Digital Operations Resilience Act (DORA) Regulation
Digital Operations Resilience Act (DORA) Regulation
Ensuring the Cyber Resilience of Financial Institutions.
What is DORA?
A harmonized framework for ICT risk management in the financial sector
The Digital Operational Resilience Act (Regulation (EU) 2022/2554) is a regulatory framework established to improve the cybersecurity and operational resiliency of the financial services sector. It complements existing laws such as the Network and Information Security Directive (NISD) and the General Data Protection Regulation (GDPR).
The Digital Operational Resilience Act (DORA), known as the “lex specialis” of NIS2, was introduced by the European Commission in 2020 and aims to strengthen the operational “resilience” of the financial sector in the European Union. It extends and unifies existing European standards and requirements to create a detailed and harmonized framework.
The concept of “resilience” introduces a paradigm shift. It requires companies in the financial sector to organize from the outset to ensure effective management of breakdowns and cyber-attacks.
DORA is based on three fundamental principles: Risk and Incident Management in Information Technology and Cybersecurity, Operational Resilience Management and Information Sharing.
The Digital Operational Resilience Act (DORA) is expected to come into force on January 17, 2025. This date marks a significant milestone for financial institutions, which will need to comply with the new requirements set out in the legislation.
DORA applies, among others, to credit institutions, payment institutions, crypto-asset service providers, insurance and reinsurance companies, asset managers, and third-party ICT service providers.
DORA is not a one-time compliance exercise, but a requirement to maintain constant resilience in an evolving environment and an increasingly complex technological context.
Why DORA matters
A paradigm shift: resilience at the heart of financial regulation
No other sector exemplifies the growing tension between digital transformation and cyber vulnerability more than finance. Every day, banks, insurers, neobanks, and asset managers operate on the edge of a digital cliff. 46% of cyberattacks directly target banks. In 2025, the financial industry alone experienced thousands of cyber incidents, with nearly a thousand resulting in confirmed data breaches.
Behind these figures lies a harsh reality: the threat is constant, multifaceted, and often invisible until the damage is done. Over half of cyberattacks are financially motivated. Even more concerning, credential theft has now overtaken phishing as the primary entry point in many intrusions.
46%
of cyberattacks directly target banks.
While ransomware continues to spread, attackers relentlessly evolve their tactics—faster than traditional defenses can adapt.
Who is affected by DORA?
Financial entities and critical third-party ICT service providers
The DORA regulation broadens its scope to include new types of financial entities. It applies to a wide range of financial sector actors operating within the European Union, divided into several categories defined in Article 2 of the regulation.
Two main types of actors are concerned:
-
Regulated financial entities: DORA requires these organizations to implement a robust framework for managing risks related to information and communication technologies (ICT), including cybersecurity, business continuity, and oversight of critical third-party service providers.
-
Critical third-party ICT service providers: As soon as they deliver essential services to one or more financial entities, these providers become indirectly subject to certain DORA obligations, particularly through contractual clauses imposed by their clients.
Banking & Payment
- Credit institutions
- Payment institutions
- Account information service providers
- Data communication service providers
- Electronic money institutions
- Third-party providers of information and communication technology (“ICT”)
Finance
- Investment firms
- Crypto-asset service providers licensed on crypto-asset markets and issuers of tokens referring to one or more assets
- Asset management companies
- Alternative investment fund managers
- Participatory finance service providers
- Central securities depositories
- Central counterparties
- Trading platforms
- Trade repositories
- Securitization repositories
- Credit rating agencies
- Administrators of critical benchmarks
Insurance
- Insurance and reinsurance companies
- Insurance intermediaries, reinsurance intermediaries and incidental insurance intermediaries
- Institutions for occupational retirement provision
Key principles of DORA
Resilience built on risk management, incident response, testing, third-party oversight, and information sharing
DORA is not a “one-off” compliance exercise, but a demand to maintain constant resilience in a changing environment and an increasingly complex technological context.
The Digital Operational Resilience Act (DORA) regulations are divided into five categories, each designed to enhance different aspects of cybersecurity in organizations. The main components include:
ICT Risk Management
DORA requires a comprehensive framework for managing ICT-related risks as the foundation for the resilience of financial companies. The governing body assumes ultimate responsibility for managing the ICT-related risk of the financial entity.
Management of Incidents
DORA strengthens incident management in ICT by implementing detection, classification, and mandatory reporting of major incidents, as well as encouraging voluntary reporting of significant cyber threats to authorities.
Cybersecurity Testing
A risk-based approach ensures that critical and important IT systems are regularly tested for their operational resilience and protection against potential disruptions. For instance, a threat-based penetration test must be conducted at least every three years on production systems.
3P Risk Management
DORA mandates detailed record-keeping of all contracts with ICT service providers, particularly highlighting those critical to operations, and sets minimum standards for risk monitoring. It also establishes a European-level framework to oversee critical third-party service providers.
Information sharing
The regulation enables financial firms to exchange cyber threat information among themselves and to receive and act on anonymized threat data provided by the supervisory authority. The aim is to develop defensive capabilities and detection techniques.
DORA Compliance and Licensing Risk for Financial Entities
Non-compliance with DORA: A Major Risk to the License of Financial Entities
Unlike the NIS2 directive, the DORA regulation does not establish a standalone penalty regime with specific fines. However, this does not mean that financial entities can afford partial or delayed compliance.
DORA: A Regulation Embedded at the Core of Financial Law
DORA is not an additional layer on top of banking or insurance regulations—it is fully integrated into them.
It is legally embedded within the framework of key European financial texts (CRR, MiFID II, PSD2, Solvency II…), as explicitly stated in Article 3 of the regulation.
Thus, any financial entity is required to comply with DORA just as it must with other sectoral regulations that govern its licensing.
Failure to Comply with DORA Has Serious Consequences
Non-compliance with DORA is not limited to isolated financial penalties—it can directly endanger an entity’s authorization to operate:
-
An entity failing to meet the obligations of the regulation, particularly concerning the management of critical ICT third-party providers (Article 28.1.a), may have its license suspended or revoked.
-
Article 3.22 explicitly states that failing to meet legal obligations—now including DORA—can lead to the loss of authorization to operate.
-
Article 50 empowers national competent authorities to impose any corrective measures deemed necessary, including the immediate cessation of non-compliant activities or financial penalties, with no upper limit.
Case of Critical ICT Third-Party Providers
ICT providers designated as critical may be subject to daily fines of up to 1% of their global annual turnover, continuing until compliance is restored (Article 35).
Prepare for DORA now
A trusted partner for financial institutions to ensure resilience and compliance
Eligibility for DORA
The DORA is a complex regulation that may overlap with other applicable regulations (NIS2, …)
We help you by organizing targeted workshops, training sessions, and updates to assist you in understanding DORA.
We define the scopes affected by DORA compliance and conduct an initial impact analysis. We also identify your critical assets.
Gap Analysis
It is important to identify the main gaps in your maturity to ensure an effective resilience plan.
We analyze the gaps between the measures already in place and the 480 DORA requirements through guided interviews and document analyses.
We ensure a correlation between DORA requirements and major international cybersecurity standards (NIST, CIS Controls, ISO 27001, etc.).
Roadmap
Remediation
Benefits of aligning DORA with cybersecurity standards
In the financial sector, compliance with DORA and major cybersecurity standards (NIST, CIS Controls, ISO, etc.) mitigates the risks associated with online transactions and data breaches, thereby enhancing trust and ensuring business continuity. Financial institutions must pay particular attention to DORA’s strict requirements regarding operational resilience and third-party ICT risk management.
Unified Approach
Security standards offer globally recognized best practices. Aligning DORA with these standards ensures consistent management of cybersecurity and compliance.
Simplified Management
Organizations can simplify their management processes by leveraging existing infrastructure and resources. Management can be conducted through user-friendly tools.
Efficiency
Clear guidelines facilitate prioritization of efforts and allocation of resources based on the importance and impact of each control.
Scalability & Adaptability
Standards can be selected and adapted according to the size, activity, and challenges of the organization. Aligning them with DORA ensures cybersecurity measures remain flexible in the face of regulatory and technological changes.
Ongoing enhancement
Cybersecurity standards incorporate the concept of continuous improvement. By aligning them with DORA, organizations can keep their cybersecurity measures up to date against new threats.
