DORA
DORAAlso called digital Operational Resilience Act, regulation (EU) 2022/2554
DORA is the EU Digital Operational Resilience Act, Regulation (EU) 2022/2554. It sets one rulebook for how banks, insurers, investment firms, payment firms and crypto-asset service providers manage ICT risk. It has applied since 17 January 2025 and also brings critical ICT third-party providers, such as cloud firms, under EU oversight.
How it works
DORA covers five areas. Firms need an ICT risk management framework approved by the management body. They classify ICT incidents and report major ones to their regulator. They test resilience, with threat-led penetration tests for the largest firms. They manage ICT third-party risk and keep a register of information on every ICT contract. They may share cyber threat intelligence.
DORA matters because it replaced a patchwork of national rules with one regulation applying to around 20 types of financial entity. Supervisors collect each firm's register of information every year. The European Supervisory Authorities oversee critical ICT third-party providers directly. Detailed technical standards set incident time limits, contract terms and testing methods.
The rules
Sets requirements for ICT risk management, incident reporting, resilience testing, third-party risk and oversight of critical ICT providers.
EU financial entities and critical ICT third-party providersAmends existing financial directives so that their ICT and operational risk provisions point to DORA.
EU financial entities under CRD, MiFID II, Solvency II and othersSets initial notification within 4 hours of classification, an intermediate report within 72 hours and a final report within one month.
EU financial entities in scope of DORACommon questions
Who does DORA apply to?
DORA applies to around 20 types of EU financial entity, including credit institutions, payment and e-money institutions, investment firms, insurers, crypto-asset service providers and trading venues. It also covers ICT third-party providers designated as critical by the European Supervisory Authorities.
When did DORA start to apply?
DORA entered into force on 16 January 2023 and has applied since 17 January 2025. Firms had two years to build their ICT risk frameworks, registers of information and incident reporting processes.
What is the DORA register of information?
It is a structured record of every contract a financial entity has with ICT third-party service providers. Firms submit it to their national supervisor, which passes the data to the European Supervisory Authorities to assess concentration risk.
Does DORA apply in the UK?
No. DORA is EU law and was adopted after Brexit. UK firms with EU subsidiaries or EU clients may be in scope through those entities. The UK has its own operational resilience and critical third parties regimes.
