Do the DORA Regulation and the Guidelines on outsourcing arrangements apply to VASPs in Poland?

The entry into force of the Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (hereinafter: ‘DORA’) implies an obligation for its recipients to adapt, first and foremost, to the requirements for outsourcing services of an ICT nature. At the same time, the provisions of the EBA Guidelines on outsourcing arrangements (hereinafter: “Guidelines on outsourcing”), i.e. soft law regulations, are addressed to financial institutions in this regard. From the point of view of the crypto sector, a number of questions of a practical nature arise against the background of these rules.

In Poland, one of the fundamental questions is: Do DORA and the Guidelines on outsourcing apply to VASPs (virtual asset service providers), i.e. entities required to obtain registration in the register of virtual currency activities in Poland. 

To answer this question, it should first be pointed out that DORA is addressed to financial entities. In turn, Article 2(1)(f) of the DORA indicates that the DORA applies, among others, to crypto-asset service providers authorised under the MiCA Regulation, and thus to entities with the status of CASPs. Thus, as VASPs in the current state of the law are not yet licensed CASPs in the sense of the MiCA Regulation, the DORA will not apply to them until they obtain such a licence.

The situation of VASPs is similar in the context of the aforementioned Guidelines on outsourcing. Namely, Guidelines on outsourcing are addressed to entities that are financial institutions, such as credit institutions, investment firms or payment institutions. These entities operate in financial market sectors hitherto regulated by the EU legislator. 

Thus, in both cases, it should be concluded that entities with VASP status in Poland will only become addressees of the obligations set out in the two sources in question when they obtain a CASP licence under the MiCA Regulation, i.e. when they simultaneously become a fully-fledged financial entities.