{"id":5081,"date":"2026-10-21T16:39:44","date_gmt":"2026-10-21T14:39:44","guid":{"rendered":"https:\/\/naaia.ai\/?p=5081"},"modified":"2026-11-05T16:40:10","modified_gmt":"2026-11-05T15:40:10","slug":"dora-financial-sector","status":"publish","type":"post","link":"https:\/\/naaia.ai\/en\/dora-financial-sector\/","title":{"rendered":"DORA: Understanding the EU Regulation on Digital Operational Resilience for the Financial Sector"},"content":{"rendered":"\n

Credit transfers, securities clearing, insurance underwriting, lending: financial operations are now entirely digital. This reliance on information systems exposes banks, insurers, investment firms and payment providers to new risks, where an outage or a cyberattack can halt business overnight. In response, the European Union adopted DORA<\/strong>, the regulation on digital operational resilience for the financial sector<\/strong>.<\/p>\n\n\n\n

The regulation goes beyond cybersecurity. It makes the management body responsible for ICT risk, harmonises incident reporting, requires regular testing and sets rules for the use of technology providers.<\/p>\n\n\n\n

This article covers the scope of the regulation, its six pillars and its implementing texts.<\/p>\n\n\n\n

1. DORA: a regulation for the digital resilience of finance<\/h2>\n\n\n\n

1.1. Key facts<\/h3>\n\n\n\n

Regulation (EU) 2022\/2554<\/a>, the Digital Operational Resilience Act (DORA) of 14 December 2022, has applied since 17 January 2025 in all EU Member States, with no need for national transposition. It is accompanied by Directive (EU) 2022\/2556<\/a>, which brings eight sectoral directives into line with it.<\/p>\n\n\n\n

The NIS 2 Directive, the EU\u2019s general cybersecurity framework, gives way to sector-specific legislation that imposes requirements of at least equivalent effect. DORA meets this condition for financial entities: ICT risk management, incident reporting and supervision are governed by its rules.<\/p>\n\n\n\n

NIS 2 nonetheless keeps a residual role. It still applies to financial sector entities outside DORA\u2019s scope, and to obligations that DORA does not cover.<\/p>\n\n\n\n

1.2. Why the European Union adopted it<\/h3>\n\n\n\n

In the digital age, financial entities have become highly interconnected and heavily dependent on information and communication technologies (ICT). As a result, an incident at any one of the EU\u2019s roughly 22,000 financial entities can easily spread to others and affect the entire banking, financial and insurance sector. Before DORA, rules on incidents, testing and providers varied from one country to another. The aim is therefore to harmonise the applicable rules across the EU for this sector.<\/p>\n\n\n\n

2. Who does DORA apply to?<\/h2>\n\n\n\n

2.1. The 20 categories of financial entities<\/h4>\n\n\n\n

The regulation lists twenty categories of financial entities, from retail banks to insurance brokers.<\/p>\n\n\n\n

Area<\/th>Entities covered<\/th><\/tr><\/thead>
Banking and payments<\/td>credit institutions; payment institutions; account information service providers; electronic money institutions<\/td><\/tr>
Markets and investment<\/td>investment firms; crypto-asset service providers and issuers of asset-referenced tokens; central securities depositories; central counterparties; trading venues; trade repositories; alternative investment fund managers; management companies; data reporting service providers<\/td><\/tr>
Insurance and pensions<\/td>insurance and reinsurance undertakings; insurance, reinsurance and ancillary insurance intermediaries; institutions for occupational retirement provision<\/td><\/tr>
Other players<\/td>credit rating agencies; administrators of critical benchmarks; crowdfunding service providers; securitisation repositories<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

2.2. ICT third-party service providers<\/h3>\n\n\n\n

A twenty-first category completes the list: ICT third-party service providers, which supply digital and data services on an ongoing basis. Examples include a data centre host, a cloud computing provider or the vendor of an institution\u2019s core banking software.<\/p>\n\n\n\n

2.3. Exclusions and proportionality<\/h3>\n\n\n\n

DORA excludes certain entities from its scope. These include institutions for occupational retirement provision with no more than fifteen members, and small insurance intermediaries.<\/p>\n\n\n\n

For everyone else, requirements are scaled to size and risk profile. A brokerage firm with five employees, classed as a microenterprise, falls under a lighter regime, while a systemically important bank applies the full set of requirements laid down by the regulation.<\/p>\n\n\n\n

3. The six pillars of DORA<\/h2>\n\n\n\n

3.1. ICT risk management<\/h3>\n\n\n\n

The management body bears ultimate responsibility: it approves the resilience strategy, allocates the budget and receives regular training. The risk management framework is documented and reviewed at least once a year. It relies on an independent control function and on business continuity, backup and recovery plans.<\/p>\n\n\n\n

3.2. Incident management and reporting<\/h3>\n\n\n\n

Incidents are logged and then classified against six criteria: clients affected, duration, geographical spread, data losses, criticality of services and economic impact. An outage of a few hours in the credit transfer service that prevents thousands of clients from making payments would be classified as a major incident. It must then be reported to the competent authority in three stages: initial notification, intermediate report and final report.<\/p>\n\n\n\n

3.3. Resilience testing<\/h3>\n\n\n\n

Systems that support critical functions are tested at least once a year: vulnerability assessments, performance testing and end-to-end testing. Entities designated by the authorities must also carry out threat-led penetration testing (TLPT) at least every three years. TLPT replicates the methods of real attackers on live production systems.<\/p>\n\n\n\n

3.4. Third-party risk management<\/h3>\n\n\n\n

Each entity keeps a register of all its arrangements with ICT providers and, before signing any contract, checks the safeguards on offer. It assesses concentration risk: hosting critical applications with the same cloud provider as the rest of the market creates a dependency that regulators monitor. The entity remains responsible for complying with DORA, even when it outsources.<\/p>\n\n\n\n

3.5. Oversight of critical providers<\/h3>\n\n\n\n

The European Supervisory Authorities designate the providers deemed critical to the financial system, such as a major cloud service provider. A Lead Overseer, chosen from among the European Banking Authority (EBA), the European Insurance and Occupational Pensions Authority (EIOPA) and the European Securities and Markets Authority (ESMA), can investigate, carry out on-site inspections and issue recommendations.<\/p>\n\n\n\n

3.6. Information sharing<\/h3>\n\n\n\n

The regulation encourages entities to share cyber threat intelligence on a voluntary basis, in line with competition law and the GDPR.<\/p>\n\n\n\n

4. A three-level regulatory framework<\/h2>\n\n\n\n

The regulation and the amending directive make up level 1.<\/p>\n\n\n\n

Regulatory technical standards (RTS) and implementing technical standards (ITS) make up level 2. They specify:<\/p>\n\n\n\n