Financial sector · DORA

Financial sector — DORA: the common resilience foundation

DORA is the common denominator across the entire financial sector: all financial entities have been subject to it since 17 January 2025. This guide provides a cross-cutting overview of the text; the 'Banking' and 'Insurance' pages cover sector-specific requirements. This guide details the scope, the five pillars, and the proportionality principle.

DPO / CISO team — Data Comply One Updated on 15 June 2026

In brief

  • Regulation: DORA.
  • All financial entities listed by DORA are concerned, as well as their third-party ICT providers (governed by contract, or even supervised if they are critical).
  • ICT risk management framework.
  • Incident management and notification.
  • Resilience tests.
  • Prudential framework: supervisory and sanctioning powers of authorities; periodic penalty payments possible for critical ICT providers (up to 1% of average daily worldwide turnover).

Regulatory deadlines

The key dates of this regulation.

January 2023

Entry into force

In force

January 2025

Application

In force

What does DORA cover?

DORA harmonises the digital operational resilience of the entire European financial sector. Its scope is broad: credit, insurance, investment, payment, electronic money, crypto-assets, and trading platforms, among others.

Five pillars structure the text, with a proportionality principle and a simplified framework for certain smaller entities.

Is the 'Financial sector' concerned?

All financial entities listed by DORA are concerned, as well as their third-party ICT providers (governed by contract, or even supervised if they are critical).

Proportionality adjusts the intensity according to size and risk profile.

Detailed obligations

ICT risk management framework

ICT risk strategy, policies, and governance under management responsibility.

Incident management and notification

Classify and notify major ICT incidents to the authorities.

Resilience testing

Testing programme and, for significant systems, TLPT.

ICT provider risks.

Information register and contractual framework (audit, reversibility, subcontracting).

Information sharing

Participation in cyber-threat information-sharing schemes.

Sanctions & risks

Prudential framework: supervisory and sanctioning powers of authorities; periodic penalty payments possible for critical ICT providers (up to 1% of average daily worldwide turnover).

Application timeline

  • 1Application. Since 17 January 2025 for all financial entities.
  • 2Register. Periodic reporting to authorities.

Common mistakes in the sector

  • 1Confusion with NIS2. Duplicate the systems.
  • 2Incomplete register. Omitting service providers or subcontracting arrangements.
  • 3Theoretical tests. Unproven programme.
  • 4Absent governance. Treating DORA as purely technical.

Practical case

A payment institution structures its DORA compliance by formalising its ICT risk framework, building its information register of service providers and planning its tests, with governance driven at management level.

Compliance roadmap

  1. 1

    Structuring the ICT framework. Formalise strategy and governance.

  2. 2

    Tooling incidents. Classification and notification.

  3. 3

    Schedule testing. Programme and TLPT if significant.

  4. 4

    Maintain the register. Identify and govern service providers.

  5. 5

    Govern. Involve senior management.

Frequently asked questions

Yes, with proportionality and a simplified framework for certain small entities.

Back to the Financial sector guideFinancial sector & AI Act

Take action on DORA

Free assessment or a chat with an expert dedicated to financial sector.

Start my free assessment Talk to an expert

They already trust us

See how organisations in the financial sector sector secured their compliance with DCO.

See testimonials