The Digital Operational Resilience Act, known as DORA, is Regulation (EU) 2022/2554. It sets one EU rulebook for how financial firms manage the risks of the technology they depend on, from cyber attacks and system outages to the loss of a cloud provider. As a regulation, it applies directly in every Member State with no national transposition.
DORA entered into force on 16 January 2023 and has applied since 17 January 2025. It is supported by technical standards that set the detail, including how to classify incidents, the reporting templates and deadlines, the register of ICT arrangements and the conduct of threat-led testing.
DORA is the specific rule for the financial sector under the EU's wider cyber security law, the NIS2 Directive (Directive (EU) 2022/2555). Financial entities covered by both follow DORA for ICT risk management and incident reporting.
Before DORA, ICT risk rules were spread across sector rules, guidelines and national practice, and differed by country and type of firm. DORA replaces that patchwork with common definitions, common deadlines and common supervisory expectations across the financial sector.
Financial services now run on distributed cloud platforms, software-as-a-service tools and real-time data flows, much of it outside the firm's own systems. A cyber attack, an outage at a shared provider or a faulty software update can stop payments, trading or claims handling across many firms at once.
DORA responds in three ways that set it apart from earlier rules:
The aim is resilience of the system as a whole, not only of individual firms.
Article 2 of DORA lists the financial entities in scope, from credit institutions to ICT third-party service providers. The main groups are:
| Group | Examples |
|---|---|
| Banking and payments | Credit institutions, payment institutions, account information service providers, electronic money institutions |
| Investment and markets | Investment firms, fund managers, trading venues, central securities depositories, central counterparties, trade repositories |
| Insurance and pensions | Insurers, reinsurers, insurance intermediaries, occupational pension schemes |
| Digital finance | Crypto-asset service providers and issuers of asset-referenced tokens under MiCA, crowdfunding service providers |
| Other | Credit rating agencies, administrators of critical benchmarks, data reporting service providers, securitisation repositories |
DORA scales to size and risk. Microenterprises, firms with fewer than 10 staff and annual turnover or balance sheet of no more than €2 million, have lighter obligations in several areas. A simplified ICT risk management framework under Article 16 applies to small and non-interconnected investment firms, payment institutions and EMIs exempted under PSD2 and the Electronic Money Directive, exempted credit institutions and small pension schemes.
For payment institutions, EMIs and crypto-asset service providers, DORA also forms part of the licence application. Our guide to the EU payment institution licence explains how regulators assess it at authorisation.
| Date | Milestone |
|---|---|
| 16 January 2023 | DORA enters into force |
| 13 March 2024 | Delegated Regulation (EU) 2024/1772 sets incident classification criteria and thresholds |
| 29 November 2024 | Implementing Regulation (EU) 2024/2956 sets the register of information templates |
| 17 January 2025 | DORA applies to all financial entities in scope |
| 18 September 2026 | EBA publishes final Guidelines on the management of third-party risk, aligned with DORA, with a two-year transition |
Many of DORA's strictest requirements apply to ICT services that support critical or important functions: the annual testing of systems, the extra contractual terms, exit plans and the thresholds for downtime. A function is critical or important where a disruption would materially impair the firm's financial performance, the soundness or continuity of its services, or its continuing compliance with its licence conditions.
Identify these functions first, because they drive the scope of the whole programme. For a payment institution or EMI they typically include:
Map each function to the systems and providers that support it. That map becomes the basis of the register of information, the testing plan and the exit strategies.
Each financial entity must have a sound, comprehensive and documented ICT risk management framework, reviewed at least once a year and after major incidents. The framework covers the full cycle:
The framework must assign clear roles, with an independent control function for ICT risk, and be audited regularly by internal audit. DORA is concerned with organisational accountability, not with any particular tool.
Firms must detect, manage, log and classify every ICT-related incident, and report major incidents to their competent authority. Delegated Regulation (EU) 2024/1772 sets seven classification criteria.
| Criterion | Threshold for a major incident |
|---|---|
| Clients, counterparts and transactions | More than 10% of clients using the affected service, among other measures |
| Duration and downtime | Incident lasting more than 24 hours, or downtime over 2 hours for services supporting critical or important functions |
| Geographical spread | Impact in two or more Member States |
| Economic impact | Costs and losses that exceed or are likely to exceed €100,000 |
| Data losses | Loss of availability, integrity or confidentiality of data |
| Reputational impact | Media coverage, complaints or regulatory consequences |
| Criticality of services affected | Services supporting critical or important functions |
An incident is major where it affects critical services and either involves malicious, unauthorised access to network and information systems that may cause data losses, or meets two or more of the other thresholds. Recurring incidents with the same apparent root cause, occurring at least twice in six months, can together count as one major incident.
| Report | Deadline |
|---|---|
| Initial notification | As early as possible, within 4 hours of classifying the incident as major and no later than 24 hours from becoming aware of it |
| Intermediate report | Within 72 hours of the initial notification, and again when regular activities are recovered |
| Final report | Within one month of the latest intermediate report |
Source: Delegated Regulation (EU) 2025/301, Article 5. Where a deadline falls on a weekend or bank holiday, most firms may report by noon on the next working day; the extension does not apply to initial and intermediate reports from credit institutions, central counterparties, trading venues and entities classed as essential or important under the NIS2 Directive. Firms may also notify significant cyber threats voluntarily, and must inform affected clients of major incidents that affect their financial interests.
Every firm in scope runs a risk-based testing programme. All ICT systems and applications supporting critical or important functions are tested at least once a year, using methods matched to the risk: vulnerability assessments and scans, network security assessments, gap analyses, source code reviews, scenario-based tests, compatibility and performance testing, and penetration testing.
Firms identified by their competent authority, based on their size, systemic importance and ICT risk, carry out advanced threat-led penetration testing (TLPT) at least every three years. TLPT simulates the tactics of real attackers against live production systems, follows the TIBER-EU approach and uses qualified external testers. The results, and the plans to remediate what the tests find, go to the regulator.
Testing must be independent of the people who built and run the systems, which can be an internal team or an external tester. Track every finding to closure with an owner and a date, and report the results to the board: supervisors read the testing record as the clearest evidence of whether the framework works in practice.
Firms remain fully responsible for compliance when they use ICT providers. DORA requires a board-approved strategy on ICT third-party risk and sets out how each arrangement is chosen, contracted, monitored and ended.
Every financial entity keeps a register of information on all its contractual arrangements with ICT third-party service providers, at entity level and, for groups, at sub-consolidated and consolidated level. Implementing Regulation (EU) 2024/2956 sets the standard templates. The register is reported to the competent authority, which uses it to map the sector's dependencies and to identify providers for designation as critical.
Contracts with ICT providers must contain minimum terms, with further terms for services supporting critical or important functions:
For each critical service the firm needs a tested exit strategy, and it must assess concentration risk, including dependence on one provider or a small group of connected providers. On 18 September 2026 the EBA published final Guidelines on the management of third-party risk, covering ICT and non-ICT arrangements that support critical or important functions, aligned with DORA and with a two-year transitional period.
DORA brings the most important ICT providers to the financial sector, such as large cloud and data providers, under direct EU oversight. The European Supervisory Authorities (the EBA, ESMA and EIOPA) designate critical ICT third-party providers based on the number of financial entities relying on them, their systemic importance, the degree of substitutability and the criticality of the functions they support.
Each critical provider has a Lead Overseer among the three authorities, which can request information, carry out investigations and inspections, and issue recommendations. A provider that does not comply can face periodic penalty payments of up to 1% of its average daily worldwide turnover. Financial firms using a critical provider must take the Lead Overseer's findings into account in their own risk management.
Firms may exchange cyber threat information and intelligence with each other within trusted communities, including indicators of compromise, attacker tactics and security alerts. Sharing is voluntary, governed by arrangements that protect confidential and personal data, and must be notified to the competent authority. DORA treats resilience as a collective effort: a threat seen by one firm can be stopped at many.
Article 5 places the ultimate responsibility for managing ICT risk on the management body. DORA is as much a governance regulation as a technical one. The board must:
Supervisors assess governance as closely as technical controls. Board minutes, risk committee reports, internal audit findings and the record of decisions on risk tolerance and remediation are the evidence they ask for.
National competent authorities supervise DORA for the firms they regulate. They assess resilience frameworks, request documentation and audit trails, receive and follow up major incident reports, review registers of information and coordinate on cross-border risks. Member States set the administrative penalties and remedial measures available to them, which include orders to remedy breaches and public statements.
For firms seeking a licence, DORA is now part of the application. Regulators assessing a payment institution, EMI or crypto-asset service provider examine the ICT risk framework, the register of information and the contracts with key providers before granting authorisation. Our guide to EMI compliance in Europe shows how DORA fits alongside safeguarding, anti-money laundering and PSD3 obligations, and our guide to ongoing MiCA compliance for crypto-asset service providers covers the crypto sector.
Supervisors reviewing a firm's DORA arrangements, whether at authorisation or in ongoing supervision, test whether the framework works in practice. The points they examine most often:
| Area | What a strong framework shows |
|---|---|
| Register of information | Complete, accurate entries for every ICT arrangement, including intragroup services and subcontractors |
| Critical or important functions | A documented assessment linking each function to its systems and providers |
| Contracts | DORA's key provisions present in every contract, with a plan for those still being renegotiated |
| Incident classification | Classification run against the seven criteria within the reporting deadlines, with records of each decision |
| Exit strategies | Exit plans that have been tested, with realistic timeframes and alternative providers named |
| Board oversight | Minutes showing the board approving the framework, the risk tolerance and the testing results |
| Testing | An annual programme covering every critical system, with findings tracked to closure |
Intragroup arrangements are often the gap: a subsidiary using its parent's technology must record and contract for it in the same way as an external provider.
DORA is a continuing obligation, not a one-off project. Firms that are building or reviewing their framework in 2026 can follow seven steps.
For a start-up applying for a licence, the same steps are built into the application file, scaled to the firm's size: a proportionate framework, a short list of critical providers with compliant contracts, and an incident process the regulator can follow from detection to final report.
The firm's regulatory compliance practice carries out DORA gap assessments and builds these frameworks for payment institutions, EMIs, crypto-asset service providers and investment firms.
DORA does not apply to UK firms. FCA and PRA regulated firms follow the UK operational resilience rules, under which firms had to be able to stay within impact tolerances for their important business services by 31 March 2025, and the UK regime for critical third parties, in force since 1 January 2025.
A UK group with EU subsidiaries runs both regimes: DORA for the EU entities and the UK rules for the UK firm. Mapping important business services under the UK rules to critical or important functions under DORA lets one control framework serve both. Our article on operational resilience for UK banks covers the UK position.
DORA entered into force on 16 January 2023 and has applied since 17 January 2025.
EU financial entities including banks, payment institutions, EMIs, investment firms, fund managers, insurers, crypto-asset service providers and crowdfunding platforms, with critical ICT providers overseen directly by the European Supervisory Authorities.
An initial notification within 4 hours of classifying an incident as major and no later than 24 hours from detection, an intermediate report within 72 hours, and a final report within one month.
A register of every contractual arrangement with ICT third-party providers, kept in the templates set by Implementing Regulation (EU) 2024/2956 and reported to the competent authority.
Yes, with proportionality. Payment institutions and EMIs exempted under PSD2 and the Electronic Money Directive use a simplified ICT risk management framework under Article 16.
At least every three years, for firms identified by their competent authority based on size, systemic importance and ICT risk.
No. UK firms follow the FCA and PRA operational resilience rules and the UK critical third parties regime; UK groups with EU subsidiaries apply DORA to those entities.
Buckingham Capital Consulting has obtained payment and e-money licences in the UK and the EU since 2013, including a Central Bank of Ireland EMI licence for Own Solutions, and builds the DORA framework into every EU application it prepares. The firm carries out DORA gap assessments, incident playbooks, registers of information and provider contract reviews for payment institutions, EMIs, crypto-asset service providers and investment firms.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.