In plain words
Think of DORA as fire safety rules for the technology inside financial firms. It is not enough to own a fire extinguisher. You need a plan, regular drills, a way to raise the alarm quickly, and checks on the landlord who runs the building.
DORA, the Digital Operational Resilience Act, is Regulation (EU) 2022/2554. It has applied since 17 January 2025 across the whole EU, as one rulebook rather than different national versions. 1 It requires financial firms to manage information and communication technology (ICT) risk, report major incidents, test their resilience and keep control of the tech suppliers they depend on.
Before DORA, these expectations were scattered across guidelines for different kinds of firm. DORA puts them in one law, with the same core rules for a bank, an EMI, a payment institution or a crypto firm, scaled to their size.
How it works
How DORA works inside a firm
A cycle the firm runs all the time, not a one-off project.
-
1
Map and protect
The management body approves an ICT risk framework. The firm maps its systems, data and the business functions that depend on them, and protects them.
-
2
Detect and report
Incidents are logged and classified. Major ones are reported to the national regulator in stages, starting within hours.
-
3
Test
The firm tests its systems regularly. The most significant firms also run threat-led penetration tests.
-
4
Control the suppliers
Every ICT supplier contract goes on a register, with required terms, monitoring and an exit plan. This is where vendors feel DORA most.
The five pillars of DORA
ICT risk management
A documented framework owned by the board: identify, protect, detect, respond and recover, with backups and business continuity plans.
Incident reporting
Classify ICT incidents by set criteria and report major ones to the regulator in an initial, intermediate and final report.
Resilience testing
A risk-based testing programme, from vulnerability scans to scenario tests. Firms identified as significant run threat-led penetration testing (TLPT), usually every three years.
Third-party risk
A register of all ICT contracts, due diligence before signing, required contract clauses, concentration risk checks and exit strategies.
Information sharing
Firms may share threat intelligence with each other through trusted arrangements. This pillar is voluntary.
Small and less complex firms, such as some smaller payment institutions, can use a simplified ICT risk framework. The other duties still apply in proportion to their size. 2
One practical duty catches many firms out: the register of information. It lists every contract with an ICT supplier, which business functions it supports and which subcontractors sit behind it, and firms must submit it to their regulator. Building it means knowing your supply chain in detail.
What DORA means for tech suppliers
DORA regulates financial firms, not their suppliers. But it makes the firm responsible for its suppliers, so the rules arrive through the contract.
What EU clients will ask a supplier for
- Clear service levels and where services and data are located
- Rights to audit and access for the client and its regulator
- Prompt notice of incidents that affect the client
- Help with the client’s resilience testing
- Exit and transition support if the contract ends
- Details of the supplier’s own subcontractors
What DORA does not do
- License or certify suppliers
- Move the client’s responsibility to the supplier
- Require a specific certificate such as ISO 27001
- Supervise ordinary suppliers directly
The exception is critical ICT third-party providers. The EU financial supervisors (the EBA, EIOPA and ESMA) can designate the largest providers, typically major cloud and data services, as critical and oversee them directly through a lead overseer. 2
DORA, the UK and the Gulf
| Market | What applies | What it means for you |
|---|---|---|
| European Union | DORA, directly, since 17 January 2025 1 | Any EU-licensed financial firm must comply, including an EU subsidiary of a UK group |
| United Kingdom | FCA and PRA operational resilience rules, outsourcing rules, and a separate regime for critical third parties 3 | DORA does not apply to UK-only firms, but similar ideas do. UK suppliers to EU firms meet DORA through contracts |
| Gulf | No DORA equivalent. Regulators set their own cyber, outsourcing and continuity rules, such as the SAMA Cyber Security Framework | Map the local rules separately. DORA-ready controls help, but do not prove local compliance |
Many UK groups with an EU-licensed entity run one set of controls and map both the UK and the EU rules onto it, rather than keeping two separate programmes. For the UK side of this picture, read UK launch readiness beyond the FCA checklist.
Example: a UK supplier signs an EU client
Tom runs a UK company that provides a card management tool. A Lithuanian EMI wants to use it.
- Due diligence. The EMI sends a questionnaire on security, incident handling, data location and subcontractors, and asks for his ISO 27001 certificate or SOC 2 report and a recent penetration test.
- Contract. The contract adds audit rights, incident notice, service levels, help with testing and an exit plan, as DORA requires.
- Register. The EMI records Tom’s service in its register of ICT contracts and rates how critical it is.
- Incident. An outage stops card controls for an hour. Tom notifies the EMI straight away with a timeline, so the EMI can decide whether it is a major incident to report.
Common misconceptions
“DORA is only for big banks.”
It covers most EU financial firms, including payment institutions, EMIs and crypto firms. Smaller firms get proportionate rules, not an exemption.
“We are a UK company, so DORA is not our problem.”
If you have EU clients in finance, or an EU-licensed entity, DORA reaches you through contracts or directly.
“Our cloud provider handles DORA for us.”
The financial firm stays responsible. The provider’s certificates help, but your own risk framework, testing and exit plans do not come with them.
FAQ
What is DORA in simple terms?
DORA is an EU law that makes banks, payment firms, e-money institutions, crypto firms, insurers and other financial firms manage their technology risks properly. It covers IT risk management, incident reporting, resilience testing and oversight of tech suppliers.
When did DORA come into force?
DORA, Regulation (EU) 2022/2554, entered into force in January 2023 and has applied since 17 January 2025. Firms in scope must comply now.
Who does DORA apply to?
It applies to most types of EU financial firm, including credit institutions, payment and e-money institutions, investment firms, crypto-asset service providers under MiCA and insurers. Smaller firms get a lighter, proportionate version of some rules.
Does DORA apply to UK companies?
Not directly to UK firms serving only the UK. But a UK firm with an EU-licensed entity must comply there, and a UK tech supplier to EU financial firms will see DORA requirements in its contracts and audits.
Does DORA apply to software vendors?
Indirectly, yes. EU financial firms must put specific terms into contracts with their ICT suppliers and monitor them. The largest providers can be designated critical and supervised directly by the EU financial authorities.
What is the difference between DORA and NIS2?
NIS2 is a broad EU cyber security directive covering many sectors. DORA is the specific rulebook for the financial sector, and for financial firms in its scope it takes priority where the two overlap.
Related terms
Sources
-
1
EL
EUR-Lex Regulation (EU) 2022/2554 on digital operational resilience for the financial sector
https://eur-lex.europa.eu/eli/reg/2022/2554/oj -
2
E
EIOPA Digital Operational Resilience Act (DORA)
https://www.eiopa.europa.eu/digital-operational-resilience-act-dora_en -
3
FC
Financial Conduct Authority Operational resilience
https://www.fca.org.uk/firms/operational-resilience
