DORA for crypto finance teams: how to assess your accounting provider

What DORA covers, and what it does not

DORA applies from January 17, 2025. Its main areas include ICT risk, incident management, resilience testing and ICT third-party risk. Financial entities need to assess the applicable scope of their activities and supplier relationships.

Do not assume every company that holds crypto has the same obligations. Your legal and risk teams determine applicability and service importance. This article proposes supplier evaluation questions; it is not a determination that your entity or Conta has a particular regulatory status.

Start with the function your provider supports

Describe where Conta sits in your process. Does the team use it for daily review, month-end reporting or investigations? Which accounts and outputs depend on it? Which accounting tasks could continue during an interruption? These answers make the evaluation specific to your company.

Then assign an internal owner. The supplier can explain its service, but your team must decide how an interruption affects the close, who handles it and when a workaround is acceptable. A shared spreadsheet should not become the fallback without a decision on its accuracy and access.

Controls you can examine in Conta Finance

Conta provides an isolated database and deployment for each client. Exchange connections use encrypted, read-only credentials. The application does not custody funds or authorize withdrawals. Organization and team permissions define who can view, review, change or administer records.

Sign-in supports Google, Microsoft and a one-time email code, with TOTP as a second factor. These controls help you assess the access model. They do not, by themselves, establish that your whole operational risk framework meets DORA.

Read the security and certification overview ↗

Five evidence requests for supplier due diligence

Use this as a practical interview checklist, not a claim that every item is already included in a standard contract. The required depth depends on the function and your risk assessment. Ask for a written response where the answer affects your continuity plan.

• Scope: which systems, locations and services are covered by the security evidence?
• Recovery: which backup and restore tests support the stated recovery objectives?
• Incidents: who contacts your team, through which channel and under which agreed terms?
• Dependencies: which subcontractors support the service, and how are changes communicated?
• Exit: which records can be exported, in which format and with what supporting context?

ISO 27001 and SOC 2 Type II are evidence, not a DORA label

Conta’s security page describes ISO 27001 certification and a SOC 2 Type II report. Request the documents and their scope. Check the entity, service, validity or review period and any exceptions relevant to your process. Do not infer those details from the public badges.

A security certification and an assurance report answer specific questions about controls. They do not replace your assessment of the service, contractual terms or the responsibilities of your own staff. Avoid adding a “DORA certified” claim to a procurement file without a valid basis.

Test a finance scenario, not only a technical uptime figure

A useful exercise is an interruption during the close. Determine which approved export the team would use, how it would identify the export’s cutoff and how activity after that cutoff would be reviewed. Define the person who can authorize an exceptional process.

Also test an employee leaving the team. Review organization access and external AI connections. Record the removal procedure and verify the remaining users can still complete the close. These are suggested exercises, not a description of completed customer tests.