for CASPs, the ACPR (Autorité de contrôle prudentiel et de résolution, the French Prudential Supervision and Resolution Authority) for payment and electronic money institutions. A firm that holds both statuses answers to both authorities.
The five pillars of the regulation
- An ICT risk management framework, under the responsibility of the management body (Articles 5 to 16).
- The classification of ICT-related incidents and the reporting of major incidents to the authority (Articles 17 to 23).
- Digital operational resilience testing, from basic tests to threat-led penetration testing (TLPT), the latter reserved for entities identified by the authority (Articles 24 to 27).
- The management of ICT third-party risk: contracts, register of information, exit strategy (Articles 28 to 30).
- The sharing of cyber threat information and intelligence (Article 45).
Microenterprises: lighter rules, not an exemption
The proportionality principle (Article 4) adjusts how the rules apply; it removes none of the pillars. A CASP that qualifies as a microenterprise, meaning fewer than ten staff and an annual turnover or balance sheet total of no more than EUR 2 million (Article 3), applies the full framework. It is spared a few requirements: the independent control function for ICT risk (Article 6(4)), regular internal audit of the framework (Article 6(6)) and a formal strategy on ICT third-party risk (Article 28(2)). It reviews its framework periodically rather than every year.
The AMF checks this status on the basis of documents, in the light of headcount and business volumes. It expects a microenterprise to have an ICT audit trigger framework, even though no audit frequency is imposed. The simplified ICT risk management framework of Article 16 does not cover CASPs: it is aimed at, among others, exempted payment and electronic money institutions.
Payment and electronic money institutions
DORA also applies to payment institutions and electronic money institutions, under ACPR supervision. Those exempted under the payment services and electronic money directives fall under the simplified framework of Article 16. In France, this covers the établissement de paiement allégé (small payment institution under the PSD2 exemption; linked article in French) that a CASP obtains to provide services on e-money tokens.
An authorised institution that applies for CASP authorisation has had to comply with DORA since 17 January 2025. The AMF then expects a single framework that covers both payment functions and crypto-asset services, with controls that have been running for several months, and their results.
Dual CASP and payment institution status: when crypto needs ACPR authorisation
What does the AMF check in the ICT section of a CASP authorisation application?
The application describes the applicant’s ICT systems and security arrangements (MiCA, Article 62(2)), and MiCA refers to DORA for operational resilience (Article 68). DORA binds authorised CASPs only, yet the AMF reviews this section against the regulation and its implementing texts. In practice, the framework must exist when the file is submitted, with its evidence, and must operate on the day of authorisation.
The AMF’s requests follow a consistent pattern. It does not accept an information security policy in place of a full set of documents: each policy must be backed by procedures, as Commission Delegated Regulation (EU) 2024/1774 requires, or failing that by a dated roll-out plan. It requires a chief information security officer (CISO), who holds the independent control function of Article 6(4) and stays separate from operational functions: neither a member of the management body nor the chief technology officer may hold the role, which may however be outsourced. It reads the risk assessment closely: the assessment must identify critical or important functions within the meaning of Article 8 and link them to the assets that support them.
| Area | What the AMF expects | Expected deliverables |
|---|---|---|
| Applicable regime | Microenterprise status justified by headcount and volumes; lighter rules limited to what the text provides | Memo on the applicable regime |
| Governance | Independent CISO, segregation of duties, ICT committees that actually meet and decide | ICT risk governance policy, contract for the outsourced CISO, committee minutes |
| Policy framework | Policies backed by operational procedures; dated roll-out plan for what remains to be deployed | Policies and procedures, requirements coverage matrix, roll-out plan |
| Risk assessment | Explicit method, detailed likelihood and impact, critical or important functions linked to assets, treatment plan, a named owner for each risk | Map of critical or important functions, risk assessment, risk treatment plan |
| Internal control | First-level and second-level control plan covering the whole framework; evidence that the controls operate | Control plan, evidence log, control results |
| ICT third-party providers | ICT third-party risk policy, register consistent with the outsourcing policy, documented due diligence, updated contracts with critical providers | ICT third-party risk policy, register of information, contracts and amendments, due diligence files |
| Continuity and audits | Business continuity plan with a testing schedule; audit programme or, for a microenterprise, an audit trigger framework | Audit trigger framework, business continuity plan, testing schedule |
| Incidents | Ready-to-use classification and reporting procedure, with defined roles and deadlines | Incident management and reporting procedure, reporting templates. See also: obtaining CASP authorisation from the AMF |
An applicant that arrives with a consistent set of documents, dated evidence and committees that have actually met shortens the exchanges with the AMF. A register of providers that contradicts the outsourcing policy, or assessments all dated the week of submission, have the opposite effect.
DORA after authorisation: what changes in the life of a CASP
Authorisation opens a permanent compliance obligation. The commitments made in the application bind the CASP, and the AMF checks that they are carried out through its information requests and inspections. Four moments call for a legal review of the framework:
- the review of the framework, at least once a year (periodically for a microenterprise) and after any major ICT-related incident (Article 6(5));
- the annual submission of the register of information to the authority, using the templates of Commission Implementing Regulation (EU) 2024/2956 (Article 28(3));
- changes in business: a new service, a new critical provider or a redesigned architecture alters the list of critical or important functions and may call for a notification to the AMF;
- acquisition or fundraising: an acquirer of a holding in a CASP must assess the target’s DORA compliance, and the firm handles this part of the acquisition due diligence.
The register of information lists all contractual arrangements for ICT services and identifies those that support critical or important functions. It is submitted once a year: for payment and electronic money institutions, the ACPR collected the register for the 2025 financial year through its OneGate portal, by 31 March 2026. The most common errors concern substance more than format: providers wrongly classified, critical functions left out, inconsistencies with the signed contracts.
Ongoing compliance matters outside DORA, such as public policies, best execution and conflicts of interest, are covered on the page MiCA compliance for authorised CASPs.
Major ICT-related incident: who reports, and when?
The CASP classifies each incident against the criteria of Commission Delegated Regulation (EU) 2024/1772: clients affected, duration, geographical spread, data losses, criticality of the services, economic impact. If the incident is major, the CASP reports it to the AMF (Article 19). Commission Delegated Regulation (EU) 2025/301 sets the content and time limits:
- initial notification within four hours of classification, and no later than 24 hours after the CASP becomes aware of the incident;
- intermediate report within 72 hours of the initial notification;
- final report within one month of the latest intermediate report.
The CASP remains responsible even when the incident originates with a provider (Article 28(1)). This is the most frequent case: in its report of 24 September 2026 on major incidents reported in 2025, the AMF notes that more than 80% of the 33 incidents reported by the entities it supervises came from their providers. The CASP must then report on incomplete, sometimes contradictory information, and correct it in the intermediate report. Classifying the incident, deciding to report it and drafting the notification commit the entity before its regulator: the firm settles these points with the client, within the deadlines.
ICT providers: classify, negotiate, demonstrate
Most CASPs rely on providers for hosting, custody, execution, KYC or payments. MiCA governs the outsourcing of operational functions (Article 73); DORA governs any use of an ICT service. The firm handles both regimes together, as the same contract often falls under both. The work follows four stages.
- Analysis: classify each relationship (ICT service within the meaning of DORA, outsourcing within the meaning of MiCA, critical or important function) and identify missing clauses.
- Advice: settle the CASP’s position on each gap, the exit strategy and the fallback options when the provider refuses to negotiate.
- Negotiation: obtain the clauses of Article 30 (description of the services, data processing locations, service levels, assistance in the event of an incident, cooperation with the authority, termination rights and, for critical or important functions, audit rights and exit strategy). The firm also acts for providers facing their financial-sector clients.
- Demonstration: document compliance in the register, the ICT third-party risk policy and the answers to the AMF, so that the authority finds the same analysis in every document.
Providers that are hard to replace often impose their standard terms. The AMF’s report also notes that some dispute their status as ICT providers to escape the regulation’s requirements. A well-built DORA amendment, with a written record of refusals and compensating measures, protects the CASP during an inspection. Choosing a blockchain analytics or travel rule provider also engages the CASP’s AML/CFT framework.
Our approach
A DORA engagement follows four stages. The firm handles the legal side and coordinates the parties; the client’s cybersecurity provider keeps the technical side.
The stages of a DORA engagement
| Stage | What ORWL Avocats does | What stays with the client and its cybersecurity provider |
|---|---|---|
| 1. Scoping | Applicable regime, critical or important functions, legal mapping of providers, gap analysis requirement by requirement | Inventory of assets and data flows, status of security tools |
| 2. Project management | Work plan aligned with the authorisation review or the authority’s deadlines, allocation of roles, preparation of committees | Appointment of the CISO, mobilisation of teams |
| 3. Delivery | Policies and procedures, contracts and amendments, register of information, incident procedure, answers to the AMF or the ACPR | Technical risk assessment, security measures, resilience and continuity testing |
| 4. Follow-up | Annual review, register submission, incidents, business changes, information requests and inspections by the authority | First-level and second-level controls, system monitoring, audits |
Where the client has no cybersecurity provider, the firm draws on a network of specialists (audit, penetration testing, monitoring) to cover the matter end to end, with the right counterpart at each stage.
Why work with ORWL Avocats?
ORWL Avocats has advised crypto-finance projects before the AMF and the ACPR since the first PSAN registrations (prestataires de services sur actifs numériques, the former French regime for digital asset service providers). On DORA, the firm advises CASP authorisation applicants, payment institutions extending their business to crypto-assets, authorised CASPs and technology providers facing their financial-sector clients. The practice is ranked in Chambers FinTech and recognised by Leaders League for blockchain law.
A consultant sets up the framework; a lawyer classifies, negotiates and defends it. Deciding that a function is critical, that a supplier is an ICT provider or that an incident must be reported is a legal analysis, and the authority bases its findings on that analysis. Exchanges with the firm are protected by the lawyer’s professional secrecy (secret professionnel) under French law. The lawyer is professionally liable for what they write, and experience of exchanges with the AMF and the ACPR guides every answer.
A partner leads each matter: they set the strategy, lead the exchanges and decision meetings, and sign the deliverables that commit the client. The team adapts to each engagement to bring in the relevant expertise.
The CASP life cycle
Digital operational resilience is one of the six dimensions of a crypto-asset service provider’s compliance. It is built in the authorisation application and works alongside ongoing compliance and AML/CFT.
CASP lawyers in France: MiCA authorisation and compliance
Obtaining CASP authorisation from the AMF
AML/CFT compliance for crypto-asset service providers in France
