As DORA entered into application in January 2025, supervisory authorities have been granted substantial enforcement powers to ensure compliance. This article examines the penalty framework, supervisory powers, and strategies for managing enforcement risk.

DORA Enforcement Authority

Who Has Enforcement Power?

Multiple authorities have enforcement responsibilities under DORA:

  • National Competent Authorities (NCAs): Primary enforcement for financial entities within their jurisdiction
  • European Supervisory Authorities (ESAs): Direct enforcement over critical ICT third-party service providers
  • Coordinated Action: Joint investigations and enforcement in cross-border cases

Dual Enforcement Framework

DORA creates two enforcement tracks:

  • Financial Entities: Supervised and sanctioned by NCAs
  • Critical ICT Third-Party Providers: Subject to direct ESA oversight and penalties

Penalty Framework for Financial Entities

Maximum Penalties

NCAs can impose administrative pecuniary penalties on financial entities of up to:

  • 2% of total annual worldwide turnover of the financial entity in the preceding business year for the most serious infringements
  • Penalties must be effective, proportionate, and dissuasive
  • Member states may set higher maximum levels

Penalty Considerations

When determining penalties, authorities consider:

  • Gravity and Duration: Seriousness and length of the infringement
  • Degree of Responsibility: Culpability and intent of the entity
  • Financial Strength: Resources of the sanctioned entity
  • Economic Benefit: Gains derived from the infringement
  • Cooperation: Level of cooperation with authorities
  • Previous Infringements: History of non-compliance
  • Measures Taken: Remedial actions implemented

Penalties for Critical ICT Third-Party Providers

ESA Enforcement Powers

For critical ICT third-party service providers (CTPPs), the ESAs can impose:

  • Periodic Penalty Payments: Up to 1% of average daily worldwide turnover for continued non-compliance
  • Fines: Up to €5 million or maximum set by member state law for specific violations

Sanctionable Violations by CTPPs

ESAs can penalize CTPPs for:

  • Failure to comply with ESA recommendations
  • Non-cooperation with oversight activities
  • Refusal to provide requested information
  • Obstruction of inspections
  • Failure to implement required remedial measures
  • Violations of specific DORA requirements applicable to CTPPs

Types of Enforcement Actions

Administrative Measures

Before imposing penalties, authorities may take measures including:

  • Warnings: Formal notice of non-compliance
  • Directives: Orders to cease specific practices
  • Remediation Requirements: Mandates to implement specific controls
  • Restrictions: Limitations on activities or business
  • Enhanced Supervision: Increased reporting and monitoring

Public Disclosure

DORA requires publication of penalties, with potential reputational impact:

  • Penalties and measures must be published on the authority's website
  • Publication includes identity of offender and nature of breach
  • Information remains public for minimum five years
  • Anonymous publication possible in exceptional circumstances

Supervisory Powers

Investigative Powers

NCAs and ESAs possess extensive investigative authority:

  • Document Requests: Comprehensive information gathering rights
  • Onsite Inspections: Access to premises and systems
  • Interviews: Summoning and questioning of personnel
  • Expert Appointments: Engaging specialists for assessments
  • Third-Party Information: Gathering data from service providers

Reporting Obligations

Financial entities must report to NCAs:

  • Major ICT-related incidents (within specified timeframes)
  • Register of ICT third-party service providers
  • Results of digital operational resilience testing
  • Material changes to ICT risk profile
  • Significant third-party dependencies

Most Common Enforcement Triggers

Based on Early Enforcement Activity

Supervisors are focusing initial enforcement on:

  1. Incident Reporting Failures: Missing or late incident notifications
  2. Inadequate ICT Risk Management: Insufficient frameworks or governance
  3. Third-Party Compliance: Contracts lacking required DORA clauses
  4. Testing Deficiencies: Inadequate resilience testing programs
  5. Governance Gaps: Lack of board oversight or clear accountability

Red Flag Indicators

Situations likely to attract enforcement attention:

  • Repeated ICT incidents without remediation
  • Major incidents unreported or reported late
  • Complete absence of key DORA requirements
  • Refusal to provide information to supervisors
  • Material misrepresentation of compliance status
  • Egregious third-party risk management failures

Managing Enforcement Risk

Proactive Compliance

Reduce enforcement exposure through:

  • Comprehensive Programs: Address all DORA pillars systematically
  • Documentation: Maintain detailed evidence of compliance efforts
  • Self-Assessment: Regular gap analyses and remediation
  • Board Engagement: Active senior management and board oversight
  • Resource Allocation: Adequate investment in compliance capabilities

Incident Management

For ICT incidents:

  • Report promptly within required timeframes
  • Provide accurate and complete information
  • Conduct thorough root cause analysis
  • Implement effective remediation
  • Document lessons learned and improvements

Third-Party Relationships

Minimize third-party risk exposure:

  • Ensure all contracts include required DORA clauses
  • Conduct comprehensive due diligence
  • Implement ongoing monitoring programs
  • Maintain exit strategies and contingency plans
  • Document decision-making and risk acceptance

Responding to Enforcement Actions

Upon Receipt of Supervisory Letter

If you receive enforcement communication:

  1. Assess Immediately: Understand the allegations and requirements
  2. Assemble Team: Include legal, compliance, IT, and business representatives
  3. Document Everything: Maintain detailed records of all actions
  4. Investigate Thoroughly: Determine facts and root causes
  5. Respond Promptly: Meet all response deadlines

Response Strategy

Effective responses typically include:

  • Acknowledgment: Recognize the issue without unnecessary admissions
  • Factual Basis: Provide objective analysis of circumstances
  • Remediation Plan: Detail specific corrective actions
  • Timeline: Commit to realistic completion dates
  • Governance: Demonstrate management and board engagement
  • Resources: Show commitment of adequate resources

Challenging Penalties

Entities have the right to:

  • Judicial review of enforcement decisions
  • Appeal penalty amounts and conditions
  • Request reconsideration based on mitigating factors
  • Present evidence of remediation efforts

Lessons from Early Enforcement Cases

Observed Patterns

Early enforcement activity reveals:

  • Focus on Fundamentals: Authorities prioritizing basic compliance over sophistication
  • Incident Reporting: Strict enforcement of notification timelines
  • Documentation: Heavy emphasis on evidence and records
  • Proportionality: Larger penalties for larger institutions
  • Repeat Offenders: Escalating enforcement for persistent non-compliance

Mitigating Factors

Authorities have shown leniency when:

  • Entity self-reported issues proactively
  • Genuine efforts at compliance were evident
  • Immediate remediation was undertaken
  • Cooperation with investigators was full and transparent
  • No customer harm or systemic risk resulted

Industry Coordination

Consistency in Enforcement

ESAs are working to ensure:

  • Harmonized interpretation of DORA across member states
  • Consistent penalty levels for similar violations
  • Coordinated enforcement in cross-border cases
  • Sharing of supervisory experiences and findings

Precedent Development

Watch for emerging enforcement precedents:

  • Published decisions establishing standards
  • Supervisory statements on expectations
  • Industry guidance based on enforcement trends
  • Case law from judicial reviews

Beyond Regulatory Penalties

Additional Consequences of Non-Compliance

Beyond fines, entities face:

  • Reputational Damage: Public disclosure of penalties
  • Market Access Restrictions: Limitations on business activities
  • Increased Costs: Enhanced monitoring and remediation expenses
  • Competitive Disadvantage: Customer and investor concerns
  • Personal Liability: Potential action against individual managers

Cyber Insurance Implications

DORA non-compliance may affect:

  • Insurance eligibility and coverage
  • Premium levels
  • Policy exclusions for regulatory penalties
  • Claims outcomes for covered incidents

Best Practices for Compliance Assurance

Three Lines of Defense

Implement robust assurance:

  • First Line: Business and IT operational compliance
  • Second Line: Compliance and risk oversight functions
  • Third Line: Internal audit independent assessment

Ongoing Monitoring

  • Regular compliance assessments
  • Key performance and risk indicators
  • Management information reporting
  • Board-level oversight and attestation

Key Takeaways

  • DORA enforcement is now active with significant penalty potential
  • Financial entities face fines up to 2% of annual worldwide turnover
  • Critical ICT providers subject to €5 million penalties and periodic payments
  • Authorities have extensive investigative and enforcement powers
  • Incident reporting and third-party management are enforcement priorities
  • Proactive compliance and documentation are best defenses
  • Cooperation and remediation can mitigate penalties
  • Public disclosure of penalties creates reputational risk

Conclusion

The DORA enforcement framework is designed to ensure meaningful compliance across the financial sector. With substantial penalties possible and active supervisory programs underway, financial institutions must treat DORA compliance as a critical priority. The best approach is proactive, comprehensive compliance backed by thorough documentation and continuous improvement. In the event of enforcement action, cooperation, transparency, and swift remediation are essential to managing outcomes.