What CEXs Should Know About Crypto Regulations in the European Union 2025 — MiCA, DORA, and AML Package

Introduction

The European Union has become one of the most influential regions in defining how the crypto industry should operate. With regulation now moving from discussion to enforcement, the EU is introducing binding frameworks that directly shape the future of digital assets.

For centralized exchanges, this is especially significant. Compliance with EU rules is not only a condition for operating in the European market but also a signal of long-term reliability. Since European standards often serve as a benchmark for other jurisdictions, understanding these regulations is essential for exchanges aiming to build global trust and resilience.

General Context: Crypto Regulation in the European Union

The European Union has taken a structured and proactive approach to regulating the crypto industry, aiming to balance three main objectives: consumer protection, financial stability, and market integrity. By establishing clear rules, the EU seeks to provide a secure environment for users while fostering responsible growth of digital assets and related services.

Key legislative initiatives shaping this framework include:

• MiCA (Markets in Crypto-Assets Regulation) — sets comprehensive rules for crypto-asset service providers, including licensing, governance, and transparency requirements.
• DORA (Digital Operational Resilience Act) — focuses on operational resilience, cybersecurity, and ICT risk management for financial entities, including centralized exchanges.
• AML Package (Anti-Money Laundering directives) — strengthens requirements for customer due diligence, transaction monitoring, and reporting to prevent illicit activities.

It is important to note that these regulatory frameworks also apply to centralized exchanges, which are the primary focus of this article. Compliance with these rules is critical for CEXs to operate legally in the EU countries and to build trust with users and partners globally.

MiCA (Markets in Crypto-Assets Regulation)

The MiCA regulation (Markets in Crypto-Assets) introduces a unified EU crypto regulation that applies to all crypto-asset service providers (CASPs), including centralized exchanges. For businesses, this means that compliance is mandatory: operating without authorization or failing to meet EU standards can result in fines, suspension, or being forced to leave the market.

• Definition of CASP

Under MiCA crypto regulation, CASPs are defined as businesses offering custody, trading platforms, crypto-to-fiat or crypto-to-crypto exchange, transfers, and other crypto-asset services. This definition is broad and ensures that most centralized exchanges fall under MiCA EU rules.

In simple terms: A CASP is basically any business that lets people trade, store, or move crypto. This includes centralized exchanges, so if your platform offers these services, MiCA rules apply to you.

Source: MiCA, Title I – SUBJECT MATTER, SCOPE AND DEFINITIONS, Article 3.

• Mandatory Authorization

All CASPs must obtain authorization from the competent authority under MiCA to operate legally in the EU. From 30 December 2024, new CASPs cannot start providing services without such authorization. Existing providers may continue to operate under national regimes during a transitional period until 1 July 2026, after which authorization will be mandatory.

In simple terms: To run legally in the EU, every CASP needs a MiCA license. New platforms must have it from 30 December 2024, while existing ones can keep operating under national rules only until 1 July 2026. After that, no license means no business.

Sources: MiCA, Title V – Authorization of Crypto-Asset Service Providers, Articles 59–83;
MiCA, Title IX – TRANSITIONAL AND FINAL PROVISIONS, Article 143.

• Services Requiring Licensing

Activities such as custody and administration, operation of a trading platform, exchange (crypto↔fiat or crypto↔crypto), execution of orders, reception and transmission of orders, placing, advice, portfolio management, and transfer of crypto-assets are defined as crypto-asset services under MiCA and therefore require CASP authorisation. Exchanges should review their full service stack to ensure compliance with MiCA’s authorisation and operating conditions.

In simple terms: MiCA lists a wide range of crypto services — like custody, trading platforms, exchanges, order execution, advice, and portfolio management — that all need a CASP license. This means centralized exchanges must check every service they offer to make sure each one is covered by proper authorization.

Sources: MiCA, Title I – SUBJECT MATTER, SCOPE AND DEFINITIONS, Article 3;
MiCA, Title V – AUTHORISATION AND OPERATING CONDITIONS FOR CRYPTO-ASSET SERVICE PROVIDERS, Articles 59–83;
MiCA, Title IX – TRANSITIONAL AND FINAL PROVISIONS, Article 143.

• Organizational Requirements

The MiCA regulation requires CASPs to have proper governance structures, clear roles, risk management systems, and internal procedures to ensure operational continuity. Strong IT systems and security measures are also mandatory to protect users and maintain resilience.

In simple terms: CASPs need strong internal rules and clear responsibilities so the business keeps running smoothly and securely. They must also have reliable IT systems and cybersecurity measures in place — especially important for centralized exchanges — to protect users and stay resilient against risks.

Source: MiCA, Title V – AUTHORISATION AND OPERATING CONDITIONS FOR CRYPTO-ASSET SERVICE PROVIDERS, Chapter 2, Article 68.

• Technical Standards and Cybersecurity

ESMA and EBA are mandated under EU crypto regulation to develop detailed technical standards for CASPs, covering ICT systems, resilience, and cybersecurity. CEXx should align their IT infrastructure and security protocols with these standards early. Tools like independent security audits and bug bounty programs can help identify vulnerabilities and demonstrate readiness to regulators.

In simple terms: EU regulators (ESMA and EBA) will set detailed tech and security rules for CASPs. Centralized exchanges should start upgrading their IT and cybersecurity now — using tools like audits and bug bounty programs — so they’re ready to meet these standards and avoid trouble later.

Sources: MiCA, Title V – AUTHORISATION AND OPERATING CONDITIONS FOR CRYPTO-ASSET SERVICE PROVIDERS, Chapter 2, Article 68;
MiCA, Title VI – Competent authorities, ESMA and EBA, Articles 86–92.

DORA (Digital Operational Resilience Act)

DORA sets uniform EU-wide requirements for the digital operational resilience of financial entities, explicitly including crypto-asset service providers (CASPs). For centralized exchanges, this means supervisors will not only assess licensing and conduct obligations under MiCA but also monitor the robustness of ICT systems, cybersecurity measures, and third-party risk management frameworks.

• Scope

DORA applies to crypto-asset service providers (CASPs) as financial entities under EU law, establishing binding obligations for ICT risk management and operational resilience.

In simple terms: DORA treats CASPs, including centralized exchanges, like other financial institutions. This means they must follow strict rules on IT risk management and operational resilience to stay compliant.

Source: DORA, Article 2 – Scope

• ICT Risk Management

Exchanges, as CASPs under DORA, must establish and maintain a comprehensive ICT risk management framework covering governance, prevention, detection, response, recovery, and continuous improvement. This framework must include robust business continuity and backup planning, secure access and change management, continuous monitoring of ICT systems, and regular resilience testing.

In simple terms: Centralized exchanges have to build strong IT risk systems that cover everything from prevention to recovery. This includes backup and continuity plans, strict access controls, constant system monitoring, and regular security testing to prove they can withstand disruptions.

Source: DORA, CHAPTER II – ICT risk management, Articles 5–14.

• Incident Reporting

Exchanges, as CASPs under DORA, must report major ICT-related incidents—including cyberattacks, system outages, or data breaches—to their competent authority within prescribed deadlines. Reporting obligations include an initial notification, subsequent updates, and a final report. In cases of serious impact, affected clients may also need to be informed. Failure to comply constitutes a regulatory breach.

In simple terms: Centralized exchanges must quickly inform regulators if they face big IT problems like hacks or outages. They need to send an initial alert, follow-up updates, and a final report — and in serious cases, also notify their users. Not reporting on time breaks the law.

Source: DORA, Chapter III – ICT-related incident management, classification and reporting, Articles 17-23.

• Digital Operational Resilience Testing

Exchanges must conduct regular ICT resilience testing, including vulnerability assessments and other security evaluations, as part of their ongoing risk management. For “significant” CASPs, supervisors may mandate threat-led penetration testing (TLPT), which must be carried out at least once every three years. These measures ensure preparedness against sophisticated cyber threats and validate the robustness of ICT systems.

In simple terms: Centralized exchanges need to test their IT security regularly through checks like vulnerability scans. If they’re considered “significant,” regulators can also require advanced penetration tests (TLPT) at least every three years to prove their systems can handle serious cyberattacks.

Source: DORA, Chapter IV – Digital operational resilience testing, Articles 24–27.

• Third-Party ICT Risk

Exchanges must actively manage their dependencies on third-party ICT providers, such as cloud services and payment infrastructure. Obligations include contractual safeguards, clear exit strategies, and measures to avoid excessive reliance on a single provider. For critical ICT providers, an EU-level oversight framework applies, giving supervisors direct powers to monitor and enforce resilience requirements.

In simple terms: Centralized exchanges need to carefully manage outside tech providers like cloud or payment services. They must have strong contracts, backup exit plans, and avoid depending too much on one provider. If a provider is deemed critical, EU regulators can directly oversee and enforce their resilience.

Source: DORA, Chapter V – Managing of ICT third-party risk, Articles 28–44

EU Anti-Money Laundering Package

EU anti-money laundering (AML) and counter-terrorist financing (CFT) rules apply directly to crypto-asset service providers (CASPs), including centralized exchanges. They require robust KYC, transaction monitoring, and reporting of suspicious activities. Failure to implement effective AML controls can result in severe fines, reputational damage, and suspension or withdrawal of authorisation to operate in the EU.

• Customer Due Diligence (CDD)

Centralized exchanges must perform robust CDD, including identity verification, beneficial ownership checks, understanding the purpose/nature of the relationship, and ongoing monitoring of transactions. In higher-risk cases, enhanced due diligence measures apply.

In simple terms: Centralized exchanges must verify who their customers are, check who really owns the accounts, and understand why they are using the service. They also need to keep monitoring activity, and if a client is higher risk, apply stricter checks.

Source: EU AML Package, Chapter III – Customer due diligence (Article 19–50)

• Transaction Monitoring and Reporting

CASPs must carry out ongoing monitoring of business relationships and transactions to detect unusual or suspicious activity. Where suspicion arises, they are obliged to report promptly to the Financial Intelligence Unit (FIU). They must also refrain from executing suspicious transactions until the FIU is notified, submit reports in the prescribed format, and ensure that no disclosure (“tipping-off”) is made to customers.

In simple terms: Centralized exchanges have to keep watching transactions for anything suspicious. If they spot unusual patterns, they must stop the transaction, report it quickly to the FIU, and never warn the customer about the report.

Source: EU AML Package, Chapter III – Customer due diligence (Article 26);
EU AML Package, Chapter V – Reporting obligations (Articles 69–73).

• Internal Controls and Compliance Programs

Exchanges (as CASPs) must establish internal AML/CFT policies and procedures, provide regular staff training, and ensure independent audit mechanisms. Senior management is responsible for approving and overseeing these controls and for ensuring effective compliance governance.

In simple terms: Centralized exchanges need to set up clear anti-money laundering rules, train their staff regularly, and have independent audits. Senior management must take responsibility for approving and supervising these measures to make sure compliance works in practice.

Source: EU AML Package, Chapter II – Internal policies, procedures and controls (Articles 9–18).

• Record Keeping

CASPs must retain customer due diligence data, transaction records, and AML documentation for at least five years, with the possibility of a further extension (up to an additional five years) where required by competent authorities. These rules ensure traceability for supervisory and investigative purposes.

In simple terms: Centralized exchanges must keep customer verification data, transaction history, and AML records for at least five years — and up to ten if regulators require it. This makes it easier for authorities to trace activity and run investigations.

Source: EU AML Package, Chapter VII – Data protection and record retention (Articles 76–78)

• Integration with Digital Operational Resilience

CASPs must integrate their AML/CFT obligations directly into operational and ICT systems. This requires governance and internal controls approved by management (Chapter II), ongoing monitoring of customer activity and transactions through reliable IT solutions (Chapter III), and secure retention of records to ensure availability for competent authorities (Chapter VII). Embedding AML compliance into core systems strengthens both regulatory conformity and resilience against operational and cyber risks.

In simple terms: Centralized exchanges need to build AML rules right into their day-to-day operations and IT systems. That means management-approved controls, tech that monitors customer activity, and secure record keeping — all working together to stay compliant and protect against risks.

Source: EU AML Package, Chapter VII – Data protection and record retention (Articles 76–78)

Implementation Differences Across EU Member States

MiCA and DORA apply uniformly across all EU member states, with baseline compliance deadlines set directly in the regulations: MiCA applies to CASPs from 30 December 2024, and DORA applies from 17 January 2025.

For CASPs already operating before MiCA takes effect, Article 143 MiCA establishes a transitional period of up to 18 months (until 1 July 2026). However, each member state may decide to shorten or remove this transitional period, meaning that deadlines for full MiCA compliance differ across the EU. For instance, Lithuania has limited the transitional period to 12 months (until 31 December 2025), while Estonia applies the full 18 months (until 1 July 2026).

This flexibility means that centralized exchanges must track country-specific deadlines in addition to EU-level requirements. Failure to align with national supervisory decisions could result in fines, operational restrictions, or loss of authorization.

Sources: MiCA, TITLE IX – TRANSITIONAL AND FINAL PROVISIONS, Article 143;
DORA, CHAPTER IX, Transitional and final provisions, Article 64;
ESMA Statement on MiCA transitional periods

From Regulation to Action: How CEXs Can Respond

The evolution of global crypto regulation, and the EU’s proactive approach in particular, reflects the growing need for standardized frameworks to safeguard consumers, maintain market integrity, and support sustainable innovation.

For centralized exchanges, this regulatory landscape translates into concrete obligations around authorization, operational resilience, and cybersecurity. Implementing bug bounty programs is a strategic measure that enables exchanges to proactively detect and remediate vulnerabilities, directly supporting compliance and risk mitigation. Notably, exchanges such as WhiteBIT, Coinmetro, and 80+ other CEXs leverage HackenProof to enhance system security and demonstrate readiness to regulators.

EU crypto regulations are constantly evolving, and staying compliant requires up-to-date expertise. Our consultants continuously monitor regulatory changes to help exchanges stay ahead. Feel free to schedule a call with us to discuss how we can support your compliance and security strategy

FAQ

What is MiCA crypto regulation?

MiCA crypto regulation is the EU’s new framework for supervising crypto-asset service providers (CASPs), including centralized exchanges. It sets rules on licensing, consumer protection, market integrity, and cybersecurity.

What does MiCA mean for CEXs?

Under MiCA, centralized exchanges must obtain authorization, follow strict governance standards, and comply with EU-wide crypto rules. Without a MiCA license, they cannot legally operate in the EU.

When does MiCA EU regulation apply?

MiCA applies across the EU from 30 December 2024. Existing providers may continue under national rules until 1 July 2026, unless their country shortens this transition.

How does MiCA regulation interact with other EU crypto laws?

MiCA works alongside DORA (on digital operational resilience) and the EU AML regulation. Together, they create a unified crypto EU regulatory framework covering licensing, cybersecurity, and anti–money laundering.

Does MiCA cover all cryptocurrency regulation in the EU?

Not fully. MiCA focuses on crypto-assets and CASPs. Other areas, such as anti-money laundering, are covered by the AML package, and ICT risk is covered by DORA. Together, these form a broad cryptocurrency regulation framework in the EU.

What is DORA in EU crypto regulation?

DORA (Digital Operational Resilience Act) is another key part of EU crypto regulation. It focuses on ICT risk, requiring exchanges and financial entities to build strong cybersecurity, manage third-party risks, and ensure operational resilience.

When does DORA apply to crypto exchanges?

DORA applies from 17 January 2025. From that date, centralized exchanges must meet EU-wide standards for ICT systems, resilience testing, and incident reporting.