What is DORA and who does it apply to
DORA (Digital Operational Resilience Act) is Regulation (EU) 2022/2554 on digital operational resilience for the financial sector. It has applied since 17 January 2025 and is directly applicable in all EU countries.
Digital operational resilience is an entity's ability to withstand an outage or attack on its ICT systems, keep providing critical services and recover quickly. Previously, IT risk requirements were scattered across various guidelines and national rules. DORA brought them together in one act.
- Banks and investment firms. Credit institutions, brokers and asset managers.
- The payments sector. Payment institutions and e-money institutions.
- The crypto market. Crypto-asset service providers licensed under the MiCA regulation.
- Insurance and market infrastructure. Insurers, exchanges, central securities depositories, credit rating agencies and others — more than 20 types of financial entities in total.
The five pillars of DORA
The regulation is built around five areas. Each comes with specific obligations and technical standards developed by the European supervisory authorities (EBA, ESMA, EIOPA).
- 01. ICT risk management. A documented framework: asset inventory, protection, attack detection, backups and recovery plans.
- 02. Incident management and reporting. Classifying incidents using common criteria and mandatory reports to the supervisor on major incidents.
- 03. Digital resilience testing. Regular vulnerability and scenario testing, and threat-led penetration testing (TLPT) for the largest entities.
- 04. ICT third-party risk. Oversight of cloud and software providers, mandatory contract terms and a register of all ICT contracts.
- 05. Information sharing. Voluntary sharing of cyber threat intelligence between financial entities.
Management responsibility
DORA explicitly places responsibility for ICT risk on the entity's management body. The board approves the digital resilience strategy, allocates the budget and undergoes regular training. Cyber security is no longer "an IT department issue" — it is a duty of board members, for which they are personally accountable.
The principle of proportionality still applies. Smaller and less complex entities have a simplified risk management framework. But the basics — a system inventory, backups and a response plan — are mandatory for everyone.
Incident reporting: tight deadlines
A major ICT incident must not only be resolved but also quickly reported to the supervisor. The technical standards set a clear timeline:
- Initial notification. Within 4 hours of classifying the incident as major and no later than 24 hours after detecting it.
- Intermediate report. Within 72 hours of the initial notification.
- Final report. Within one month, with a root cause analysis and measures to prevent recurrence.
If an incident affects clients' financial interests, the entity must inform them too. For payment services that run around the clock, such as instant euro transfers, this discipline is especially important.
Oversight of critical ICT providers
DORA's most innovative part concerns not financial entities themselves but their suppliers. Most banks depend on a handful of large cloud platforms. An outage at one of them could hit the whole sector at once.
That is why the European supervisory authorities designate critical ICT third-party providers and oversee them directly. The first list of such providers, which includes the largest cloud and technology companies, was published at the end of 2025. A provider that fails to follow the overseer's recommendations risks daily penalties of up to 1% of its average daily worldwide turnover.
For financial entities, this means new contract requirements: audit rights, exit terms and plans for service termination. Responsibility for DORA compliance always remains with the entity, not the provider.
Practical steps for fintech companies
Almost two years after DORA started to apply, supervisors have moved from explanations to inspections. Companies should make sure that:
- The register of ICT contracts is complete and up to date, including subcontractors for critical functions.
- The incident response plan has been tested in exercises, and roles and contacts are known in advance.
- An exit strategy from key providers exists in more than just paperwork.
- API and integration security is tested regularly, following OWASP practices and the ISO/IEC 27001 standard.
In brief: frequently asked questions
Does DORA apply to small fintech companies?
Yes, if the company holds a financial entity licence in the EU. Small entities have a simplified ICT risk management framework, but the basic requirements are mandatory.
How is DORA different from NIS2?
NIS2 is a general cyber security directive covering many sectors. DORA is a specific regulation for the financial sector, and its rules take precedence for financial entities.
Can responsibility for DORA be outsourced to an IT provider?
No. The financial entity remains fully responsible for compliance, even if functions are performed by an external provider.
