DORA Regulation 2025: Compliance Guide for Financial Entities and Fintech

The Digital Operational Resilience Act (Regulation (EU) 2022/2554, DORA) has applied to all EU financial entities since 17 January 2025. Covering approximately 22,000 entities across banking, insurance, investment management, payments and crypto-assets, DORA introduces five binding pillars of digital operational resilience that are now being actively supervised by national competent authorities across the EU.

Which entities must comply with DORA?

DORA Article 2 defines the scope. Covered entities include: credit institutions (banks, credit cooperatives), payment institutions and e-money institutions, investment firms and UCITS management companies, alternative investment fund managers, insurance and reinsurance undertakings, crowdfunding service providers, crypto-asset service providers (CASPs) under MiCA, and credit rating agencies. ICT third-party service providers that serve these entities are also subject to DORA's oversight framework when designated as critical by the European Supervisory Authorities (EBA, ESMA, EIOPA).

DORA applies proportionality: microenterprises and small non-complex entities can apply the simplified ICT risk framework under Art. 16 for some Chapter II requirements. However, the incident notification framework (Chapter III) and the third-party risk management contracts (Art. 30) apply to all entities without simplification.

What are the 5 DORA pillars?

1. ICT Risk Management (Chapter II, Arts. 5–15): A documented ICT risk management framework approved by the management body. Covers asset inventory classified by criticality, information security policy, protection controls (MFA for critical systems, encryption, patch management with SLAs), continuous detection (SIEM), business continuity (BCP/DRP with annually tested RTO/RPO) and at least annual independent review.
2. ICT Incident Management and Reporting (Chapter III, Arts. 17–23): Register of all ICT incidents, classification of major incidents per RTS criteria, and mandatory reporting to the national supervisor: initial alert within 4 hours, intermediate report within 72 hours, final report within 1 month.
3. Digital Operational Resilience Testing (Chapter IV, Arts. 24–27): Annual basic testing (vulnerability assessments, penetration tests) for all entities. Systemically important entities identified by supervisors: Threat-Led Penetration Testing (TLPT) every 3 years.
4. ICT Third-Party Risk Management (Chapter V, Arts. 28–44): Register of all ICT contracts. Mandatory contractual clauses (Art. 30) for providers supporting important or critical functions. Enhanced oversight of ICT third-party providers designated as critical by the ESAs.
5. Information Sharing Arrangements (Chapter VI, Art. 45): Voluntary participation in sector-level cyber threat intelligence sharing platforms.

What are the DORA incident notification timelines?

How does DORA apply proportionality for small fintech firms?

A small payment institution or a crowdfunding platform does not face the same requirements as a systemically important bank. DORA Article 4 establishes the proportionality principle. Article 16 and Delegated Regulation 2024/1773 (RTS on the simplified ICT risk framework) define the conditions under which smaller entities can apply reduced requirements for Chapter II. However, the following apply without simplification to all entities regardless of size: incident classification and reporting (Arts. 17–23), mandatory contractual clauses with ICT providers (Art. 30), and submission of the ICT third-party register to the supervisor (ITS 2024/2956).

Frequently asked questions about DORA

Does DORA replace NIS2 for financial entities?

Largely yes. DORA is lex specialis for the financial sector and supersedes NIS2 requirements in the area of digital operational resilience for in-scope entities. NIS2 remains relevant for financial entities that also operate non-financial critical infrastructure or digital services. Entities should check with legal counsel whether their specific activities trigger dual obligations.

When did supervisory inspections under DORA begin?

National competent authorities began DORA supervisory assessments from Q1 2025. Systemically important entities were the first to receive information requests. On-site inspections are expected to materialise during 2026 for entities unable to demonstrate documentary compliance. The EBA, ESMA and EIOPA have published supervisory expectations and Q&A guidance.

How are "major" ICT incidents defined under DORA?

The classification criteria for major incidents are set in the joint EBA/EIOPA/ESMA RTS. They include: number of clients affected, financial impact (direct and indirect losses), duration of service disruption, geographic scope, type and sensitivity of data compromised, and whether a critical service is involved. Entities must document their real-time incident classification process internally.

Can AWS, Azure or Google Cloud be designated as critical ICT providers?

Yes. The ESAs (EBA, ESMA, EIOPA) have the authority to designate ICT third-party service providers as critical (CTPP) if their systemic importance to EU financial markets exceeds certain concentration thresholds. Designated providers are subject to direct ESA oversight, including on-site inspections, and face recurring fines of up to €5 million per month for non-compliance with ESA recommendations.

What are the DORA RTS and why do they matter?

The Regulatory Technical Standards (RTS) are delegated regulations that flesh out DORA's technical requirements. The main ones are: RTS 2024/1774 (ICT risk management tools — asset register fields, patch SLAs, cryptography), RTS 2024/1773 (simplified framework for small entities), and ITS 2024/2956 (standardised templates for the ICT third-party register). They are directly binding and came into force with DORA on 17 January 2025.

How does IgeraLegal support DORA compliance?

IgeraLegal is a RAG compliance assistant that answers DORA questions by citing the exact article of the Regulation and applicable RTS. It generates 5-pillar implementation checklists tailored to entity type and size, ICT risk management policy templates, contractual clause models for ICT providers, and the third-party ICT register in ITS 2024/2956 format. Each answer is delivered in under 5 seconds, with the source article clearly cited.