DORA - Digital Operational Resilience Act
Comprehensive guide to DORA (Regulation EU 2022/2554). Understand ICT risk management, incident reporting, resilience testing, and third-party risk obligations for financial entities. Reversa helps you achieve DORA compliance.
Key Figures
Overview
What is this regulation?
The Digital Operational Resilience Act (DORA), formally Regulation (EU) 2022/2554, establishes a comprehensive framework for managing ICT (Information and Communication Technology) risks in the European financial sector. DORA recognizes that financial entities are deeply dependent on digital technologies and that ICT disruptions can have systemic consequences for the entire financial system. The regulation harmonizes ICT risk management rules across the EU, replacing the fragmented national approaches that previously existed. DORA applies to virtually all regulated financial entities - including banks, insurance companies, investment firms, payment institutions, crypto-asset service providers, and critical ICT third-party service providers. It creates a unified supervisory approach to digital operational resilience, ensuring that all financial entities can withstand, respond to, and recover from ICT-related disruptions. The regulation covers five core pillars: ICT risk management frameworks, ICT-related incident reporting, digital operational resilience testing, managing ICT third-party risk, and information-sharing arrangements. DORA entered into force on January 16, 2023, and has been applicable since January 17, 2025, making compliance an immediate priority for the European financial sector.
Who does it affect?
Organizations and roles impacted by this regulation
Credit institutions (banks) and payment institutions operating in the EU
Investment firms, trading venues, and central counterparties
Insurance and reinsurance undertakings
Crypto-asset service providers authorized under MiCA
Critical ICT third-party service providers (including cloud providers)
Key Obligations
Core compliance requirements organizations must address
ICT Risk Management Framework
Financial entities must establish and maintain a comprehensive ICT risk management framework covering identification, protection, detection, response, and recovery capabilities. The management body bears ultimate responsibility and must approve, oversee, and be held accountable for the ICT risk strategy.
ICT Incident Reporting
Entities must classify ICT-related incidents using defined criteria, report major incidents to competent authorities within strict timelines (initial notification, intermediate report, and final report), and notify affected clients when incidents impact their financial interests.
Digital Operational Resilience Testing
All financial entities must conduct basic ICT testing (vulnerability assessments, scenario-based tests, penetration testing). Significant entities must also perform advanced threat-led penetration testing (TLPT) at least every three years, using qualified external testers following the TIBER-EU framework.
Third-Party ICT Risk Management
Financial entities must maintain a register of all ICT third-party service providers, conduct due diligence before outsourcing, include specific contractual provisions, and manage concentration risk. Critical ICT providers will be subject to direct EU oversight through a Lead Overseer designated by the European Supervisory Authorities.
Information Sharing
DORA encourages financial entities to participate in voluntary cyber threat intelligence sharing arrangements to collectively enhance digital operational resilience and raise awareness of ICT risks across the financial sector.
Governance and Accountability
Management bodies must approve ICT risk management strategies, allocate adequate budgets, undertake regular ICT risk training, and be personally accountable for DORA compliance. Board members must maintain sufficient knowledge and skills regarding ICT risks.
Penalties for Non-Compliance
DORA empowers national competent authorities to impose administrative penalties and remedial measures for non-compliance. While the regulation does not specify fixed penalty amounts (leaving this to national transposition measures and supervisory discretion), penalties can include public statements identifying the responsible entity, orders to cease non-compliant conduct, and significant administrative fines. For critical ICT third-party service providers under the Lead Overseer framework, periodic penalty payments of up to 1% of average daily worldwide turnover can be imposed for each day of non-compliance, for up to six months. The real risk extends beyond financial penalties: failure to maintain digital operational resilience can result in service disruptions, customer harm, and systemic risk - all of which carry severe reputational and business consequences.
Implementation Timeline
Key milestones and compliance deadlines
European Commission publishes the Digital Finance Package, including the DORA legislative proposal
DORA regulation adopted by the European Parliament and the Council
DORA enters into force - 24-month implementation period begins
European Supervisory Authorities publish first batch of Regulatory Technical Standards (RTS) and Implementing Technical Standards (ITS)
DORA becomes fully applicable - all financial entities must be compliant
How Reversa Helps
Purpose-built tools for navigating this regulation with confidence
Regulatory Radar
24/7 monitoring of hundreds of official sources - ESAs, national competent authorities, and supervisory bodies. Receive same-morning notifications when DORA-related RTS/ITS updates, guidelines, or enforcement actions are published.
AI-Powered Analysis
Deep-dive regulatory impact analysis with sector-specialized AI agents that extract concrete DORA obligations - from ICT risk management requirements to incident reporting timelines relevant to your entity type.
Legislative Twins
Map DORA obligations to your organization's specific context - creating digital representations of how the regulation affects your entity based on your classification, size, and ICT risk profile.
Automated Reporting
Generate newsletters, compliance radars, and reports for committees and stakeholders automatically - keeping your team aligned on DORA developments and supervisory expectations without manual effort.
Frequently Asked Questions
Common questions about this regulation