Raising the bar: Assessing historical cryptocurrency exchange practices in light of the EU’s MiCA and DORA regulation
Marilyne Ordekian, Ingolf Becker, Tyler Moore, Marie Vasek · Computer law & security review · 2025
Centralized cryptocurrency exchanges have quickly become internal components of the digital finance ecosystem, mirroring traditional institutions by offering custody, investments, and transactional services. Despite their increasing prominence, the regulatory oversight has historically been fragmented and inadequate, leaving them largely relying on self-regulation. The resulting environment has been marked by exchange collapses, connections to criminal activities, cyber attacks, and poor operational security. High-profile failures, such as Mt. Gox and FTX, highlight the systemic risks and failure of internal governance models to properly mitigate or protect user funds from cascading risks or security breaches. In response, the European Union introduced the Markets in Crypto-Assets (MiCA) regulation and the Digital Operational Resilience Act (DORA), intending to standardize regulatory oversight and enhance user protection. This paper presents the first comprehensive interdisciplinary analysis of centralized exchanges under the MiCA and DORA frameworks. Drawing on methods from both law and computer science, we systematically translate regulatory requirements into measurable compliance standards, and develop a novel doctrinal and empirical methodology to evaluate current self-regulatory practices of 75 centralized exchanges operating in Europe. Through a detailed analysis of 143 exchange legal documents, we identify major compliance gaps and regulatory uncertainties. Our findings indicate significant shortcomings in exchange practices relating to asset custody, cybersecurity, and liability. This suggests that serious efforts are needed to change these practices and ensure their alignment with regulatory requirements. Our framework enables a systemic comparison between regulation and practice, and establishes a baseline for evaluating the effectiveness of regulatory measures. This approach can be replicated to study other self-regulating emerging sectors. • We conduct a doctrinal analysis on recent EU regulations, the Markets in Crypto-Assets Regulation (MiCA) and Digital Operational Resilience Act (DORA). We identify requirements for centralized cryptocurrency exchanges and systematically extract them and create a standard framework comprising 53 criteria. • We conduct the first comprehensive empirical study of self-regulation practices among all 75 fiat-dealing exchanges in Europe, analyzing 143 documents, including terms and conditions (T&Cs) and security policies. We compile a dataset of 371 hand-coded variables across 14 themes describing exchange practices. • We use the extracted legal standards to evaluate exchange practices, assessing their compliance posture with recent regulations. This study provides a baseline to gauge the effectiveness of MiCA/DORA in the long term and track changes compared to the pre-regulation era. Additionally, it provides a tool to understand the areas currently lacking or that need more attention in industry practices. • We show that many exchanges face challenges in effectively self-regulating, fulfill their custodial duties, maintaining robust security measures, and (may) use T&Cs to shift liability. By documenting these practices and shortcomings, we provide regulators and the industry actionable and tailored recommendations for improvements. We also provide a replicable methodology to investigate the self-regulation and governance of service providers in other emerging self-regulating technologies. • An earlier draft of this research was communicated with the EU’s European Securities and Markets Authority (ESMA) and European Banking Authority (EBA) in a closed meeting. We were recommended to expand the scope of the study to include DORA provisions in addition to MiCa. It was also suggested that this study could act as the ground truth baseline for pre-MiCA industry practices. A final version has been requested by said authorities. Additionally, findings from this paper have been submitted as evidence for consultation calls in the, UK. For intance, the FCA and HM Treasury. One of the authors recently presented the high-level implications of this study in an invited and closed conference organized by the FCA.