DORA compliance, without the guesswork

DORA applies to more than 22,000 financial entities across 21 categories — banks, payment and e-money institutions, investment firms, insurers, crypto-asset service providers, pension funds, trading venues, CCPs, CSDs, asset managers and crowdfunding platforms — plus their critical ICT third-party providers. Some smaller, non-interconnected investment firms and payment institutions qualify for simplified requirements.

ICT risk management, incident reporting, digital operational resilience testing, ICT third-party risk management, and information sharing.

For a major ICT-related incident: initial notification within 4 hours of classification, an intermediate report within 72 hours, and a final report within one month.

You need a Register of Information covering every ICT arrangement, and contracts with critical providers must include Article 30 clauses such as audit rights and exit plans. Some providers can also be designated as "critical" for direct oversight by EU supervisors.

There's no single EU-wide fine cap for financial entities — each Member State sets its own maximum. Designated critical ICT third-party providers face fines of up to 1% of average daily worldwide turnover, accruable for up to six months. Management body members can also be held personally liable under Article 50(5).

Yes. DORA has applied in full since 17 January 2025. Supervisors are now auditing Register of Information quality, running the first TLPT cycles, folding DORA into the ECB's SREP process, and querying incident-classification errors — enforcement has moved from paperwork to active scrutiny.