Best RPC providers for MiCA and DORA compliance (2026)

MiCA became fully applicable on December 30, 2024, and DORA went live on January 17, 2025. For every crypto-asset service provider (CASP), asset-referenced token (ART) issuer, and e-money token (EMT) issuer operating in the EU, compliance is no longer a future roadmap item — it is a present operational requirement. The infrastructure stack supporting your on-chain operations, including the RPC providers your systems call thousands of times per second, now sits directly within the scope of EU financial regulation.

What most engineering teams miss is that DORA does not distinguish between “traditional” ICT providers and blockchain node operators. Under DORA’s third-party ICT framework (Articles 28–44), any provider of critical digital services — including the RPC endpoints your settlement engine, monitoring systems, and compliance pipelines rely on — must meet contractual SLA requirements, be subject to audit rights, and satisfy concentration risk controls. Choosing the wrong RPC provider is not just a reliability decision anymore. It is a compliance decision with direct regulatory consequences.

This guide covers the six most relevant RPC providers for regulated EU entities operating across Ethereum, Arbitrum, Base, BNB, and Polygon. It addresses the specific DORA and MiCA requirements your infrastructure team needs to satisfy, the RPC methods that power compliance workloads, and how each provider stacks up for production-grade regulated operations.

Quick verdict: best RPC providers for MiCA and DORA compliance in 2026

Chainstack is our top pick for regulated EU multi-chain infrastructure, as an editorial judgment based on its published SOC 2 Type II and ISO 27001 certifications, an Enterprise plan with a contractual SLA and audit rights, Dedicated Nodes and flat 1 RU / 2 RU pricing. Chainstack publishes this page and is one of the 6 listed providers, so see how we compared and the benchmark limits before relying on the ranking. Last updated October 29, 2026. This article summarizes regulatory requirements as the page describes them and is not legal advice. The best fit by need:

• Best for a single-vendor enterprise agreement with dedicated isolation: Chainstack (Enterprise plan with contractual SLA and audit rights, Dedicated Nodes).
• Best for ISO 27001 alongside SOC 2 with dedicated clusters, as primary or failover: Quicknode (SOC 1 Type II, SOC 2 Type II and ISO 27001, contractual Enterprise uptime SLA, figure not verified).
• Best for development and pre-production with a large free tier: Alchemy (30M CU/month free, Enhanced APIs; no standard dedicated nodes).
• Best for Ethereum-centric teams that do not need DORA-critical contract terms: Infura (long operating history; no published SOC 2 or ISO 27001).
• Best for the largest free-credit allowance and archive on all tiers: Ankr (200M credits/month; no published SLA; SOC 2 Type II held by its infrastructure operator, no ISO 27001).
• Best for development, testing and broad chain coverage: dRPC (100+ chains, free public endpoints; no SOC 2 found; free public nodes carry no SLA, paid plans list 99.96% uptime).
• Best for DORA concentration-risk mitigation: Chainstack as primary with Quicknode as failover, both documented in your ICT third-party risk register.

Provider comparison: 6 RPC providers for MiCA and DORA compliance (2026)

The table below summarises public positioning as of May 2026; the figures were not re-verified on October 29, 2026. The rank is the editorial order used in this article (see how we compared), not a benchmark result.

Rank	Provider	Best for	Pricing model	Free tier	Dedicated nodes	SOC 2 / compliance cert	Contractual SLA
1	Chainstack	Single-vendor enterprise agreement, dedicated isolation	RU-based, 1 RU/call (no multipliers)	3M RU/month, 25 RPS	Yes ($0.50/hr compute)	SOC 2 Type II (Dec 2025) and ISO 27001 (Jul 2026)	Yes (Enterprise plan)
2	Quicknode	ISO 27001 plus dedicated clusters, primary or failover	Credit-based (method-weighted)	30-day trial only	Yes (dedicated clusters)	SOC 2 Type II + ISO 27001	Yes (Enterprise)
3	Alchemy	Development, pre-production, Enhanced APIs	CU-based (method-weighted; stated planning average 27 CU per request)	30M CU/month	No standard option	SOC 2 Type II listed on Trust Center; no ISO 27001 listed	Not publicly documented
4	Infura	Ethereum-centric, non-critical workloads	Credit-based	3M credits per day	No	Not published	Not publicly documented
5	Ankr	Large free tier, archive on all tiers	API credit-based	200M credits/month	No	SOC 2 Type II (infrastructure operator; report under NDA); no ISO 27001	Not publicly documented
6	dRPC	Development, testing, broad chain coverage	Per-1M requests (paid); public free	Free public endpoints	No	Not found	Enterprise only (committed SLAs)

How we compared RPC providers for MiCA and DORA compliance

Disclosure: this comparison is published by Chainstack. Chainstack is one of the 6 listed providers and is ranked first, so read the ranking as a vendor perspective and check the figures against the official pricing pages linked in each provider section.

Criteria. Each provider is compared on the same five criteria: published compliance certifications (SOC 2 Type II, ISO 27001), contractual SLA and audit rights, dedicated or isolated infrastructure, multi-chain coverage, and pricing transparency. The evaluation criteria table lists what was checked and which facts on this page support each criterion for every provider. The order is editorial judgment for regulated EU multi-chain use, weighted towards certifications, contract terms and isolation. It is not a benchmark result: the latency data covers 4 of the 6 listed providers (Chainstack, Quicknode, Alchemy and dRPC) on Ethereum and Arbitrum only, and does not determine the order.

Sources. Prices, limits and certifications come from each provider’s public pricing, documentation and security pages, as summarized on this page as of May 2026 unless a section says otherwise. Latency figures come from the Chainstack Labs Research Team’s October 2026 Ethereum report and a Chainstack Compare snapshot for Arbitrum (see the benchmark section). Chainstack’s platform uptime is shown as 99.99%+ platform uptime (status.chainstack.com, Ethereum, Arbitrum One, Base, BNB Smart Chain and Polygon Mainnet components, each 99.99%+ over the 90 days to October 29, 2026). That figure is platform uptime from the status page, which covers the Mainnet component of each chain (testnet and devnet components are tracked separately) and Chainstack only; it is separate from the benchmark’s probe success rate and from contractual SLAs, and it is not a guarantee. SLA figures quoted for other providers are as stated by the provider.

Regulatory statements. The dates, article references, incident-reporting timelines and supervisory interpretations in the MiCA and DORA sections describe the page’s reading as of May 2026. They were not re-verified against the primary texts (Regulation (EU) 2023/1114 on MiCA and Regulation (EU) 2022/2554 on DORA) on October 29, 2026. This article is not legal advice; confirm requirements with your legal and compliance advisers.

Not covered. Other RPC providers may also support Ethereum, Arbitrum, Base, BNB Smart Chain and Polygon. They are not part of this comparison.

Latency data. See the latency benchmark section for the figures, the method and what the benchmark does not show. For your own workload, measure from the region where your application runs; see how to measure RPC latency (P50, P95, P99).

💡 Already using Chainstack? Jump straight to the enterprise infrastructure page or deploy your endpoint in minutes.

MiCA and DORA on multi-chain infrastructure: what the regulations require, as summarized here

The DORA third-party framework for RPC providers

DORA Article 28 requires financial entities to maintain a comprehensive register of all ICT third-party service providers and to apply a risk-based classification. Providers supporting “critical or important functions” — which includes any RPC infrastructure underpinning settlement, custody, or compliance monitoring — must meet a higher bar.

Article 30 mandates specific contractual provisions for these critical providers. Your contract must include: a full description of services with quantified service levels (SLAs), data processing locations and the data residency obligations that flow from them, guaranteed audit rights for both your compliance team and your competent authority, provisions on availability, integrity, and confidentiality of data, and termination rights with an adequate transition period to avoid lock-in. Self-service SaaS terms on a checkout page do not satisfy Article 30. You need a real enterprise agreement.

DORA also addresses concentration risk (Article 29): regulators expect financial entities to monitor and manage exposure to individual ICT providers. If your entire multi-chain monitoring stack runs through a single RPC vendor with no secondary provider, that is a concentration risk that must be documented and mitigated. The practical implication: your architecture should support at least two independent RPC providers with automatic failover, and your vendor management documentation should reflect this.

MiCA operational resilience requirements

MiCA Title III (for ART issuers) and Title IV (for EMT issuers and CASPs) impose operational resilience obligations that directly translate to infrastructure requirements. CASPs must have business continuity plans covering ICT disruptions, incident classification and reporting procedures (with initial reports to national competent authorities within 4 hours for major incidents), and recovery time objectives for critical functions.

For stablecoin infrastructure specifically, MiCA Article 35 requires issuers to maintain “resilient and secure ICT systems and tools” with appropriate business continuity measures. ESMA’s technical standards interpret this as requiring at minimum: documented SLAs from critical providers, geographic redundancy, and the ability to switch providers without service interruption. If your EMT’s reserve monitoring, redemption processing, or transaction validation pipeline depends on a single shared RPC endpoint with no contractual backing, you have a compliance gap.

RPC methods that power compliance workloads

Eight EVM methods anchor most regulated cross-chain operations. Understanding what each does — and what infrastructure it requires — is prerequisite to choosing the right provider.

• eth_getLogs is the workhorse of compliance event ingestion. It queries historical and recent event logs by contract address, topic, and block range. Every USDC/USDT transfer event, every DEX swap, every governance vote your compliance engine needs to audit flows through this method. It does not require archive node access for recent blocks — a full node suffices for current and recent data. High-volume compliance pipelines typically call this method at 50–200 RPS across multiple chains simultaneously.
• eth_getTransactionByHash retrieves complete transaction data including calldata. It is used for transaction verification and building audit trails. For compliance reporting, you need to be able to reconstruct the full transaction record — this method is the primary mechanism.
• eth_getTransactionReceipt returns the post-execution transaction receipt including status (success/failure), gas consumed, and emitted logs. It is essential for settlement confirmation: you cannot mark a payment as settled until you have a receipt with status: 1. Batching receipt lookups is common in high-throughput settlement pipelines.
• eth_call executes a contract read at the current or a specified block. For compliance, this means querying token balances, allowances, reserve ratios, and smart contract state at any point in time. Calling at a historical blockNumber requires archive access; calling at "latest" does not.
• eth_getBlockByNumber retrieves full block data including all transaction hashes or full transaction objects. Compliance pipelines that reconstruct the full transaction set for a given block period — for example, to produce daily settlement reports — rely heavily on this method. It is also used to verify block finality timestamps.
• eth_subscribe (via WebSocket) provides real-time event streaming for logs and newHeads topics. For live compliance monitoring — catching a suspicious transfer event within seconds of it being mined — a persistent WebSocket subscription is far more efficient than polling. Providers that drop WebSocket connections under load, or that rate-limit subscription events, are unsuitable for real-time compliance applications.
• debug_traceTransaction produces a full execution trace of a transaction, including internal calls and state changes. This is the primary tool for forensic analysis: understanding why a transaction reverted, tracing the flow of funds through a multi-hop DeFi operation, or producing evidence for a regulatory inquiry. It requires archive node access and is computationally expensive — latency of 500ms–2s is normal.
• trace_block returns execution traces for all transactions in a block simultaneously. It is used for batch forensic analysis and for compliance reporting workflows that must reconstruct complete block-level activity. Like debug_traceTransaction, it requires an archive node with trace support (Erigon or equivalently configured nodes).

For a full reference of these methods across all supported EVM chains, see the Chainstack blockchain API reference.

Infrastructure requirements for regulated operations

Beyond individual method support, regulated operations impose infrastructure requirements that go beyond what consumer and developer-tier RPC services provide.

Uptime SLA: MiCA and DORA operational resilience standards imply near-continuous availability. A 99.9% uptime SLA means roughly 8.7 hours of acceptable downtime per year — inadequate for a settlement engine processing redemptions. Production compliance infrastructure should target providers with a contractual 99.99% SLA (≤52 minutes downtime per year).

Geographic redundancy: DORA’s resilience requirements effectively mandate multi-region deployment. Your RPC provider must serve requests from geographically distributed nodes so that a single data center failure does not cause a service outage. Geo-balanced load balancing across at least three independent regions is the minimum adequate configuration.

Dedicated vs shared infrastructure: Shared RPC endpoints pool your traffic with thousands of other users. A traffic spike from a popular NFT mint or mempool storm can saturate shared capacity and cause latency spikes or rate limit enforcement precisely when your compliance pipeline is under the highest load. For critical-function infrastructure under DORA, dedicated nodes — where your capacity is isolated from other users — are the architecturally correct choice.

Data residency: Some EU jurisdictions impose data residency requirements under national law or GDPR Article 44. If your node provider routes traffic through non-EU data centers without adequate safeguards, you may have a compliance exposure. Enterprise agreements with providers that support EU-only node deployment address this.

Audit rights and documentation: DORA Article 30(2)(j) requires that you have the contractual right to audit ICT providers. This right must be exercised periodically and documented in your ICT third-party risk register. Providers with SOC 2 Type II and ISO 27001 certifications give you an independently audited baseline; providers without published certifications require you to conduct or commission your own audit, which is operationally expensive and often impractical with smaller vendors.

Chainstack for MiCA and DORA compliance

In our assessment, Chainstack is a strong option for regulated EU entities building multi-chain infrastructure (Chainstack publishes this page; see how we compared). It combines published SOC 2 Type II and ISO 27001 certifications, contractual enterprise SLAs, Dedicated Nodes, and Global Nodes with geo-balanced routing across three regions. Quicknode lists a comparable set (certifications, enterprise SLA, dedicated clusters). Whether any provider’s contract satisfies DORA Article 30 depends on the agreement you negotiate, so use this page as a starting point for due diligence.

Chainstack holds SOC 2 Type II (December 2025) and ISO 27001 (announced July 2026) certifications. SOC 2 Type II is an independent audit by a registered AICPA firm covering a multi-month period of operational controls, and ISO 27001 certifies an information security management system; neither is a self-attestation. For DORA vendor due diligence, SOC 2 Type II and ISO 27001 evidence is a common due-diligence package; Chainstack can provide it.

For compliance-critical applications, Dedicated Nodes on Chainstack provide fully isolated compute: your node is not shared with any other customer. This eliminates the noisy-neighbour problem that plagues shared endpoints and ensures that your throughput commitments are honoured even during peak network conditions. Dedicated Nodes are available for Ethereum, Arbitrum, Base, BNB, Polygon, and 60+ other chains. Compute is priced at $0.50/hour per node, with storage at $0.01 per 20 GB/hour — transparent, predictable, and suitable for budgeting in a regulated environment.

Global Nodes provide geo-balanced shared RPC access across Chainstack’s three deployment regions (US, EU, Asia-Pacific). For workloads that don’t require dedicated isolation, Global Nodes route automatically to the healthiest available node; measured latency data is in the benchmark section. Chainstack states that its platform processes over 10 billion API calls per day. Chainstack’s platform uptime is 99.99%+ platform uptime (status.chainstack.com, Ethereum, Arbitrum One, Base, BNB Smart Chain and Polygon Mainnet components, each 99.99%+ over the 90 days to October 29, 2026); this is not an SLA.

Chainstack’s pricing is straightforward: 1 Request Unit (RU) per full-node call, 2 RUs per archive call, no per-method multipliers. The Growth plan ($49/month) includes 20M RUs at 250 RPS; the Business plan ($499/month) includes 200M RUs at 600 RPS. Enterprise agreements from $990/month offer 400M+ RUs, unlimited RPS, and the contractual SLA and audit rights provisions required under DORA. For high-throughput compliance pipelines that generate predictable volume, the Unlimited Node add-on (from $149/month for 25 RPS flat-fee) eliminates per-request billing entirely.

Multi-chain coverage spans all the major regulated chains: Ethereum mainnet and Sepolia testnet, Arbitrum One, Base, BNB Smart Chain, Polygon PoS, and 60+ additional networks — all accessible from a single dashboard, single API key format, and single invoice.

The fintech infrastructure page and stablecoin infrastructure page document specific use case configurations for payment processors and stablecoin issuers.

Code example: multi-chain eth_getLogs for USDC compliance event ingestion

The following Python snippet demonstrates parallel event log ingestion across Ethereum, Arbitrum, and Base — a common pattern for CASP compliance pipelines monitoring USDC transfers.

import asyncio
from web3 import AsyncWeb3, WebSocketProvider
from web3.middleware import ExtraDataToPOAMiddleware

# USDC contract addresses per chain
USDC_ADDRESSES = {
    "ethereum": "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48",
    "arbitrum": "0xFF970A61A04b1cA14834A43f5dE4533eBDDB5CC8",
    "base":     "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
}

# Transfer(address,address,uint256) topic
TRANSFER_TOPIC = "0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef"

ENDPOINTS = {
    "ethereum": "YOUR_CHAINSTACK_ETH_ENDPOINT",
    "arbitrum": "YOUR_CHAINSTACK_ARB_ENDPOINT",
    "base":     "YOUR_CHAINSTACK_BASE_ENDPOINT",
}

async def ingest_logs(chain: str, endpoint: str):
    w3 = AsyncWeb3(AsyncWeb3.AsyncHTTPProvider(endpoint))
    if chain in ("arbitrum", "base"):
        w3.middleware_onion.inject(ExtraDataToPOAMiddleware, layer=0)

    latest = await w3.eth.block_number
    from_block = latest - 1000  # last ~1000 blocks

    logs = await w3.eth.get_logs({
        "fromBlock": hex(from_block),
        "toBlock": "latest",
        "address": USDC_ADDRESSES[chain],
        "topics": [TRANSFER_TOPIC],
    })

    print(f"[{chain}] Found {len(logs)} USDC transfer events")
    for log in logs[:3]:
        print(f"  tx={log['transactionHash'].hex()} block={log['blockNumber']}")

async def main():
    await asyncio.gather(*[
        ingest_logs(chain, ep)
        for chain, ep in ENDPOINTS.items()
    ])

if __name__ == "__main__":
    asyncio.run(main())

Replace the endpoint placeholders with your Chainstack endpoints from the console. For a full guide on deploying nodes and the complete Web3.py API surface, see the Chainstack protocols and tutorials index.

RPC rate limits and free tiers compared

Rate limits and billing units differ between providers, so the same number of calls can cost different amounts. This table uses only the figures given elsewhere on this page; “Not stated here” means this article gives no figure.

Provider	Free tier	Paid or flat-rate throughput	Billing unit
Chainstack	Developer plan: 3M RU/month, 25 RPS, no credit card	Growth $49/month: 20M RU, 250 RPS. Business $499/month: 200M RU, 600 RPS. Enterprise from $990/month: 400M+ RU, unlimited RPS. Unlimited Node add-on from $149/month for 25 RPS flat fee. Dedicated Nodes: $0.50/hour compute, $0.01 per 20 GB/hour storage	Request Units: 1 RU per full-node call, 2 RU per archive call, no method multipliers
Quicknode	30-day trial only (limits not stated here)	Dedicated Clusters; contractual uptime SLA on Enterprise (figure not verified)	Credits, method-weighted
Alchemy	30M CU/month (roughly 1.1M requests at Alchemy’s stated 27 CU planning average)	No standard dedicated node option; enterprise terms not publicly documented	Compute units, method-weighted (stated planning average 27 CU per request)
Infura	3M credits per day (Free plan)	No dedicated node option; enterprise terms not publicly documented	Credits
Ankr	200M credits/month	No standard dedicated nodes; debug and trace namespaces on the Premium tier	API credits (archive data on all tiers)
dRPC	Free public endpoints	Per-1M requests on paid tiers	Per request (per-1M)

Chainstack alternatives for MiCA and DORA RPC

If Chainstack is not the right fit, these are the head-to-head differences between Chainstack and each alternative, using the facts on this page:

• Chainstack vs Quicknode: Quicknode lists SOC 1 Type II, SOC 2 Type II and ISO 27001 (reports on request), dedicated clusters, a contractual uptime SLA on Enterprise (figure not verified) and 83+ chains, but uses method-weighted credits and offers only a 30-day trial; Chainstack publishes flat 1 RU / 2 RU pricing and a permanent free tier (3M RU/month). In the October 2026 Ethereum report Quicknode was faster than Chainstack in the US (98 ms against 143 ms P95) and Germany (40 ms against 47 ms), and in the Arbitrum snapshot Quicknode had the higher probe success rate (99.98% against 99.25%).
• Chainstack vs Alchemy: Alchemy lists a SOC 2 Type II report (no ISO 27001 on its Trust Center as of October 29, 2026), a 30M CU/month free tier and Enhanced APIs, but has no standard dedicated nodes, no publicly documented contractual SLA and, per its docs, an Arbitrum Trace API (arbtrace_*) whose per-method support is not verified here. Alchemy had the faster US P95 on Ethereum (80 ms against 143 ms) and the highest probe success rate in the Arbitrum snapshot (100.00% against 99.25%).
• Chainstack vs Infura: Infura has a long operating history on Ethereum, but publishes no SOC 2 Type II or ISO 27001, no public contractual SLA and no dedicated node option, and its free tier is 3M credits per day; Chainstack lists SOC 2 Type II and ISO 27001 and offers Dedicated Nodes. Infura was not measured in the benchmark data cited here.
• Chainstack vs Ankr: Ankr offers 200M free credits per month and archive data on all tiers across a distributed operator network, but has no standard dedicated nodes, no published contractual SLA and a SOC 2 Type II attestation held by its infrastructure operator (report under NDA, no ISO 27001); Chainstack offers Dedicated Nodes and an Enterprise plan with a contractual SLA. Ankr was not measured in the benchmark data cited here.
• Chainstack vs dRPC: dRPC covers 100+ chains with free public endpoints and per-request pricing, but no SOC 2 certification was found, free public nodes carry no SLA (paid plans list 99.96% uptime, Enterprise lists committed SLAs); Chainstack lists both certifications and an Enterprise plan. dRPC was measured and was slower: 641 ms against 78 ms overall P95 on Ethereum (October 2026 report) and 135 ms against 34 ms on Arbitrum (October 29, 2026 snapshot).

In-depth reviews: 6 RPC providers for MiCA and DORA compliance (2026)

1. Chainstack: best for a single-vendor enterprise agreement with dedicated isolation

Verdict: SOC 2 Type II and ISO 27001, an Enterprise plan with contractual SLA and audit rights, Dedicated Nodes and flat 1 RU / 2 RU pricing across Ethereum, Arbitrum, Base, BNB, Polygon and 60+ chains. Trade-off: DORA-oriented contract terms require the Enterprise plan (from $990/month), the free tier (3M RU/month) suits testing only, and its probe success rate (99.25%) was the lowest of the four providers measured in the October 29, 2026 Arbitrum snapshot. Official pricing.

Chainstack is built for regulated multi-chain infrastructure. Its SOC 2 Type II and ISO 27001 certifications, enterprise agreement framework, and Dedicated Nodes product line collectively cover the DORA Article 30 elements described above: documented SLA, audit evidence, contractual data processing provisions, and isolation of critical-function infrastructure. Quicknode lists a comparable set; Alchemy, Infura, Ankr and dRPC document fewer of them publicly.

The platform covers Ethereum, Arbitrum, Base, BNB, Polygon, and 60+ additional chains from a single endpoint management interface. Archive data access is available on all paid plans (2 RU per archive call). The debug_ and trace_ namespaces are supported on dedicated archive nodes. Global Nodes provide geo-balanced shared access across US, EU, and APAC regions; Dedicated Nodes provide per-customer isolated infrastructure with Bolt fast-sync for rapid provisioning. For flat-fee high-volume pipelines, the Unlimited Node add-on (from $149/month for 25 RPS) eliminates per-request costs entirely.

In our assessment, Chainstack’s pricing is the simplest to model in this comparison: 1 RU per standard call, 2 RUs per archive call, no method multipliers. The Growth plan at $49/month (20M RU/250 RPS) covers most mid-size compliance workloads. The Enterprise plan (from $990/month, 400M+ RU, unlimited RPS) includes contractual SLA provisions, dedicated account management, and the audit-rights framework needed for DORA compliance documentation. For context, stablecoin infrastructure and fintech blockchain infrastructure configurations are documented on separate use case pages.

Limitations: The free developer tier (3M RU/month) is adequate for testing but not for production compliance pipelines. DORA-compliant contractual terms require the Enterprise plan — Growth and Pro plans include standard commercial terms only.

Fit by workload:

• Regulated DeFi / stablecoin infrastructure: Excellent — SOC 2 Type II and ISO 27001, dedicated isolation, contractual SLA on the Enterprise plan, archive access, full EVM method coverage
• Cross-chain audit and reporting: Excellent — multi-chain from single account, consistent RU pricing, eth_getLogs and trace_ support across all major EVM chains
• Enterprise CASP operations: Excellent — enterprise agreement, DORA-compatible contractual framework, audit rights, dedicated account support

2. Quicknode: best for ISO 27001 with dedicated clusters, as primary or failover

Verdict: SOC 1 Type II, SOC 2 Type II and ISO 27001, a contractual uptime SLA on Enterprise (figure not verified) and Dedicated Clusters across 83+ chains. Trade-off: method-weighted credits make trace-heavy budgets harder to model, and the entry offer is a 30-day trial rather than a permanent free tier. Official pricing.

Quicknode lists SOC 1 Type II, SOC 2 Type II, and ISO 27001, with reports available on request through an account representative, the broadest certification list of the six providers on this page. For regulated institutions that require ISO 27001 alongside SOC 2, Quicknode is, in our assessment, the closest alternative to Chainstack on the facts here, although Alchemy lists SOC 2 Type II but no ISO 27001.

Quicknode supports 83+ chains across 140+ networks, covers all major EVM chains relevant to EU regulated operations, and routes traffic across 14+ global regions. The uptime SLA is contractual on the Enterprise plan; the SLA percentage is not verified. Dedicated Clusters provide fully isolated infrastructure for high-throughput applications. Quicknode’s credit-based pricing applies method-specific weightings — a debug_traceTransaction call costs significantly more credits than a simple eth_blockNumber — which can make budget planning less predictable for compliance pipelines that rely heavily on expensive trace methods.

The 30-day trial replaces a permanent free tier, which means teams cannot run a persistent low-cost monitoring environment without entering a paid plan. For a regulated entity building out its infrastructure stack, this is a minor but real friction point.

Limitations: Credit-based pricing with method multipliers makes cost modelling for trace-heavy compliance workloads more complex than flat RU pricing. No permanent free tier.

Fit by workload:

• Regulated DeFi / stablecoin infrastructure: Excellent — SOC 2 Type II + ISO 27001, contractual SLA, dedicated clusters, archive and trace support
• Cross-chain audit and reporting: Strong — broad chain coverage, archive access, trace methods supported
• Enterprise CASP operations: Strong — ISO 27001 makes Quicknode competitive for institutions with ISO-aligned procurement requirements

3. Alchemy: best for development and pre-production with a large free tier

Verdict: SOC 2 Type II listed (no ISO 27001 on its Trust Center), 30M CU/month free tier and Enhanced APIs. Trade-off: no standard dedicated nodes, no published contractual SLA, Arbitrum trace support not verified here and method-weighted CU pricing. Official pricing.

Alchemy’s Trust Center lists a SOC 2 Type II report (held by Alchemy Insights, Inc., available on request) and no ISO 27001 as of October 29, 2026. Alchemy also offers a generous free tier of 30M Compute Units per month, which translates to roughly 1.1M requests at Alchemy’s stated planning average of 27 CU per request. Its Enhanced APIs — including NFT, Token, and Transfers endpoints — provide higher-level abstractions useful for compliance pipelines that aggregate multi-chain transfer data. Supernode, Alchemy’s distributed infrastructure layer, claims 99.9% uptime and automatic failover across multiple node sources.

For compliance use cases, the key limitation is the absence of standard dedicated nodes. Alchemy’s infrastructure is fully shared; there is no product offering equivalent to Chainstack’s Dedicated Nodes or Quicknode’s Dedicated Clusters. For regulated entities with DORA-mandated isolation requirements, this is a structural gap. Additionally, Alchemy does not publish contractual SLA terms outside of enterprise agreements, and its enterprise agreement pricing and terms are not publicly documented. Teams that need DORA Article 30-compliant contracts should verify contractual availability with Alchemy’s enterprise sales team before building dependencies.

Alchemy’s CU pricing with method multipliers (Alchemy’s stated planning average is 27 CU per request across the method mix) can result in effective per-call costs materially higher than Chainstack’s flat 1 RU pricing for trace-heavy workloads. Alchemy’s docs list an Arbitrum Trace API (arbtrace_*), and Debug and Trace APIs are gated to paid plans; which methods work on Arbitrum was not verified here, so check this before relying on it for audit workloads that span Arbitrum.

Limitations: No dedicated node option; no published contractual SLA; Arbitrum trace support to be confirmed per method; method-weighted CU pricing less predictable for compliance pipelines.

Fit by workload:

• Regulated DeFi / stablecoin infrastructure: Good — SOC 2 Type II listed (no ISO 27001), broad EVM coverage, but no dedicated isolation
• Cross-chain audit and reporting: Moderate — Arbitrum Trace API (arbtrace_*) is documented; per-method support on Arbitrum not verified here
• Enterprise CASP operations: Moderate — enterprise terms reportedly available but not publicly documented; no dedicated nodes constrains DORA isolation requirements

4. Infura: best for Ethereum-centric teams that do not need DORA-critical contract terms

Verdict: Long operating history on Ethereum under ConsenSys. Trade-off: no published SOC 2 Type II or ISO 27001, no public contractual SLA, no dedicated node option and a free tier of 3M credits per day. Official pricing.

Infura, operated by ConsenSys, is a long-established Ethereum RPC provider, with a stated 10 billion+ API requests per day across 430,000+ registered developers. Infura’s brand recognition and long operational history give it credibility in institutional contexts. Infura supports Ethereum, Polygon, Arbitrum, Optimism, Base, BNB, Linea, and a handful of additional chains.

The compliance limitation is significant: Infura does not publish SOC 2 Type II and ISO 27001 or equivalent certifications. For DORA vendor due diligence, this forces regulated entities to either perform their own audit (expensive) or treat Infura as non-critical infrastructure only. Infura’s standard terms do not include the contractual SLA provisions required under DORA Article 30 for critical-function providers — enterprise agreements may be available but are not publicly documented. The free tier (3M credits per day, 500 credits per second) is capped relative to paid plans.

Limitations: No published SOC 2 certification; no public contractual SLA; free tier capped at 3M credits per day; weaker archive and trace support compared to dedicated infrastructure providers.

Fit by workload:

• Regulated DeFi / stablecoin infrastructure: Limited — no published compliance certification constrains its use for DORA-critical functions
• Cross-chain audit and reporting: Moderate — broad EVM chain coverage but compliance documentation gaps
• Enterprise CASP operations: Limited — DORA Article 30 compliance documentation not publicly available

5. Ankr: best for a large free tier and archive access in development and testing

Verdict: 200M free credits per month and archive data on all tiers across a distributed operator network. Trade-off: no published contractual SLA, a SOC 2 Type II attestation held by its infrastructure operator (report under NDA, no ISO 27001) and no standard dedicated nodes. Official pricing.

Ankr operates a distributed network of independent node operators across 40+ chains on public access, 65+ on freemium, and 80+ on premium. Ankr’s 200M free API credits per month is the largest free-tier allowance listed in this comparison (billing units differ between providers), and its distributed architecture provides a degree of geographic diversity that centralised providers do not offer in the same form. Archive data is included across all tiers; the Premium tier adds debug and trace namespace access.

On compliance certifications, Ankr’s trust page states that its infrastructure operator holds a SOC 2 Type II attestation (audited by A-LIGN, full report under NDA; page updated October 28, 2026) and that ISO 27001 certification is in progress, so ISO 27001 is not held. Confirm the attestation scope directly with Ankr before relying on it for DORA vendor documentation. There is no published contractual SLA. The distributed node operator model, while beneficial for censorship resistance and geographic diversity, introduces variability in response consistency: a request routed to a lagging operator node may return stale data, which is problematic for settlement confirmation pipelines where data freshness is a correctness requirement.

Limitations: No standard dedicated nodes; no published contractual SLA; inconsistent response latency across distributed operator pool; the SOC 2 Type II attestation is held by the infrastructure operator and its scope should be confirmed with Ankr.

Fit by workload:

• Regulated DeFi / stablecoin infrastructure: Moderate — broad chain coverage and archive access, but no ISO 27001 and no dedicated isolation
• Cross-chain audit and reporting: Good — archive and trace access on Premium, extensive chain coverage
• Enterprise CASP operations: Limited — no published contractual SLA; SOC 2 Type II is held by the infrastructure operator (report under NDA)

6. dRPC: best for development, testing and broad chain coverage

Verdict: 100+ chains and free public endpoints with per-request paid tiers. Trade-off: no SOC 2 or ISO 27001 found, no SLA on free public nodes (paid plans list 99.96% uptime; Enterprise lists committed SLAs). Official pricing.

dRPC routes traffic across a network of 50+ independent node operators using what dRPC describes as an AI-driven load balancer that selects the fastest, healthiest endpoint per request. It supports 100+ chains and 190+ networks, processes billions of requests per day, and charges per-million requests on paid tiers with free public access at no cost. The architecture is designed to eliminate single points of failure through multi-operator routing.

For regulated use cases, dRPC publishes the least compliance documentation of the six providers, in our assessment. No SOC 2 certification was found; free public nodes carry no SLA, paid plans list 99.96% uptime, and the Enterprise plan lists committed SLAs, SSO and dedicated clusters. Because dRPC routes across third-party node operators, this page treats data residency and audit rights provisions — both DORA Article 30 elements described above — as not documented as available. dRPC is appropriate for development, testing, or non-regulated workloads where cost efficiency and broad chain access matter more than compliance documentation.

Limitations: No SOC 2 certification found; no SLA on free public nodes (committed SLAs on Enterprise only); multi-operator routing introduces response consistency variability; audit rights framework not documented.

Fit by workload:

• Regulated DeFi / stablecoin infrastructure: Limited — published compliance documentation does not cover the requirements above
• Cross-chain audit and reporting: Moderate — broad coverage and generally low latency, but no compliance guarantees
• Enterprise CASP operations: Limited — no published contractual framework for DORA Article 30 provisions

Evaluation criteria for MiCA and DORA RPC providers

The earlier version of this page showed a chart of numeric ratings per provider. Those ratings were assigned by Chainstack without a published rubric, so they have been replaced with the table below. It lists the five criteria used on this page, what was checked, and the facts on this page that support each criterion for each provider, so readers can weigh the criteria themselves. Facts are as of May 2026 unless noted and were not re-verified on October 29, 2026.

Criterion	What was checked	Facts on this page, by provider
Compliance certifications	Published SOC 2 Type II and ISO 27001 status	Chainstack: SOC 2 Type II (Dec 2025), ISO 27001 (Jul 2026). Quicknode: SOC 1 Type II, SOC 2 Type II, ISO 27001 (reports on request). Alchemy: SOC 2 Type II report listed on its Trust Center, no ISO 27001 listed (October 29, 2026). Infura: none published. Ankr: SOC 2 Type II held by its infrastructure operator (report under NDA), ISO 27001 in progress. dRPC: none found.
Contractual SLA and audit rights	Whether a contractual SLA and an enterprise agreement framework are documented	Chainstack: Enterprise plan (from $990/month) with contractual SLA and audit-rights framework. Quicknode: contractual uptime SLA on Enterprise (figure not verified). Alchemy: enterprise terms not publicly documented (Supernode states 99.9% uptime). Infura: no public SLA. Ankr: no published SLA. dRPC: no SLA on free public nodes; paid plans list 99.96% uptime and Enterprise lists committed SLAs.
Dedicated or isolated infrastructure	Whether customer-isolated nodes are offered	Chainstack: Dedicated Nodes ($0.50/hour compute). Quicknode: Dedicated Clusters. Alchemy, Infura, Ankr, dRPC: no standard dedicated option.
Multi-chain coverage	Coverage of Ethereum, Arbitrum, Base, BNB Smart Chain and Polygon, and breadth beyond them	Chainstack: all five plus 60+ networks. Quicknode: 83+ chains, 140+ networks. Alchemy: major EVM chains; Arbitrum Trace API documented, per-method support not verified. Infura: Ethereum, Polygon, Arbitrum, Optimism, Base, BNB, Linea and a few more. Ankr: 40+ chains public, 65+ freemium, 80+ premium. dRPC: 100+ chains, 190+ networks.
Pricing transparency	Published pricing model, free tier and method weighting	Chainstack: 1 RU / 2 RU, no multipliers, published plan prices. Quicknode: method-weighted credits. Alchemy: method-weighted CUs (stated planning average 27 CU per request). Infura: credits, 3M credits per day free tier. Ankr: credits, 200M free per month. dRPC: per-1M requests, free public access.

RPC latency benchmark for MiCA and DORA workloads: Ethereum and Arbitrum examples (October 2026)

Disclosure: Chainstack operates the monitoring service, the public Grafana dashboard and the scoring formula behind the benchmark data below, and is one of the providers measured. Benchmark data is chain-specific: this article covers Ethereum, Arbitrum, Base, BNB Smart Chain and Polygon, but only two chains are shown here, as examples, and their numbers should not be read as results for the other chains. Chainstack Compare tracks Ethereum, Arbitrum, Base and BNB Smart Chain live (this page cites no figures for Base or BNB Smart Chain; see Compare and the Chainstack research reports). Chainstack Compare did not monitor Polygon when this article was updated (October 29, 2026). Compare labels the success-rate column “availability”; here it is called probe success rate because it is not platform uptime.

Method in brief: probes every 1 to 3 minutes from three cloud regions, each provider on its first paid plan; a request counts as failed if it takes longer than 55 seconds. The score is response time divided by success rate cubed per region (lower is better), averaged equally across the three regions. The collection code is open source (compare-dashboard-functions).

Example 1: Ethereum, 7-day report (window ending October 8, 2026)

Source: Ethereum RPC provider benchmark (Research Note No. 050, published October 8, 2026) by the Chainstack Labs Research Team; regions Germany, US and Singapore.

Provider	Listed in this article	Score (lower is better)	Probe success rate	P50 (ms)	P95 (ms)	P99 (ms)	Germany P95 (ms)	US P95 (ms)	Singapore P95 (ms)
Chainstack	Yes	0.079	99.98%	36	78	117	47	143	42
Quicknode	Yes	0.097	99.98%	40	92	142	40	98	138
Alchemy	Yes	0.114	99.98%	38	103	188	64	80	164
dRPC	Yes	0.670	99.96%	56	641	1,950	153	875	895

• Chainstack has the lowest P50 (36 ms), P95 (78 ms) and P99 (117 ms) and the best overall score (0.079) of the four providers measured; the report puts second-place Quicknode’s score 23% higher.
• Chainstack is not fastest everywhere. In the US, Alchemy (80 ms P95) and Quicknode (98 ms) beat Chainstack (143 ms), and in Germany Quicknode (40 ms) beats Chainstack (47 ms).
• Chainstack, Quicknode and Alchemy tie on probe success rate at 99.98% (dRPC is 99.96%). This is the share of benchmark probe requests that succeeded over 7 days; it is not platform uptime and not an SLA.

Example 2: Arbitrum, 24-hour snapshot (captured October 29, 2026, about 12:54 UTC)

Source: Chainstack Compare, Arbitrum, 24-hour view; regions Germany, US and Japan. This is a rolling 24-hour snapshot, not a dated report: the live dashboard refreshes every 3 minutes, so current figures will differ.

Provider	Listed in this article	Score (lower is better)	Probe success rate	P50 (ms)	P95 (ms)	P99 (ms)	Germany P95 (ms)	US P95 (ms)	Japan P95 (ms)
Chainstack	Yes	0.035	99.25%	17	34	768	20	57	23
Quicknode	Yes	0.043	99.98%	28	43	60	33	76	22
Alchemy	Yes	0.078	100.00%	18	78	113	125	60	48
dRPC	Yes	0.134	99.98%	38	135	222	84	164	158

• The Compare dashboard headline for this snapshot reads “Chainstack ranks #1 for Arbitrum”: Chainstack has the best score (0.035) and the lowest P95 (34 ms).
• Chainstack also has the lowest probe success rate of the four (99.25%, against 100.00% for Alchemy and 99.98% for Quicknode and dRPC) and by far the highest P99 (768 ms against 60 ms for Quicknode). Quicknode has the lowest Japan P95 (22 ms against 23 ms).

What this benchmark does not show: Infura and Ankr were not measured in either example, so this page does not claim Chainstack is the fastest of the 6 listed providers. No figures are cited for Base, BNB Smart Chain or Polygon. The Ethereum report covers a single 7-day window and the Arbitrum data a single 24-hour window, each provider on its first paid plan only (free and higher plans can behave differently), with synthetic probes from cloud regions rather than end-user latency. Neither measures throughput under load, cost, correctness, SLA terms, certifications or audit rights, which are the main criteria for MiCA and DORA vendor selection, and because Chainstack chose the scoring formula, a different formula could reorder close pairs. The Ethereum report excludes eth_subscribe, so it says nothing about WebSocket subscription stability.

To reproduce a latency measurement against your own candidate endpoints, run the command below from the region where your compliance pipeline runs, repeat it many times and compare P50 and P95. See also how to measure RPC latency (P50, P95, P99).

curl -s -o /dev/null -w "%{time_total}" -X POST -H "Content-Type: application/json" --data '{"jsonrpc":"2.0","id":1,"method":"eth_blockNumber","params":[]}' YOUR_ENDPOINT_URL

For compliance workloads, the methods that matter most are eth_getLogs (bulk event ingestion), eth_getTransactionReceipt (settlement confirmation), and eth_call (contract state reads). Latency on these methods from the EU regions where your pipeline runs shapes its performance envelope; the benchmark tables above use standard probe methods, not this specific method mix.

For latency-sensitive workloads like real-time transaction monitoring where you are continuously calling eth_subscribe for log events, geographic routing to the closest healthy node is as important as raw per-request latency. Chainstack’s Global Nodes use geo-balanced DNS routing to minimise round-trip time from the user’s deployment region. For EU-based compliance infrastructure deployed in Frankfurt or Amsterdam, Chainstack’s Global Nodes are intended to route to the nearest EU region; confirm this from your own deployment region.

⚡ Benchmark before you commit: Validate your specific method mix against your deployment region. Run a 60-second load test hitting each provider’s endpoint from your production environment and compare p50 and p95 before finalising your provider selection.

Data sources: Chainstack Ethereum benchmark report, Chainstack Compare (Arbitrum) and the Chainstack performance dashboard.

Getting started with cross-chain compliance infrastructure on Chainstack

Step 1 — Create your account. Log in to console.chainstack.com. The Developer plan is free (3M RU/month) and requires no credit card — adequate for initial testing.

Step 2 — Create a project. In the Chainstack console, click “Create project.” Projects group your nodes and endpoints for access control and billing visibility.

Step 3 — Deploy nodes for each chain. Within your project, click “Add node.” Select the chain (Ethereum, Arbitrum, Base, BNB, or Polygon), choose mainnet, and select Global Nodes (shared, instant provisioning) or Dedicated Nodes (isolated, DORA-critical workloads). For EU data residency requirements, select the EU deployment region.

Step 4 — Copy your endpoints. Each deployed node provides an HTTPS endpoint and a WSS endpoint. Copy both — use HTTPS for batch/polling workloads and WSS for real-time eth_subscribe streams.

Step 5 — Configure multi-chain in your application. Your endpoint URL format is https://[chain-name].p2pify.com/[your-api-key]. Each chain gets its own endpoint with the same API key format.

Code example: real-time USDC transfer monitoring with eth_subscribe

The following Python script subscribes to USDC Transfer events on Ethereum via WebSocket — a real-time compliance monitoring pattern for CASPs and EMT issuers.

import asyncio
import json
from websockets import connect

CHAINSTACK_WSS = "wss://YOUR_CHAINSTACK_ETH_WSS_ENDPOINT"

USDC_ADDRESS = "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48"
TRANSFER_TOPIC = "0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef"

async def monitor_usdc_transfers():
    async with connect(CHAINSTACK_WSS) as ws:
        # Subscribe to USDC Transfer logs
        subscribe_msg = {
            "jsonrpc": "2.0",
            "id": 1,
            "method": "eth_subscribe",
            "params": [
                "logs",
                {
                    "address": USDC_ADDRESS,
                    "topics": [TRANSFER_TOPIC]
                }
            ]
        }
        await ws.send(json.dumps(subscribe_msg))
        response = json.loads(await ws.recv())
        sub_id = response["result"]
        print(f"Subscribed: {sub_id}")

        # Stream incoming transfer events
        async for message in ws:
            event = json.loads(message)
            if "params" in event and event["params"].get("subscription") == sub_id:
                log = event["params"]["result"]
                # Decode from/to from padded 32-byte topics
                from_addr = "0x" + log["topics"][1][-40:]
                to_addr   = "0x" + log["topics"][2][-40:]
                amount_hex = log["data"]
                amount_usdc = int(amount_hex, 16) / 1e6
                print(f"USDC Transfer: {from_addr} → {to_addr} | {amount_usdc:.2f} USDC | block {log['blockNumber']}")

asyncio.run(monitor_usdc_transfers())

For the full API reference and additional SDK examples across chains, see the Chainstack protocols and tutorials index.

🤖 You can also access Chainstack RPC endpoints directly from Claude, Cursor, Codex, Gemini, or Windsurf using Chainstack MCP. Learn more about Chainstack MCP.

Conclusion

For EU-regulated entities, the RPC provider decision in 2026 comes down to two practical constraints, in our assessment (Chainstack publishes this page; see how we compared): the provider should have a published, independently audited compliance certification (this page uses SOC 2 Type II and ISO 27001 as the baseline), and the enterprise agreement must cover DORA Article 30’s contractual requirements for critical-function ICT providers.

• Regulated DeFi and stablecoin infrastructure (MiCA ART/EMT issuers): Chainstack — SOC 2 Type II and ISO 27001 certification, enterprise SLA, Dedicated Nodes for isolation, full archive and trace access
• Cross-chain audit and reporting pipelines: Chainstack as primary, Quicknode as secondary — both list the compliance certifications and multi-chain coverage this page looks for in documented DORA vendors
• Enterprise CASP operations requiring ISO 27001: Chainstack or Quicknode — both list ISO 27001 alongside SOC 2 Type II and offer contractual SLAs (Alchemy lists SOC 2 Type II but no ISO 27001, and documents no contractual SLA); pairing Chainstack with Quicknode covers primary and failover
• Development and pre-production testing: Alchemy or Ankr — large free tiers for building, with migration to certified infrastructure before production cutover
• Concentration risk mitigation (DORA Article 29): Deploy Chainstack as primary with Quicknode as failover; document both in your ICT third-party risk register

Additional resources

• Chainstack enterprise infrastructure
• Stablecoin infrastructure on Chainstack
• Blockchain infrastructure for fintech
• Tutorials and guides for all chains on Chainstack
• Chainstack pricing
• Chainstack performance dashboard — Ethereum, Arbitrum, Base, BNB
• Chainstack Compare (live RPC provider comparison)
• Chainstack research reports
• More Ethereum tutorials and articles on the Chainstack blog

Changelog

We review this comparison regularly so that the information stays accurate, clear, and easy to verify. This page was reviewed to improve how the comparison is structured and sourced.

• October 29, 2026: Added a quick verdict, a Rank and Best for column in the provider comparison table (moved up), a methodology, disclosure and regulatory-note section, an evaluation criteria table replacing the previous per-provider numeric ratings, a latency benchmark section (Ethereum report and Arbitrum snapshot, October 2026) replacing the previous benchmark paragraph, a rate limits and free tiers comparison, alternatives guidance, numbered provider sections with one-line verdicts and official pricing links, a corrected Chainstack ISO 27001 date, a cited platform uptime statement, corrected vendor pricing, limits and certification details, and wording clarifications.
• May 25, 2026: Original publication.