DORA

DORA, the Digital Operational Resilience Act, sets one EU-wide rulebook for how financial entities manage information and communication technology risk. It covers risk management, incident reporting, resilience testing and, unusually, the ICT providers the financial sector depends on.

It is a regulation, so it applies directly across the EU, and it has applied since 17 January 2025. Detailed technical standards fill in much of the practice.

• Financial entities, including credit institutions, payment and e-money institutions, investment firms, crypto-asset service providers, trading venues, insurers and reinsurers, and many others listed in Article 2.
• ICT third-party service providers serving them, with the most critical designated for direct EU oversight.
• A simplified framework applies to some smaller and less interconnected entities (Art. 16).

Member states set administrative penalties and remedial measures (Art. 50). Critical ICT third-party providers overseen at EU level can face periodic penalty payments of up to 1% of their average daily worldwide turnover for each day of non-compliance, for up to six months (Art. 35).

1. Confirm your entity type, and whether the simplified framework applies.
2. Have your management body approve the ICT risk-management framework and own it.
3. Build the register of information on all ICT third-party arrangements.
4. Classify incidents against the regulatory criteria and rehearse the reporting timeline for major incidents.
5. Update ICT contracts with the Article 30 clauses and exit strategies.
6. Plan resilience testing, and threat-led penetration testing if you are selected.