What is DORA regulation?

DORA applies to 20 types of financial entities. For banks and asset managers, the list in Article 2(1) names credit institutions, investment firms, managers of alternative investment funds and management companies. It also covers payment and e-money institutions, insurers, trading venues, central counterparties, crypto-asset service providers and others. Article 2(3) exempts some small firms, such as insurance intermediaries that are micro, small or medium-sized enterprises.

Is DORA a regulation or a directive? It is a regulation. The text is "binding in its entirety and directly applicable in all Member States" (Article 64), so the same rules apply in Frankfurt and in Vienna without national transposition.

The 5 pillars of DORA are its Chapters II to VI. The chapter titles name the areas, and together they set the DORA compliance requirements for banks and the other financial entities. Chapter II asks for an ICT risk management framework.

ICT risk in DORA is "any reasonably identifiable circumstance in relation to the use of network and information systems" that may compromise the security of those systems, of operations or of the provision of services (Article 3(5)). The definition includes adverse effects "in the digital or physical environment".

A major ICT-related incident is one with "a high adverse impact" on the systems that support critical or important functions (Article 3(10)). Firms classify each incident and report the major ones to their competent authority.

DORA third-party risk management starts with responsibility: a financial entity that uses ICT services stays "fully responsible" for compliance (Article 28(1)). Before it signs a contract, it assesses whether the service supports a critical or important function and identifies the risks, including concentration risk (Article 28(4)). It reports new ICT arrangements to its authority at least yearly (Article 28(3)).

Among the DORA requirements for ICT providers, the strictest apply to critical ones. The European Supervisory Authorities, EBA, EIOPA and ESMA, designate the ICT third-party service providers that are critical for financial entities and appoint one of the three as Lead Overseer for each (Article 31). The Lead Overseer can impose a daily penalty of up to 1% of the provider's average daily worldwide turnover to enforce its measures (Article 35(8)).

The main purpose of DORA is "a high common level of digital operational resilience" in the EU financial sector, through uniform requirements for the security of the network and information systems of financial entities (Article 1(1)).

DORA vs NIS2: Directive (EU) 2022/2555 (NIS2) sets cybersecurity rules for many sectors. For financial entities that NIS2 classifies as essential or important, DORA is the sector-specific Union act (Article 1(2)); recital 16 calls DORA "lex specialis" to NIS2.

As a regulation, DORA is law in Germany without a national act of transposition, and BaFin supervises it. BaFin states that financial firms of all sectors have had to apply DORA since January 17, 2025, and it receives the reports of major ICT-related incidents. EIOPA, one of the three European Supervisory Authorities that designate critical ICT third-party providers and act as their Lead Overseers, has its seat at Westhafenplatz 1 in Frankfurt am Main. The three authorities published their first list of designated critical providers on November 18, 2025. In Austria the DORA-Vollzugsgesetz (BGBl. I Nr. 112/2024) names the FMA as the competent authority under Article 46 of DORA (§ 2) and regulates its cooperation with the Oesterreichische Nationalbank (§ 5).

Switzerland is outside the EU, so DORA does not apply there. FINMA Circular 2023/1 "Operational risks and resilience: banks" has applied since January 1, 2024. It covers ICT, critical data and cyber risks and adopts the Basel Committee principles on operational resilience of March 2021. This page gives no legal advice.