theseeus.eu

    DORA

    Last reviewed 2026-07-16.

    ← All instruments
    in forcesectoral
    Type
    regulation
    Layer
    sectoral
    Status
    in force
    Adopted
    2022-12-14
    In force
    2023-01-16
    Applies from
    2025-01-17
    Key date
    2025-01-17 applies
    CELEX
    32022R2554
    Last verified
    2026-07-16
    Official text
    EUR-Lex / official source

    DORA — the financial sector’s own cyber regime#

    Regulation (EU) 2022/2554 on digital operational resilience for the financial sector. Applies since 17 January 2025. Where NIS2 sets a baseline for 18 sectors, DORA is the stricter, directly-applicable lex specialis for finance — on the premise that a firm can fail operationally (via ICT) as surely as financially.

    Who is in scope#

    ~20 types of financial entity: credit institutions; payment & e-money institutions; investment firms; crypto-asset service providers (MiCA); trading venues; CCPs and CSDs; managers of AIFs and UCITS; (re)insurers and intermediaries; pension institutions; credit-rating agencies; crowdfunding providers; and more — plus, uniquely, the ICT third-party providers serving them (pillar 5). Proportionality applies: a simplified framework for small/non-interconnected firms; relief for micro-enterprises.

    The five pillars#

    1. ICT risk management (Arts. 5–16)#

    The management body bears final responsibility. Full framework: strategy, protection & prevention, detection, response & recovery, backups, learning/evolution, communication — mapped to identified critical functions. RTS from the ESAs specify the content.

    2. ICT incident management & reporting (Arts. 17–23)#

    Classify all ICT incidents against harmonised criteria (clients affected, duration, geographic spread, data losses, criticality, economic impact). Major incidents are reported to the competent authority in three steps:

    • Initial notification: within 4 hours of classifying as major, and no later than 24 hours from awareness;
    • Intermediate report: within 72 hours;
    • Final report: within one month. Significant cyber threats may be reported voluntarily; clients are informed when affected.

    3. Digital operational resilience testing (Arts. 24–27)#

    Annual testing programme for all (vulnerability scans, scenario tests). Significant entities run Threat-Led Penetration Testing (TLPT) at least every 3 years on live production systems of critical functions, TIBER-EU-aligned — including relevant critical ICT providers.

    4. ICT third-party risk management (Arts. 28–30)#

    Lifecycle governance of tech providers: a third-party risk strategy; the Register of Information (inventory of all ICT contractual arrangements — first regulatory submissions ran in 2025); pre-contract risk assessment; concentration-risk analysis; and mandatory contract clauses (Art. 30: access/audit rights, SLAs, termination/exit strategies, sub-outsourcing conditions, cooperation with authorities).

    5. Oversight of Critical ICT Third-Party Providers (Arts. 31–44)#

    The novel part: the ESAs directly oversee designated CTPPs (hyperscale cloud and similar) via appointed Lead Overseers — information requests, inspections, recommendations, penalty payments up to 1% of average daily worldwide turnover. First CTPP designations were made by the ESAs; oversight is ramping through 2025–2026. ⚠️ VERIFY current designation list.

    Plus voluntary information-sharing arrangements (Art. 45).

    Enforcement#

    No harmonised EU fine ceilings for financial entities — supervision and sanctions flow through the existing financial stack (ECB/SSM; EBA/ESMA/EIOPA; national authorities such as BaFin, Banca d’Italia/CONSOB/IVASS, ACPR/AMF). Supervisory expectations on governance, testing, exit strategies and audit rights matured through 2026.

    Interplay#

    NIS2 is displaced for financial entities (lex specialis), though the national CSIRT ecosystem still serves them; DORA major-incident reports are slated to flow through the future Single Entry Point; cloud certification (EUCS) and CTPP oversight are converging themes for financial cloud usage.

    Sources#