EU Parliament Passes Cybersecurity Legislation for Crypto and Fintech Firms

The European Parliament has passed a bill titled Digital Operational Resilience Act (DORA) addressing the cybersecurity of crypto and fintech companies.

The bill aims to create new rules relating to cybersecurity for the crypto asset, financial, and tech service providers. It is also passed to coordinate risk management requirements and procedures for reporting cybersecurity incidents. 

With the DORA bill, Financial institutions will be needed to oversee and report security events, and tech service providers will be submitted to oversight by European regulators. Frances Fitzgerald, a centre-right member of the European Parliament who co-drafted the law, said in a statement:

“Financial institutions and companies, including in the crypto space, hold extremely sensitive information about customers, and it is vital that EU-wide digital security measures are put in place to defeat the threat that exists.” 

The new law will apply to EU-regulated financial entities, including traditional finance banking and investment firms and digital asset providers such as electronic money (e-money) and crypto-asset service providers. Other firms included tech service providers who provide IT solutions such as data analytics.

The legislation is passed by a margin of 556 in support and 18 against. Regulations corresponding with the law are said to be fully enforced in 24 months, which is in 2025, after its publication in the Official Journal of the EU.

Fitzgerald further noted,

“We need to implement stronger protections for our citizens. We do not want to see anyone's personal financial information hacked. The Digital Operational Resilience Act will ensure that Europe will remain an important center for investment.”

Notably, the DORA bill comes after the EU parliament recently passed a bill, Markets in Crypto Assets (MiCA), which received a 28:1 vote to scale, completing the tripartite deal required to push it into its next implementation phase.