DORA Regulation — Expert Consulting for Financial Entities Across Europe

The Digital Operational Resilience Act (DORA) Regulation (EU) 2022/2554 is a binding EU regulation that establishes uniform requirements for the security and resilience of ICT systems across the financial sector. Its purpose is to ensure that financial entities and their critical technology partners can withstand, respond to, and recover from ICT-related disruptions, including cyberattacks and system failures. As a regulation (not a directive), it applies directly in all 27 EU member states without requiring transposition into national law.

DORA covers more than 20 categories of financial entities, including banks, investment firms, payment institutions, electronic money institutions, insurance and reinsurance undertakings, crypto-asset service providers, central securities depositories, central counterparties, trading venues, credit rating agencies, and crowdfunding service providers. It also applies to ICT third-party service providers that serve these entities. The regulation has extraterritorial reach: it applies based on where services are delivered to EU financial entities, regardless of where the provider is headquartered.

DORA entered into force on 16 January 2023 and became fully enforceable on 17 January 2025. All covered entities are required to comply now. The ESAs have published the regulatory technical standards (RTS) and implementing technical standards (ITS) that specify the detailed requirements for compliance.

DORA's penalty framework operates at two levels. For financial entities, Article 50 requires each member state to establish its own administrative penalties for DORA breaches. These vary significantly across the EU. A DLA Piper analysis from October 2025 found that turnover-based penalty ceilings range from 5% of annual turnover (Spain) to 10% (Sweden), while absolute ceilings range from €2 million (Czech Republic) to €20 million (Italy). Penalties can also be imposed on individual members of the management body, with ceilings ranging from €100,000 (Finland) to €5 million (Germany). For Critical Third-Party Providers, the penalties are set directly by DORA itself: Article 35 empowers the Lead Overseer (one of the three ESAs) to impose periodic penalty payments of up to 1% of the provider's average daily worldwide turnover, applied daily for up to six months until compliance is achieved. Beyond financial penalties, regulators can issue binding recommendations, require remedial actions, mandate audits at the entity's expense, and, in severe cases, require financial entities to suspend or terminate arrangements with non-compliant ICT providers.

ICT providers are affected in two ways. Indirectly, all providers serving the financial sector face increased contractual scrutiny, as their financial entity clients are required under DORA to include specific mandatory provisions in their contracts, conduct thorough due diligence, and exercise audit rights. Directly, providers designated as "critical" by the ESAs are subject to the DORA Oversight Framework, which gives the Lead Overseer powers to request information, conduct investigations and on-site inspections, issue recommendations, and impose penalty payments. In November 2025, the ESAs published the first list of 19 designated Critical Third-Party Providers. Non-EU providers designated as critical must establish an EU subsidiary within 12 months of designation.

DORA is lex specialis (more specific law) in relation to the NIS 2 Directive for the financial sector. This means that while financial entities technically fall within the scope of NIS2, they must comply with DORA's more specific and more stringent requirements. In areas where NIS2 provisions are more specific than DORA, NIS2 applies supplementarily.

DORA and ISO 27001 serve different purposes but are highly complementary. ISO 27001 provides a framework for establishing an Information Security Management System (ISMS), while DORA sets legally binding requirements specifically for digital operational resilience in the financial sector. An organisation that already holds ISO 27001 certification will find that many of the foundational risk management, incident management, and governance controls overlap with DORA's requirements, which can significantly reduce the effort needed to achieve compliance. However, DORA introduces requirements that go beyond ISO 27001, particularly around TLPT, third-party oversight with mandatory contractual provisions, specific incident reporting timelines, and management body accountability.

Threat-Led Penetration Testing (TLPT) is an advanced form of security testing required by DORA for financial entities identified as significant by their competent authorities. Unlike standard penetration testing, TLPT simulates the tactics, techniques, and procedures of real threat actors against live production systems. It must be conducted at least every three years by qualified external testers, following the TIBER-EU framework. The scope and conduct of each TLPT exercise must be coordinated with the relevant competent authority.

Yes. DORA incorporates a proportionality principle, meaning requirements must be applied in proportion to the entity's size, risk profile, and the complexity of its operations. Microenterprises (fewer than 10 employees, turnover or balance sheet below €2 million) are subject to a simplified framework. Certain entities are fully exempt, including managers of alternative investment funds below specific asset thresholds and small insurance undertakings. However, even exempt or simplified-framework entities should assess their position carefully, as their contractual relationships with larger financial entities may still be affected by DORA's third-party risk requirements.

Start with a scope assessment to confirm whether and how DORA applies to your organisation, taking proportionality into account. Then secure formal board-level support and budget. DORA explicitly requires management body involvement, so this is not optional. Conduct a detailed gap analysis comparing your existing ICT risk management framework, incident reporting procedures, testing programme, and third-party contracts against all five DORA pillars. Develop a prioritised remediation plan with clear responsibilities and timelines. Review and renegotiate third-party contracts to include DORA's mandatory provisions. Finally, formalise governance structures for ongoing ICT risk oversight, and plan for the continuous improvement that DORA requires.