In brief
- Regulation: DORA.
- Credit institutions are financial entities fully subject to DORA.
- Establishing an ICT risk management framework.
- Manage and notify incidents.
- Test resilience.
- DORA falls under a prudential regime: competent authorities hold powers of supervision, injunction, and sanction.
Regulatory deadlines
The key dates of this regulation.
January 2023
Entry into force
In forceJanuary 2025
Application
In forceWhat does DORA cover?
DORA harmonises the digital operational resilience requirements across the entire European financial sector. It is structured around five pillars: ICT risk management, ICT-related incident management and reporting, digital operational resilience testing, third-party ICT provider risk management, and information-sharing arrangements.
A proportionality principle applies: a simplified framework exists for certain small, non-interconnected entities.
Is the 'Banking' sector in scope?
Credit institutions are financial entities fully subject to DORA. The regulation covers all of their activities relying on information systems, as well as their relationships with ICT third-party service providers.
Proportionality modulates the intensity of obligations according to size and risk profile, but the framework applies to all banks.
Detailed obligations
Establish an ICT risk management framework.
Document a risk management strategy and ICT risk management policies, covering identification of critical functions, protection, detection, response and recovery, under the responsibility of the management body.
Manage and notify incidents
Classify ICT-related incidents by severity and notify major incidents to the competent authorities within the required timeframes and formats.
Test resilience
Implement a testing programme (vulnerabilities, scenarios) and, for significant entities, threat-led penetration testing (TLPT).
Manage ICT third-party risks.
Maintain a provider information register, govern contracts (audit rights, reversibility, sub-contracting, data location) and monitor concentration risk.
Share information
Participate, where applicable, in cyber threat information-sharing arrangements.
Sanctions & risks
DORA falls under a prudential regime: competent authorities have supervisory, injunctive and sanctioning powers. ICT third-party providers designated as critical may be subject to periodic penalty payments of up to 1% of their average daily worldwide turnover.
Beyond the penalty, a lack of resilience exposes organisations to supervisory measures and a major systemic and reputational risk.
Application timeline
- 1Application. DORA has been applicable since 17 January 2025.
- 2Information register. Periodic reporting of the ICT third-party provider register to authorities.
Common mistakes in the sector
- 1Confusion with NIS2. Duplicating measures when DORA prevails for ICT risk.
- 2Incomplete register. Failing to exhaustively inventory ICT service providers and subcontracting.
- 3Theoretical tests. Having an untested testing programme.
- 4Absent governance. Treating DORA as a purely technical matter.
Practical case
A bank maps its ICT providers and discovers a heavy concentration on a single cloud vendor for critical functions. Under DORA, it documents this concentration risk, strengthens reversibility clauses, and integrates the provider into its information register and testing programme — turning a blind spot into a controlled risk management framework.
Compliance roadmap
- 1
Structuring the ICT framework. Formalise ICT risk strategy, policies and governance.
- 2
Tooling incidents. Implement classification and notification of major incidents.
- 3
Schedule testing. Define a testing programme and, if significant, prepare for TLPT.
- 4
Maintain the register. Build the information register and frame supplier contracts.
- 5
Govern. Have the governing body own the framework.
Frequently asked questions
Yes, as financial entities, with a proportionality principle and a simplified framework for certain small non-interconnected entities.
Take action on DORA
Free assessment or a chat with an expert dedicated to bank.
They already trust us
See how organisations in the bank sector secured their compliance with DCO.