DORA for payment institutions and e-money issuers: operational resilience for transaction flows, safeguarding accounts, and SCA-protected fraud controls.
What is your licence status?
Applies whatever your size, calibrated by the proportionality principle of Article 4. A small authorised institution cannot elect the simplified framework of Article 16.
Next step: DORA Gap AnalysisApplies by operation of law to institutions exempted under PSD2 Article 32 or E-money Directive Article 9. Article 16 replaces Articles 5 to 15 only: incident reporting and ICT third-party risk still apply, proportionately (Article 4(2)).
Next step: DORA Compliance ChecklistAISPs are listed on their own in Article 2(1)(c) and are not on the closed list of Article 16, so the full framework applies, calibrated by proportionality (Article 4).
Next step: DORA Gap AnalysisNot sure your entity is a financial entity at all? Run the free scope determination.
Payment institutions (PIs) and electronic money institutions (EMIs) authorised or registered under PSD2 and the E-money Directive, including institutions benefiting from the small-institution exemptions, are explicitly in scope of DORA (Article 2(1)(b) and (d) of Regulation (EU) 2022/2554) and have been bound by its requirements since 17 January 2025. Because their entire business model runs on always-on digital transaction processing, card scheme connectivity and real-time fraud screening, ICT availability and integrity are not back-office concerns but the core of the regulated service itself.
DORA replaces the previously fragmented ICT expectations with a single, directly applicable framework covering ICT risk management, incident reporting, digital operational resilience testing, third-party risk and information sharing. The PSD2 major-incident reporting channel has been switched off for DORA entities (Article 96(7) PSD2, inserted by Directive (EU) 2022/2556), the EBA has repealed its Guidelines on major incident reporting under PSD2 and narrowed its Guidelines on ICT and security risk management (EBA/GL/2025/02, applicable since 20 May 2025), and the EBA Guidelines on outsourcing arrangements remain relevant only for non-ICT outsourcing. For PIs and EMIs the practical challenge is mapping the five DORA pillars onto distinctive operational realities: safeguarding of client funds, dependency on BIN sponsors and acquirers, networks of agents and distributors, and strong customer authentication (SCA) infrastructure.
Under Article 2(1)(b) and (d) of DORA, payment institutions and electronic money institutions are financial entities in their own right, and the Regulation says so expressly for institutions benefiting from the small-institution exemptions of PSD2 Article 32 and E-money Directive Article 9: they are in scope too. Account information service providers are listed separately at Article 2(1)(c). Authorisation status therefore determines which ICT risk management framework applies, not whether DORA applies. Exempted (registered) PIs and EMIs apply the simplified framework of Article 16, detailed in Delegated Regulation (EU) 2024/1774, by operation of law. Authorised PIs and EMIs, and AISPs, apply the full framework of Articles 5 to 15 whatever their size, calibrated through the proportionality principle of Article 4 and the specific reliefs the Regulation grants to microenterprises. There is no interconnectedness test and no opt-in: a small authorised PI cannot elect Article 16, and an exempted institution is not pushed into the full framework because it connects to card schemes. Passporting, EU branches and group membership change none of this.
National competent authorities under PSD2 (for example BaFin, ACPR, Banca d'Italia, DNB, CBI) supervise the DORA compliance of the payment and e-money institutions they authorise or register. The three ESAs (EBA, EIOPA, ESMA) draft the DORA technical standards jointly and run the Oversight Framework for designated critical ICT third-party providers; the EBA remains the standard-setter for the PSD2 conduct, strong customer authentication and fraud-reporting rules that continue to apply.
DORA is lex specialis for ICT risk. Directive (EU) 2022/2556 amended PSD2 so that Chapter II of DORA governs ICT and security risk management for every PSD2 payment service provider that is a DORA financial entity, exempted institutions included (new subparagraph in Article 95(1)), and so that the PSD2 major incident reporting regime no longer applies to them (Article 96(7)). The EBA drew the consequences: its Guidelines on major incident reporting under PSD2 (EBA/GL/2021/03) were repealed with effect from the application of DORA, and its Guidelines on ICT and security risk management (EBA/GL/2019/04) were amended by EBA/GL/2025/02, applicable since 20 May 2025, so that for DORA entities only the requirements on the relationship with payment service users remain. PSD2 continues to govern licensing, conduct, strong customer authentication (RTS on SCA and CSC under Article 98, Delegated Regulation (EU) 2018/389) and safeguarding of funds, and PSD2 fraud reporting under EBA/GL/2018/05 stays live. PSD3 and the Payment Services Regulation, whose final texts were agreed by the co-legislators in April 2026, will replace PSD2 for licensing and conduct 18 months or more after their publication in the Official Journal, which was still awaited when this pack was revised; they defer to DORA for ICT risk, so the resilience obligations described in this pack do not change with them.
Six obligations that play out differently in your sector. Open a card for the detail.
Articles 5 to 15, detailed in Delegated Regulation (EU) 2024/1774, require a board-approved ICT risk management framework that maps the end-to-end transaction lifecycle: authorisation, clearing, settlement and reconciliation. For PIs/EMIs this means inventorying ICT assets that touch card scheme gateways, payment processors and core ledgers, and assigning protection, detection and recovery controls proportionate to the criticality of payment continuity. Exempted institutions apply the simplified framework of Article 16 to the same payment chain, with lighter governance and documentation.
Client funds must be safeguarded under PSD2 Art. 10 / EMD Art. 7, and the ICT systems that calculate, reconcile and protect safeguarded balances qualify as supporting a critical or important function under DORA. Loss of integrity or availability in the safeguarding ledger is a resilience event, so it must be covered by business impact analysis, RTO/RPO targets, and the digital operational resilience testing programme.
Strong customer authentication, 3-D Secure and transaction risk analysis engines are ICT systems whose downtime directly blocks legitimate payments and exposes the firm to fraud. DORA requires these authentication and fraud-monitoring components to be subject to the same protection, monitoring, and resilience-testing controls as core processing, while PSD2 RTS on SCA & CSC continues to dictate the authentication logic itself.
Networks of agents (PSD2 Art. 19) and e-money distributors extend the firm's ICT perimeter to endpoints and onboarding flows it does not fully control. DORA obliges the institution to manage ICT risk arising from these channels, including identity and access management, data protection at the edge, and incident detection covering agent-facing systems, even though the agents themselves are not the regulated entity.
Many PIs/EMIs depend on a BIN sponsor, a single acquirer, or card schemes (Visa, Mastercard) and processors that are de facto unsubstitutable. Articles 28 to 30 require these dependencies to be recorded in the Register of Information (Implementing Regulation (EU) 2024/2956 templates, collected by the competent authority on an annual cycle), assessed for concentration and exit risk, and governed by contracts meeting Article 30, with subcontracting chains handled under Delegated Regulation (EU) 2025/420 and realistic exit and stressed-scenario planning for providers that cannot be quickly replaced. The ESAs designated the first critical ICT third-party providers in November 2025; a designation changes the provider's oversight, not the institution's own obligations.
Articles 24 to 27 require a risk-based testing programme; for most PIs/EMIs this means vulnerability scans, scenario-based recovery tests of payment and safeguarding systems and penetration testing, while Threat-Led Penetration Testing (TLPT, Delegated Regulation (EU) 2025/1190, aligned with TIBER-EU) applies only to entities identified by their authorities on the basis of systemic importance and risk profile. Smaller PIs/EMIs should document why TLPT does not apply and still evidence robust functional and recovery testing.
8 questions drawn from the requirements above. Each gap you declare comes back with the course that covers it and the tool that does the work. Your answers stay in this browser.
Has your management body approved an ICT risk management framework (full or Article 16) that covers authorisation, clearing, settlement and reconciliation?
Are the systems that calculate and reconcile safeguarded funds covered by a business impact analysis with RTO and RPO targets?
Can your incident desk classify an ICT-related incident against the criteria of Delegated Regulation (EU) 2024/1772 and file the initial notification within 4 hours of classifying it as major?
Do you know which payment-fraud events are also ICT security incidents, so that both the DORA report and the PSD2 fraud report are filed?
Are your BIN sponsor, acquirer, card schemes and processors recorded in your Register of Information?
Do your contracts with ICT third-party service providers contain the Article 30 clauses, with an exit plan for the providers you cannot replace quickly?
Do you test payment and safeguarding systems under a documented, risk-based programme, and have you recorded whether TLPT applies to you?
Does your management body follow regular, specific ICT risk training, and do all staff complete digital operational resilience training (Articles 5(4) and 13(6), or 16(1)(h) if exempted)?
You declared 0 areas to work on, gaps first. Each one names what to learn and what to use.
Indicative self-assessment based on your own answers, not a compliance opinion. Prices exclude VAT.
Three reports to your competent authority, each with its own clock. Enter two times to see your deadlines.
Within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it.
Enter the classification timeWithin 72 hours of submitting the initial notification, and updated when the situation changes.
Follows the initial notificationWithin one month of the latest intermediate report, once the root cause analysis is complete.
Follows the intermediate reportDelegated Regulation (EU) 2025/301, Article 5; classification under Delegated Regulation (EU) 2024/1772. The later deadlines assume each report goes in at its latest permissible time. A deadline falling on a weekend or bank holiday moves to noon of the next working day (Article 5(4)), except for the initial notification and intermediate report of credit institutions, central counterparties, operators of trading venues and essential or important entities under NIS2, or where your competent authority has decided otherwise (Article 5(5) and (6)); the dates shown do not apply that extension.
Under Article 19 DORA, Delegated Regulation (EU) 2024/1772 (classification criteria and materiality thresholds) and Delegated Regulation (EU) 2025/301 with Implementing Regulation (EU) 2025/302 (content, timelines and templates), PIs and EMIs classify ICT-related incidents on clients and counterparts affected, transactions affected, duration and service downtime, geographical spread, data losses, criticality of services and economic impact, and report major incidents to their competent authority in three steps: initial notification within 4 hours of classifying the incident as major and no later than 24 hours after becoming aware of it, intermediate report within 72 hours of the initial notification, final report within one month of the intermediate report. This DORA channel replaces the former PSD2 Article 96 filing, which Article 96(7) PSD2 disapplies for DORA entities and whose EBA Guidelines (EBA/GL/2021/03) have been repealed. Firms must still preserve PSD2 fraud reporting (EBA/GL/2018/05) and recognise the overlap where a payment-fraud event is simultaneously an ICT security incident, triggering both a DORA notification and PSD2 fraud statistics. Significant cyber threats may be notified voluntarily under Article 19(2).
The person who classifies an incident starts the reporting clock: the initial notification is due within 4 hours of classifying it as major. Your outsourcing manager negotiates Article 30 clauses with a BIN sponsor or an acquirer you cannot replace overnight. Your management body approves the ICT risk management framework and has to keep its own knowledge current. Each of these roles needs to know what DORA expects of it on payment rails, and to be able to show it.
Members of the management body must “actively keep up to date with sufficient knowledge and skills” to understand and assess ICT risk, including by following specific training on a regular basis.
Regulation (EU) 2022/2554, on EUR-Lex Article 13(6) · All staffICT security awareness programmes and digital operational resilience training are “compulsory modules” of staff training, for all employees and senior management, at a level that matches each function.
Regulation (EU) 2022/2554, on EUR-LexUnder the simplified framework of Article 16, the same duty comes from Article 16(1)(h): ICT security awareness programmes and digital operational resilience training for staff and management, according to needs and ICT risk profile.
Owns the DORA programme, the full or Article 16 framework decision and the evidence file your competent authority will ask for.
The first lesson is open to read before you buy.
Classifies outages of card gateways, SCA or safeguarding systems against Delegated Regulation (EU) 2024/1772 and drafts the initial, intermediate and final reports.
The first lesson is open to read before you buy.
Handles BIN sponsors, acquirers, schemes and processors: Register of Information, Article 30 clauses, concentration and exit plans.
The first lesson is open to read before you buy.
Sets RTO and RPO for payment and safeguarding systems and runs the continuity and recovery tests that evidence them.
The first lesson is open to read before you buy.
Approves the ICT risk management framework and must keep its ICT risk knowledge current, including through specific training (Article 5(4); Article 16(1)(h) if exempted).
The first lesson is open to read before you buy.
For payment & e-money institutions: compliance, incident reporting, third-party oversight and continuity for high-availability rails.
Several people to train? Team seats cost less per learner from 2 seats, on one invoice: see team pricing.
Starting out? DORA Fundamentals is free, certificate included.
The tools that matter most for your sector, and what each one does for you.
Draft the initial notification for a card-gateway or SCA outage, with the 4-hour, 72-hour and one-month deadlines computed.
Open Free to build · export licence €249 a yearEnter sponsors, acquirers, schemes and processors in the ITS templates and run the validation rules before the annual collection.
Open FreeTest a past outage against the major-incident criteria of Delegated Regulation (EU) 2024/1772.
Open FreeScore your ICT third-party service providers and see which ones need an exit plan first.
Open FreeMeasure your position on the five pillars in ten minutes and get a prioritised list of gaps.
Open €149Set MTPD, RTO and RPO for safeguarding and processing systems in one workbook.
OpenAll tools: browse the full list. Prices exclude VAT.
Everything tailored to your sector, ready to use on day one.
Yes. Payment institutions and electronic money institutions are named financial entities in Article 2(1)(b) and (d) of DORA, and the text adds "including payment institutions exempted pursuant to Directive (EU) 2015/2366" and "including electronic money institutions exempted pursuant to Directive 2009/110/EC". Account information service providers are listed at Article 2(1)(c). All have been bound since 17 January 2025; passporting, EU branches and group membership change nothing. What your status changes is the framework: authorised institutions apply Articles 5 to 15, exempted ones apply Article 16.
Only if it is an exempted institution. Article 16(1) lists, for the payments sector, payment institutions exempted under PSD2 Article 32 and electronic money institutions exempted under E-money Directive Article 9: they apply the simplified framework by operation of law, as detailed in Delegated Regulation (EU) 2024/1774. An authorised PI or EMI cannot opt in, however small: it applies the full framework and calibrates it through Article 4 proportionality and the microenterprise reliefs. The "small and non-interconnected" criterion that is often quoted belongs to investment firms (Article 12 of the Investment Firms Regulation) and has no bearing on payment institutions.
Directive (EU) 2022/2556 inserted Article 96(7) into PSD2: the major operational or security incident reporting of Article 96(1) to (5) no longer applies to payment service providers that are DORA financial entities, exempted PIs and EMIs included. The EBA repealed its Guidelines on major incident reporting under PSD2 (EBA/GL/2021/03) accordingly. You now file once, through the DORA channel, using the classification criteria of Delegated Regulation (EU) 2024/1772 and the 4-hour / 72-hour / one-month sequence and templates of Delegated Regulation (EU) 2025/301 and Implementing Regulation (EU) 2025/302. PSD2 fraud reporting under EBA/GL/2018/05 continues separately.
The legal safeguarding obligation stays under PSD2 Art. 10 / EMD Art. 7, but the ICT systems that compute, reconcile and protect safeguarded client balances support a critical or important function and are therefore squarely within DORA. You must include them in your asset inventory, business impact analysis, recovery objectives, and resilience testing, treating a loss of safeguarding-ledger integrity as a reportable resilience risk.
TLPT under Articles 26-27 applies only to financial entities identified by competent authorities as significant for financial stability or based on their role and risk profile; the majority of PIs and EMIs will not be designated. You should still run a full risk-based testing programme (vulnerability assessments, scenario and recovery tests, and penetration testing of payment, SCA and safeguarding systems), and keep documentation explaining why TLPT does or does not apply to you.
DORA Articles 28-30 require you to record these dependencies in the Register of Information, assess concentration and substitutability risk, and ensure contracts include the mandatory provisions on access, audit, sub-outsourcing, exit and incident cooperation. Where a provider is genuinely hard to substitute, you must document a realistic exit strategy and stressed continuity scenarios rather than relying on the assumption that the service will always be available.
No. The final PSD3 and PSR texts were agreed by the European Parliament and the Council in April 2026 and were awaiting publication in the Official Journal when this pack was revised; most provisions apply 18 months or more after entry into force. They reshape licensing, conduct, fraud liability and open banking, and fold e-money institutions into the payment institution regime, but they leave ICT risk, incident reporting, resilience testing and third-party risk to DORA. Plan the PSD3 transition on top of a stable DORA baseline, and re-check your DORA status if your licence category changes.
Need the full risk view? See the Risk Assessment Toolkits or compare all kits. All prices exclude VAT; an EU VAT invoice is issued at checkout. Professional templates, not legal advice.
Workbooks, playbooks and certifications built for EU financial entities. Add several to your cart: volume discounts apply automatically.
Take our free 5-minute assessment and get an instant DORA compliance score with personalised recommendations.