EU's Cyber Resilience Act Takes Effect, Crypto Wallet Providers Face Fines Up to $17.3 Million for Violations

The EU's Cyber Resilience Act (CRA) Article 14 officially applies from September 11, requiring manufacturers of crypto hardware and software wallets to submit early warnings within 24 hours of becoming aware of product vulnerabilities or serious security incidents, and to provide complete notifications within 72 hours. Additionally, they must submit final reports within 14 days after remediation measures are available or within one month after notifying of serious incidents. This requirement applies to all products with digital elements sold in the EU market. Companies that fail to comply with Articles 13 and 14 may face administrative fines of up to €15 million (approximately $17.3 million) or 2.5% of their global annual turnover, whichever is higher; submitting false, incomplete, or misleading information could result in fines of up to €5 million. The Cyber Resilience Act was passed in October 2024, with the main obligations set to fully apply by December 11, 2027, while Article 14 serves as an exception that takes effect earlier.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.