Kerson Wallaw
400-3 Place Ville Marie, Montréal QC H3B 2E3
Ph: (514) 312-1555
Book a free consult
Pick a time · Request a callback

DORA, resilience by regulation.

The Digital Operational Resilience Act (DORA) is the EU regulation that requires banks, insurers, payment institutions and other financial entities to prove they can withstand, respond to and recover from ICT disruptions. It has applied since 2025-01-17, and it reaches their technology suppliers through their contracts.

Talk to an expertRelated insights

DORA in brief.

Type
EU regulation, directly applicable in every member state
Reference
Regulation (EU) 2022/2554, with Directive (EU) 2022/2556
Applies since
2025-01-17
Who it covers
About 20 types of EU financial entities, and indirectly their ICT suppliers
Supervised by
National authorities (in France, the ACPR and the AMF) and the European Supervisory Authorities (EBA, EIOPA, ESMA)
Critical ICT providers
Designated providers are overseen directly by the European Supervisory Authorities

What, why and who.

What it is

One set of digital resilience rules for the EU financial sector, in five pillars: ICT risk management, classification and reporting of ICT incidents, digital operational resilience testing, management of ICT third-party risk, and voluntary sharing of threat information.

Why it exists

Financial services now depend on a small number of technology providers. One outage or cyberattack can spread across institutions and borders. DORA replaces scattered national rules with a common standard and gives supervisors a view of the whole technology supply chain.

Who it applies to

Banks, insurers and reinsurers, investment firms, payment and e-money institutions, crypto-asset service providers, fund managers, insurance intermediaries (except micro and small firms) and other financial entities. Technology suppliers are not regulated directly, but their financial clients must pass DORA requirements on to them by contract: security, incident notification, testing, audit access and exit plans.

Authority and enforcement

Each member state names its competent authorities and sets the penalties for financial entities; in France, the ACPR and the AMF. The European Supervisory Authorities oversee designated critical ICT providers directly and can impose periodic penalty payments of up to 1% of their average daily worldwide turnover.

How it got here.

  1. 2020-09-24

    The European Commission proposes DORA as part of its Digital Finance Package.

  2. 2022-12-27

    Regulation (EU) 2022/2554 is published in the Official Journal.

  3. 2023-01-16

    Entry into force, with a two-year implementation period.

  4. 2024

    Technical standards adopted on ICT risk, incident reporting, third-party contracts and the register of information.

  5. 2025-01-17

    DORA applies to financial entities across the EU.

  6. 2025

    First registers of information on ICT providers submitted to supervisors.

  7. 2025-11-18

    The European Supervisory Authorities publish the first list of 19 critical ICT third-party providers.

What it changes.

Systems and tools

  • Map of the services, systems and subcontractors behind what you deliver
  • Logging, monitoring and detection fast enough to support quick notification
  • Backups, recovery and resilience testing

Processes

  • Incident notification to clients within agreed times: they must report major incidents within hours
  • Penetration and resilience testing, including client-led tests
  • Subcontractor management and notice of changes
  • Exit plans and return of data

Governance

  • Contract clauses aligned with DORA Article 30
  • Security policies approved by management
  • Audit and access rights for clients and their supervisors
  • Evidence ready for supplier questionnaires; ISO 27001 certification helps

If you do not comply

  • Failed supplier due diligence and lost financial-sector clients
  • Termination rights for your client if requirements are not met
  • Delays at renewal while clauses are renegotiated
  • For financial entities: supervisory measures and penalties set by each member state

Changes ahead.

Announced and upcoming changes

  • ProposalThe Commission’s Digital Omnibus (2025-11-19) proposes a single EU entry point, run by ENISA, for incident reports under DORA, NIS2 and the GDPR. Reporting obligations and deadlines would not change. Not yet adopted.
  • YearlyThe European Supervisory Authorities update the list of critical ICT third-party providers each year.
  • OngoingThreat-led penetration testing (TLPT) at least every three years for the most significant financial entities, through national programmes such as TIBER-FR.

Status checked 2026-11-04. Dates can move; confirm with the official sources below.