DORA Frequently Asked Questions

DORA is an EU regulation that establishes a comprehensive set of requirements for financial institutions to manage ICT risks, ensure digital operational resilience, and test their readiness for cyber threats. It applies to banks, insurance companies, payment institutions, and other financial service providers across the EU.

DORA has applied since 17 January 2025. Financial entities have had to be fully compliant from that date, and competent authorities have been assessing compliance since 2025. The Regulation applies to all regulated financial entities in the EU.

The 5 pillars of DORA are: (1) Governance and Risk Management Framework, (2) Incident Management, (3) Digital Operational Resilience Testing, (4) Third-Party Risk Management, and (5) Information Sharing.

TLPT (threat-led penetration testing) simulates the tactics of real threat actors against the live production systems that support several or all of a financial entity's critical or important functions (DORA Article 26(2)). It is not required of every financial entity: competent authorities identify the entities that must perform it (Article 26(8)), and those entities test at least every 3 years, a frequency the competent authority may increase or reduce (Article 26(1)). Testers must meet the requirements of Article 27. Internal testers are allowed with the competent authority's approval, provided external testers are used every three tests; credit institutions classified as significant must use external testers only (Article 26(8)).

DORA does not set an EU-wide maximum fine for financial entities. Article 50 requires each Member State to give its competent authorities the power to impose administrative penalties and remedial measures, and leaves the amount to national law, so the ceiling depends on where the entity is supervised. The only turnover-based percentage set by DORA itself applies to designated critical ICT third-party providers: periodic penalty payments of 1% of average daily worldwide turnover (Article 35). Member States may also provide for criminal penalties (Article 52).

Yes, DORA applies to all financial institutions regulated under EU financial services regulations, including small entities. However, smaller institutions may benefit from proportionality principles in implementation, with extended timelines for certain requirements like TLPT.

RTS (regulatory technical standards) and ITS (implementing technical standards) are drafted jointly by the three European Supervisory Authorities (EBA, EIOPA and ESMA) through their Joint Committee, then adopted by the European Commission as delegated or implementing regulations. Once published in the Official Journal they are binding and directly applicable. RTS specify the substance of DORA requirements, such as the criteria for classifying ICT-related incidents; ITS set uniform formats and procedures, such as the templates of the Register of Information.

Cloud services are ICT services under DORA, so the contract rules of Article 30 apply. Every contract must carry the nine elements of Article 30(2), including the regions or countries where data is processed and stored, with advance notice of any change, and termination rights. Where the cloud service supports a critical or important function, Article 30(3) adds unrestricted access, inspection and audit rights and an exit strategy with a mandatory transition period, and Article 28(8) requires the financial entity to have an exit strategy. The largest providers can be designated as critical ICT third-party providers and overseen by an EU Lead Overseer, which does not change the clauses the contract needs.

Major ICT incidents follow a three-stage reporting sequence to the competent authority: an initial notification within 4 hours of classifying the incident as major (and no later than 24 hours after becoming aware of it), an intermediate report within 72 hours, and a final report within one month. Reports must include the incident classification, impact assessment, affected systems, financial impact, client implications, and the remediation measures being taken.

Begin by conducting a comprehensive gap analysis against DORA requirements, establish governance structures, inventory critical ICT systems, assess third-party dependencies, implement necessary controls, establish incident management procedures, and conduct testing to ensure readiness.

Financial entities must classify ICT-related incidents and notify those that qualify as "major" using the criteria in RTS (EU) 2024/1772: clients/financial counterparts affected, reputational impact, duration and service downtime, geographical spread, data losses, criticality of services affected, and economic impact. An incident is major when it has affected critical services and either a successful, malicious and unauthorised access that may result in data losses has occurred, or two or more of the other materiality thresholds are met (Article 8(1)). Significant cyber threats may be reported voluntarily. Major incidents trigger the 4-hour, 72-hour and 1-month reporting clock.

For a major ICT-related incident: an initial notification is due within 4 hours of classifying it as major (and no later than 24 hours after detection), an intermediate report within 72 hours of the initial notification, and a final report no later than 1 month after the latest intermediate report. Reports are submitted to the competent authority using the templates in RTS/ITS (EU) 2025/301 and 2025/302.

The Register of Information (DORA Article 28(3)) is a machine-readable register of all contractual arrangements for ICT services provided by third parties. Entities report it annually to their national competent authority in xBRL-CSV format using the 15 templates of ITS (EU) 2024/2956. The ESAs use the aggregated data to designate Critical ICT Third-Party Providers and assess concentration risk. Most 2026 national deadlines fall at the end of Q1 2026.

A Critical or Important Function (DORA Article 3(22)) is a function whose disruption would materially impair an entity's financial performance, the soundness or continuity of its services, or its compliance with authorisation conditions. CIF identification is the cornerstone of DORA: it drives Register of Information flagging, third-party contractual obligations, TLPT scope and incident classification.

TLPT applies to financial entities identified by competent authorities based on their systemic importance and ICT risk profile, not to every entity. Designated entities must run intelligence-led red-team tests on live critical systems at least every 3 years, following the TIBER-EU framework, using qualified threat-intelligence and red-team providers.

DORA is a lex specialis for the EU financial sector and prevails over NIS2 for the ICT risk of in-scope financial entities. NIS2 is the broader cross-sector cybersecurity directive. Where both could apply, financial entities follow DORA for ICT risk management, incident reporting and third-party oversight, while NIS2 continues to cover sectors and activities outside DORA's scope.

DORA Article 30 works in two tiers, set by the function the ICT service supports rather than by who the provider is. Article 30(2) requires nine elements in every ICT contract: a full description of the services and of any permitted subcontracting, service and data locations, data protection, access to and return of data on exit or insolvency, service level descriptions, incident assistance, cooperation with competent and resolution authorities, termination rights with minimum notice periods in line with the expectations of those authorities, and participation in security awareness and resilience training. Article 30(3) adds six elements when the service supports a critical or important function: quantified service levels, notice and reporting obligations, tested business contingency plans and security measures, participation in threat-led penetration testing, unrestricted access, inspection and audit rights, and an exit strategy with a mandatory transition period. A provider's designation as a critical ICT third-party provider does not change which clauses apply.

DORA does not publish a single official checklist, but compliance maps to its 5 pillars: ICT risk management governance, incident management and classification, digital operational resilience testing (including TLPT where applicable), ICT third-party risk and the Register of Information, and information sharing. Our free interactive checklist covers 45 control points across these pillars.

On 18 November 2025 the European Supervisory Authorities published the first list of 19 designated critical ICT third-party service providers (CTPPs), including the major cloud hyperscalers, data centre and telecommunications operators, IT services companies, and financial data and technology providers. Each is overseen by a Lead Overseer (EBA, EIOPA or ESMA), which can request information, run investigations and inspections, and issue recommendations (Article 35). Designation does not change the Article 30 clauses a financial entity needs: those depend on whether the service supports a critical or important function. The one CTPP-specific condition for financial entities is Article 31(12): a CTPP established in a third country must set up a subsidiary in the Union within 12 months of its designation for financial entities to keep using it.