DORA: Digital Operational Resilience Act

The Digital Operational Resilience Act (DORA), formally Regulation (EU) 2022/2554, sets a common framework for managing ICT (information and communication technology) risk in the European financial sector. DORA recognises that financial entities depend deeply on digital technologies and that ICT disruptions can have systemic consequences for the whole financial system. The regulation harmonises ICT risk management rules across the EU and replaces the fragmented national approaches that existed before. DORA applies to 20 types of regulated financial entity, including banks, insurers, investment firms, payment institutions and crypto-asset service providers, and to the ICT third-party service providers that serve them. It creates a single supervisory approach to digital operational resilience, so that financial entities can withstand, respond to and recover from ICT-related disruptions. The regulation rests on five pillars: ICT risk management, ICT-related incident reporting, digital operational resilience testing, ICT third-party risk management and information sharing. DORA entered into force on 16 January 2023 and has applied since 17 January 2025.

1. Credit institutions (banks) and payment institutions operating in the EU
2. Investment firms, trading venues and central counterparties
3. Insurance and reinsurance undertakings
4. Crypto-asset service providers authorised under MiCA
5. Critical ICT third-party service providers (including cloud providers)

1. 01

   ICT risk management framework

   Financial entities must establish and maintain a complete ICT risk management framework covering identification, protection, detection, response and recovery. The management body bears ultimate responsibility and must approve, oversee and be accountable for the ICT risk strategy.

2. 02

   ICT incident reporting

   Entities must classify ICT-related incidents using defined criteria, report major incidents to competent authorities within strict deadlines (initial notification, intermediate report and final report), and inform affected clients when incidents affect their financial interests.

3. 03

   Digital operational resilience testing

   All financial entities must carry out basic ICT testing (vulnerability assessments, scenario-based tests, penetration testing). Significant entities must also perform advanced threat-led penetration testing (TLPT) at least every three years, with qualified testers and following the TIBER-EU framework.

4. 04

   ICT third-party risk management

   Financial entities must keep a register of all ICT third-party service providers, carry out due diligence before outsourcing, include specific contractual provisions and manage concentration risk. Critical ICT providers are subject to direct EU oversight through a Lead Overseer designated among the European Supervisory Authorities.

5. 05

   Information sharing

   DORA encourages financial entities to take part in voluntary cyber threat intelligence sharing arrangements, to strengthen digital operational resilience together and raise awareness of ICT risk across the financial sector.

6. 06

   Governance and accountability

   Management bodies must approve ICT risk management strategies, allocate adequate budgets, follow regular ICT risk training and answer for DORA compliance. Board members must keep sufficient knowledge and skills on ICT risk.

DORA requires Member States to give competent authorities the power to impose administrative penalties and remedial measures (art. 50). The regulation does not set fixed fine amounts for financial entities: these are set nationally. Penalties can include public statements naming the responsible entity, orders to stop non-compliant conduct and administrative fines. For critical ICT third-party service providers, the Lead Overseer can impose periodic penalty payments of up to 1% of average daily worldwide turnover in the preceding business year, imposed daily for up to six months (art. 35). The wider risk goes beyond fines: weak digital operational resilience can lead to service disruption, harm to clients and systemic risk, with serious reputational and business consequences.

1. Sept 2020

   European Commission publishes the Digital Finance Package, including the DORA proposal

2. Nov 2022

   DORA adopted by the European Parliament and the Council

3. Jan 2023

   DORA enters into force, starting a 24-month implementation period

4. Jan 2024

   European Supervisory Authorities publish the first batch of regulatory technical standards (RTS) and implementing technical standards (ITS)

5. Jan 2025

   DORA applies: all financial entities in scope must comply