Obtaining a MiCA authorization is an important milestone for a crypto business operating in Europe, but it is not the end of its regulatory obligations. A crypto-asset service provider (CASP) may be properly authorized under MiCA and still face regulatory problems because its anti-money laundering controls are inadequate or its technology infrastructure does not meet operational-resilience requirements.
This is where three regulatory frameworks intersect: MiCA, the EU's anti-money laundering and counter-terrorist financing (AML/CFT) regime, and the Digital Operational Resilience Act (DORA). Each addresses a different category of risk, but together they determine how a regulated crypto business must operate.
For founders and compliance teams, the real challenge is not understanding these frameworks individually. It is establishing an organization in which licensing, financial-crime prevention and operational resilience work together without creating conflicting responsibilities, gaps in oversight or unnecessary duplication.
What Are MiCA, AML and DORA?
MiCA, AML/CFT and DORA are closely connected, but they serve different regulatory purposes. Understanding those differences is the foundation of an effective compliance framework.
MiCA: Authorization and Conduct of Business
The Markets in Crypto-Assets Regulation (MiCA), Regulation (EU) 2023/1114, establishes the EU framework for certain crypto-assets and crypto-asset services. For CASPs, it addresses authorization, governance, organizational arrangements, conduct of business, safeguarding and other requirements relevant to the services provided.
In practical terms, MiCA determines whether a business may provide regulated crypto-asset services and under what conditions. However, authorization alone does not establish that the business satisfies every other regulatory requirement applicable to its operations.
AML/CFT: Preventing Financial Crime
The EU's anti-money laundering framework requires relevant businesses to identify customers, assess financial-crime risks, monitor activity and detect or report suspicious conduct. For crypto businesses, this includes customer due diligence, beneficial-ownership verification, transaction monitoring, sanctions-related controls and compliance with applicable transfer-information requirements.
Crypto AML compliance is not a one-time approval process. It requires ongoing risk assessment, monitoring, recordkeeping and appropriate responses to changes in customer behavior or transactional activity.
DORA: Digital Operational Resilience
The Digital Operational Resilience Act, Regulation (EU) 2022/2554, focuses on the ability of financial entities to withstand, respond to and recover from ICT-related disruptions. For in-scope CASPs, this includes ICT risk management, incident management and reporting, resilience testing and oversight of ICT third-party providers.
DORA addresses a question that neither a licensing file nor an AML policy can resolve on its own: whether a business can continue operating safely when critical technology fails. Given the reliance of crypto businesses on custody systems, transaction-processing platforms and external infrastructure providers, this is an essential part of regulatory compliance.
How Do the Three Compliance Layers Work Together?
The easiest way to understand the relationship is to consider a typical crypto exchange. Under MiCA, the exchange requires the appropriate authorization, governance framework, client-asset protection arrangements and service-specific procedures. Under AML/CFT rules, it must identify and assess customers, monitor relevant activity and manage money laundering and terrorist-financing risks. Under DORA, if within scope, it must maintain appropriate ICT risk controls and manage operational disruptions, including those involving external technology providers.
These obligations frequently involve the same systems, employees and business processes. Customer onboarding, for example, is not exclusively an AML function. It also depends on governance arrangements, outsourcing decisions, recordkeeping and the reliability of the platforms used to collect and verify customer information. Similarly, a transaction-monitoring outage is more than an IT problem because it can prevent the business from performing mandatory financial-crime controls.
An effective compliance framework therefore needs clearly assigned responsibilities while recognizing the dependencies between different regulatory requirements. The objective is not merely to maintain three separate sets of policies, but to ensure that the controls supporting each framework function together in everyday operations.
How Does the Law Apply to CASPs?
The first step is identifying the activities a business performs and determining which legal requirements apply to those activities. Under MiCA, CASP authorization generally applies to entities providing regulated crypto-asset services within the EU, subject to the regulation's scope, exemptions and special arrangements for certain financial institutions.
Crypto AML compliance is governed by a broader set of legal instruments rather than MiCA alone. This includes applicable national AML/CFT legislation implementing EU requirements, directly applicable EU rules and relevant supervisory guidance. The EU Transfer of Funds Regulation imposes additional information requirements for certain crypto-asset transfers. Although these obligations are operationally connected to AML controls, they form a distinct legal requirement.
DORA has applied since 17 January 2025. Its scope expressly includes authorized CASPs and issuers of asset-referenced tokens, subject to the regulation's scope provisions and exclusions. Meanwhile, the forthcoming EU Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, will introduce a more harmonized AML framework, with its principal application date set for 10 July 2027.
This timing matters for crypto businesses operating in November 2026. They must comply with the AML requirements already in force while preparing for the changes that will apply under the new framework. The precise obligations depend on the services provided, the entity's legal status, the relevant Member State, its organizational structure and any applicable exemptions.
Legal Insight | Dr. Peter Merc, founder, Lemur Legal
“A MiCA authorization is not a certificate that every part of your business is compliant. It confirms that you have met the requirements for authorization, but your AML controls, operational resilience and internal governance still need to work in practice.
The real test comes when something goes wrong. A transaction-monitoring system fails, a technology provider experiences an outage, or suspicious activity goes undetected. At that point, regulators will be interested in much more than the policies you submitted with your application. They will want to know whether your controls actually worked.”
This distinction is particularly relevant for businesses that approach compliance primarily as an authorization project. The regulatory assessment should not end when permission to operate is granted. A CASP must continue demonstrating that its systems, procedures and controls remain effective as its activities and risk exposure evolve.
What AML Obligations Apply to Crypto Businesses?
A properly designed AML program begins with understanding where financial-crime risks arise in the business model. A custodial exchange, a crypto transfer service and a trading platform may face different risk exposures, even where some regulatory requirements overlap.
Customer Due Diligence and Beneficial Ownership
CASPs subject to AML obligations must implement appropriate procedures for identifying and verifying customers and, where relevant, beneficial owners. Customer due diligence may also require understanding the purpose and intended nature of a business relationship, applying enhanced measures where appropriate and keeping information up to date.
These procedures should reflect the services provided and the risks associated with different customers and transactions. A standardized onboarding process can support compliance, but it should not replace the ability to identify situations requiring additional investigation or enhanced due diligence.
Transaction Monitoring and Suspicious Activity
Crypto businesses need risk-based systems for detecting potentially suspicious activity. Monitoring may involve transaction patterns, customer behavior, exposure to higher-risk counterparties and relevant blockchain activity. Blockchain analytics can support these controls, but the technology itself does not determine whether a particular transaction is suspicious.
The business must establish procedures for investigating alerts, documenting decisions, escalating concerns and making required reports to the relevant authorities. These controls must also remain effective when transaction volumes increase, new products are introduced or customer risk profiles change.
Sanctions Compliance
Sanctions screening is closely related to financial-crime compliance but should not be treated as interchangeable with AML. EU restrictive measures may impose prohibitions or asset-freezing obligations that operate independently of a customer's money laundering risk rating.
A customer assessed as presenting a relatively low AML risk may nevertheless be subject to restrictions that prohibit certain transactions. CASPs therefore need to ensure that their compliance arrangements appropriately address both AML/CFT obligations and applicable sanctions requirements.
Travel Rule Obligations
The Travel Rule requires specified information concerning originators and beneficiaries to accompany certain crypto-asset transfers. The European Banking Authority has published guidelines on information requirements for crypto-asset transfers.
For CASPs, implementation involves ensuring that the necessary information is transmitted, received, assessed and handled appropriately. These procedures should be integrated with broader AML controls rather than operating as an isolated technical feature. In practice, reliable data flows and clearly defined responsibilities can be as important as the technology used to exchange the information.
How Does DORA Affect Crypto Businesses?
Crypto businesses depend heavily on digital infrastructure. An interruption involving custody systems, transaction processing, cloud services or cybersecurity infrastructure can affect customers and regulatory obligations simultaneously. DORA addresses these risks through a structured ICT risk-management framework that requires in-scope financial entities to develop appropriate safeguards, response capabilities and oversight arrangements.
The framework covers several interconnected areas, including ICT risk management, incident detection and reporting, operational resilience testing and management of ICT third-party risks. Businesses must identify critical systems, assess vulnerabilities, establish appropriate continuity arrangements and maintain procedures for responding to disruptions. Requirements concerning testing and reporting depend on the entity's regulatory status and the specific provisions applicable to it.
A common misconception is that DORA compliance can be achieved simply by purchasing cybersecurity software or outsourcing infrastructure to an established cloud provider. Neither approach removes the financial entity's regulatory responsibility. The governing body remains accountable for the applicable ICT risk-management framework, including relevant risks arising from outsourced technology functions.
DORA also incorporates proportionality principles and differentiated requirements. A smaller CASP should therefore assess its actual obligations rather than assuming that every technical requirement applies identically to every financial institution. The objective is to establish controls that are legally appropriate and operationally effective for the business concerned.
MiCA vs the EU AML Package: What Is the Difference?
MiCA and the EU's AML framework operate alongside each other because they address different regulatory questions. MiCA establishes requirements for authorized crypto-asset service providers and certain crypto-asset issuers, while AML legislation focuses on preventing the misuse of financial and related services for money laundering and terrorist financing.
An entity may satisfy the conditions for authorization under MiCA while still needing to implement or improve its financial-crime risk-management controls. Conversely, having established AML procedures does not replace the need for CASP authorization where MiCA requires it.
The EU's 2024 AML package introduces further harmonization through the new AML Regulation, the accompanying directive and the establishment of the EU Anti-Money Laundering Authority (AMLA). For CASPs, this creates an important compliance-planning consideration because existing procedures should not automatically be assumed to satisfy every forthcoming requirement.
Businesses should review their policies, governance arrangements, systems and documentation against the relevant implementation timetable. The objective should be controlled adaptation, with a clear understanding of which requirements already apply and which changes will become mandatory in the future.
Where Compliance Failures Usually Occur
Regulatory problems often arise not because a business lacks compliance policies, but because those policies do not accurately reflect how the organization operates. Consider a crypto platform that uses an external provider for transaction monitoring. The AML team is responsible for investigating suspicious activity, while the technology team manages the relationship with the service provider.
If the monitoring service becomes unavailable, several regulatory and operational questions arise simultaneously. The business must determine who detects and escalates the interruption, whether affected transactions can be identified, how missed alerts will be reviewed and whether the incident triggers reporting obligations under DORA. Management must also decide whether relevant services can continue safely while the disruption is being resolved.
The same event may therefore affect AML control effectiveness, ICT resilience and broader governance responsibilities. If these functions operate independently without clearly defined escalation procedures, the organization may struggle to respond consistently or demonstrate how decisions were made.
Another common weakness is inconsistent documentation. A business may describe one operational arrangement in its authorization materials, another in its compliance manual and a third in contracts with technology providers. Such inconsistencies can create difficulties during supervisory reviews and internal audits, particularly when the documented arrangements do not reflect actual responsibilities.
The solution is not necessarily producing more documentation. It is ensuring that policies, contracts, systems and internal responsibilities accurately reflect one another and that the organization can demonstrate how its controls work in practice.
How to Build an Integrated CASP Compliance Framework
The starting point should be a regulatory obligations map that identifies the requirements applicable to the company's activities, the functions responsible for implementing them and the evidence needed to demonstrate compliance. Rather than treating each regulation as a separate project, the organization should consider how requirements overlap and which systems support multiple compliance functions.
The first stage involves defining the regulatory perimeter, including the services provided, relevant legal entities and jurisdictions. The business can then map obligations under MiCA, applicable AML/CFT legislation, DORA and other relevant rules. Each requirement should have an accountable owner, whether within management, compliance, risk or technology.
Particular attention should be paid to shared infrastructure. Customer databases, transaction-monitoring platforms, custody systems and outsourced technology providers may support several regulatory obligations simultaneously. Where a critical system fails, the organization needs a clear understanding of the consequences for each affected function and the procedures required to manage the disruption.
Maintaining appropriate evidence is equally important. Policies, risk assessments, incident records, testing results, training documentation and management decisions should provide a consistent account of how compliance responsibilities are fulfilled. Regular review is necessary because the company's business model, technology infrastructure and applicable regulatory standards may change over time.
For crypto and fintech businesses operating under multiple regulatory frameworks, a structured approach to compliance can help prevent gaps between legal requirements and everyday operations. Lemur Legal provides regulatory compliance support, including compliance gap analyses, internal policies, risk assessments and ongoing guidance as EU financial regulations evolve.
A Regulatory Framework That Works Beyond Authorization
MiCA, AML/CFT and DORA should not be treated as three isolated compliance exercises. They address different regulatory risks, but they operate within the same business. A well-governed CASP needs appropriate authorization, effective financial-crime controls and resilient technology infrastructure, because weaknesses in one area can undermine the effectiveness of the others.
The strongest compliance approach begins with a clear understanding of the business model, the applicable legal obligations and the practical dependencies between systems and teams. For founders, this means treating compliance as part of operational design rather than an administrative task completed before launch.
The objective is not merely to obtain authorization. It is to establish a crypto business capable of meeting its regulatory responsibilities as it develops, with governance and controls that remain effective beyond the initial licensing process.
This article provides general regulatory information and does not constitute legal advice. Requirements depend on the company's activities, regulatory status, jurisdiction and applicable legislation.