An assessment of the impact of the digital operational resilience act on crypto-asset service providers

Abstract

The Digital Operational Resilience Act (DORA) forms part of the European Union’s approach to a harmonised regulatory framework across all member states. Set to be implemented on the 17th of January 2025, as part of the EU’s Digital Finance Package, DORA sets stringent requirements, for all financial entities in scope of the regulation, to address ICT risk and Cybersecurity. This study examines the impact of DORA on crypto-asset service providers (CASPs) in Malta, with a particular focus on the challenges, opportunities, and changes that emerge as these entities prepare for alignment to the regulatory requirements. The data for this study was gathered through surveys conducted with professionals in the crypto-asset industry in Malta. A mixed-method approach was utilised to allow for a more comprehensive exploration of the preparedness levels of CASPs, the anticipated financial burdens and opportunities, and the general perception of DORA within the industry. The literature revealed ten significant gaps between the current MFSA guidance document and DORA. This was further revealed in the analysis, with CASPs highlighting major challenges in areas, including, Digital Operational Resilience Testing, ICT third-party risk management, and the implementation of a robust risk management framework. The analysis shows that the challenges are further exemplified as none of the CASPs are fully aligned with DORA yet, with some not having conducted a gap analysis yet. Despite these concerns, the financial investment towards DORA appears to be marginal for most entities and the majority of CASPs view the regulation in a positive light. The results of the study reveal a potential misalignment between the challenges CASPs face and their perceived readiness for DORA implementation. The findings indicate that the challenges and opportunities of DORA are known, however, there is a general lack of preparedness among CASPs to implement these measures by the deadline. As a result, CASPs should revise their budget going forward and regulators should consider these results when planning ongoing supervision for 17 January, 2025.