Digital Operational Resilience Act (DORA)

The Digital Operational Resilience Act (Regulation 2022/2554) — known as DORA — entered into force on 16 January 2023 and has been applicable since 17 January 2025. It creates a unified regulatory framework for digital operational resilience across the EU financial sector, replacing a patchwork of national rules.

DORA applies to virtually all regulated financial entities: credit institutions, payment institutions, electronic money institutions, investment firms, crypto-asset service providers, central securities depositories, trading venues, central counterparties, insurance and reinsurance undertakings, insurance intermediaries, institutions for occupational retirement provision, credit rating agencies, statutory auditors, and crowdfunding service providers. Critically, it also brings ICT third-party service providers (including cloud providers) under direct regulatory oversight.

The regulation establishes five core pillars. First, ICT risk management: financial entities must maintain a comprehensive and well-documented ICT risk management framework covering identification, protection, detection, response, recovery, and learning from ICT-related incidents.

Second, ICT-related incident management: entities must classify and report major ICT-related incidents to their competent authority using standardised templates. Initial notification must be submitted within 4 hours of classification, an intermediate report within 72 hours, and a final report within one month.

Third, digital operational resilience testing: all entities must conduct regular testing of ICT systems, including vulnerability assessments, open-source analysis, network security assessments, and gap analyses. Large, systemically important entities must also conduct advanced threat-led penetration testing (TLPT) at least every three years using the TIBER-EU framework.

Fourth, ICT third-party risk management: entities must manage risks from ICT service providers throughout the lifecycle — from selection and contracting through monitoring and exit. All contracts with ICT providers must include specific clauses on performance, data location, audit rights, and exit strategies.

Fifth, information sharing: the regulation encourages voluntary sharing of cyber threat intelligence among financial entities to enhance collective situational awareness.

The European Supervisory Authorities (EBA, ESMA, EIOPA) are empowered to develop Regulatory Technical Standards (RTS) and to directly oversee critical ICT third-party service providers designated by the ESAs.