Digital Operational Resilience Act (DORA)

Applied January 2025. Unified ICT risk management, incident reporting, and resilience testing for EU financial entities including banks, insurers, investment firms, and crypto-asset providers.

JurisdictionEuropean Union
CategoryFinancial Services
StatusActive
Effective date
Latest development

Analysis

DORA is an EU regulation that applies from 17 January 2025 and sets uniform, binding requirements for ICT risk management, incident reporting, resilience testing, and third‑party ICT oversight for a broad range of EU financial entities and their critical ICT providers.Digital Operational Resilience Act (DORA) – ESMADigital Operational Resilience Act (DORA) – EIOPARegulation (EU) 2022/2554 – EUR‑Lex

Key Requirements

According to Regulation (EU) 2022/2554 (DORA) and supervisory guidance, the core requirements fall into five main pillars.Regulation (EU) 2022/2554 – EUR‑LexDigital Operational Resilience Act (DORA) – AMF FranceDigital Operational Resilience Act (DORA) – PwC

Compliance Challenges

Implementation Best Practices

  • Tools and Resources
  • Many institutions leverage GRC platforms and vendor‑risk tools that

Recent developments

  • — Industry commentary highlights that with DORA fully in application since January 2025, supervisory focus in 2026 has shifted to **enforcement readiness**, with firms prioritising closing residual gaps in ICT risk management, incident reporting, and third‑party ICT contracts, and vendors seeing increased contract re‑negotiations and due‑diligence demands.[2] (source)
  • — EIOPA updates its DORA page to emphasise that the regulation is now **fully applicable** and reminds insurers and other financial entities of the need to demonstrate operational resilience around ICT disruptions, including cyberattacks and third‑party failures, across the 20+ in‑scope financial entity types.[1] (source)
  • — ESMA publishes updated DORA implementation information stressing that, after the 17 January 2025 application date, national competent authorities are intensifying reviews of firms’ ICT risk frameworks, incident reporting processes and testing programmes, and reiterates the harmonised approach for 21 categories of financial entities.[6] (source)
  • — Baker McKenzie analysis outlines how DORA’s obligations on **ICT risk management, incident reporting, resilience testing, third‑party risk management, and information‑sharing** are now being operationalised by EU financial entities, with particular focus on governance changes and the build‑out of incident classification and reporting processes.[3] (source)
  • — Mayer Brown reports that DORA’s entry into application is driving extensive remediation projects in banks, insurers, investment firms and crypto‑asset service providers, especially around asset inventories, business continuity plans, and **contractual overhauls** for critical ICT service providers under Articles 30(2) and 30(3).[7] (source)
  • — Proofpoint notes that, following DORA’s go‑live, financial institutions are tightening controls around cyber‑incident detection and reporting timelines, and are reassessing contracts with ICT vendors that support critical or important functions to comply with the new third‑party risk and notification requirements.[4] (source)
  • — Sector update explains that post‑January‑2025, DORA is consolidating previously fragmented ICT‑risk rules into a single regime, prompting firms to integrate cyber, technology, and operational‑risk teams and to launch **threat‑led penetration testing** and enhanced monitoring as part of their resilience testing programmes.[2] (source)
  • — Baker McKenzie highlights that supervisors in several EU states are issuing DORA implementation expectations, and that financial entities are experiencing increased board‑level focus, with boards being briefed on their accountability for ICT governance, outsourcing oversight, and incident‑response capabilities under DORA.[3] (source)
  • — ESMA confirms that DORA now **applies as of 17 January 2025**, underlining that common EU‑wide standards for ICT risk management and incident reporting are in force and will be backed by coordinated supervision across securities markets, fund managers, and other ESMA‑remit entities.[6] (source)
  • — EIOPA marks DORA’s application date, stressing that it is a “game changer” for operational resilience in the financial sector and that firms must now be able to withstand, respond to and recover from ICT disruptions, with harmonised rules replacing previous patchwork national requirements.[1] (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates