Operational evidence under DORA and MiCA

The Digital Operational Resilience Act applies to crypto-asset service providers as financial entities. It requires an ICT risk management framework, classification and reporting of major ICT-related incidents, testing of resilience, and management of ICT third-party risk, including a register of the providers on which the entity depends.

For a digital asset operation, third parties include node and RPC providers, indexers, oracles, bridges, custodians and analytics vendors. Each belongs in the register with a documented exit plan. Incident reporting clocks run on weekends, which implies continuous coverage rather than on-call arrangements.

MiCA adds conduct, custody and disclosure obligations for service providers and issuers, and the GENIUS Act implementing rules in the United States require permitted stablecoin issuers to maintain an information security risk and control framework and ongoing third-party oversight.

Client Focus prepares operating evidence to these expectations: incident timelines with hop-by-hop timestamps, access logs, change records, supplier assessments and continuity test results, packaged in the formats supervisors request.