For financial entities, risk leaders, and compliance teams
Digital Operational
Resilience Act
(DORA) Compliance
Operationalize the Digital Operational Resilience Act (DORA) across ICT risk management, major incident reporting, resilience testing, and third-party oversight with one accountable workflow.
What is the Digital Operational Resilience Act (DORA)?
DORA (Regulation (EU) 2022/2554) is the EU's regulation ensuring that financial entities can withstand, respond to, and recover from ICT-related disruptions. It became fully applicable on 17 January 2025 and covers over 20 categories of financial entities, from banks and insurers to crypto-asset service providers.
DORA also establishes an EU oversight framework for designated critical ICT third-party providers and acts as lex specialis to NIS2 for financial-sector ICT risk and incident reporting obligations.
Timeline and Compliance Milestones
The Digital Operational Resilience Act (DORA) became fully applicable on 17 January 2025 after a two-year preparation period. Technical standards and CTPP designations are now in place, with ongoing oversight and testing obligations. Use this timeline to sequence readiness work against supervisory expectations.
European Commission proposes DORA as part of the Digital Finance Package
Regulation published in the Official Journal on 27 December 2022; entered into force on 16 January 2023 under Article 64; 24-month preparation period begins
DORA becomes fully applicable under Article 64. Compliance is now mandatory for in-scope financial entities listed in Article 2
ESAs designate first 19 Critical Third-Party Providers including AWS, Google Cloud, and Microsoft
Annual Register of Information reporting enters a recurring cycle under ESA implementing standards and national authority timelines
Commission review deadline for key DORA provisions, including oversight and reporting framework effectiveness (Article 58)
European Commission proposes DORA as part of the Digital Finance Package
Regulation published in the Official Journal on 27 December 2022; entered into force on 16 January 2023 under Article 64; 24-month preparation period begins
DORA becomes fully applicable under Article 64. Compliance is now mandatory for in-scope financial entities listed in Article 2
ESAs designate first 19 Critical Third-Party Providers including AWS, Google Cloud, and Microsoft
Annual Register of Information reporting enters a recurring cycle under ESA implementing standards and national authority timelines
Commission review deadline for key DORA provisions, including oversight and reporting framework effectiveness (Article 58)
European Commission proposes DORA as part of the Digital Finance Package
Regulation published in the Official Journal on 27 December 2022; entered into force on 16 January 2023 under Article 64; 24-month preparation period begins
DORA becomes fully applicable under Article 64. Compliance is now mandatory for in-scope financial entities listed in Article 2
ESAs designate first 19 Critical Third-Party Providers including AWS, Google Cloud, and Microsoft
Annual Register of Information reporting enters a recurring cycle under ESA implementing standards and national authority timelines
Commission review deadline for key DORA provisions, including oversight and reporting framework effectiveness (Article 58)
Who is Subject to DORA?
Article 2(1)(a) to (t) lists more than 20 categories of financial entities, from banks and insurers to crypto-asset service providers. Article 2(3) sets exclusions and Article 2(4) gives Member States options. DORA also reaches into the technology supply chain through its oversight framework for designated critical ICT third-party providers under Article 31.
Banking & Credit
- Credit institutions
- Payment institutions
- Electronic money institutions
- Account information service providers
Investment & Trading
- Investment firms
- Trading venues
- Central securities depositories
- Central counterparties
Insurance & Pensions
- Insurance and reinsurance undertakings
- Insurance intermediaries
- Institutions for occupational retirement provision
Crypto & Alternative
- Crypto-asset service providers
- Crowdfunding service providers
- Securitisation repositories
Asset Management
- Management companies
- Alternative investment fund managers
Market Infrastructure
- Trade repositories
- Credit rating agencies
- Administrators of critical benchmarks
- Data reporting service providers
Proportionality Principle (Article 4)
DORA applies proportionally: requirements scale with the size, risk profile, and complexity of the entity.
Article 16(1) provides a simplified ICT risk-management framework for specific entity categories: small and non-interconnected investment firms, exempt payment and e-money institutions, credit institutions exempted under Directive 2013/36/EU where Member States exercise the Article 2(4) option, and small institutions for occupational retirement provision.
Other in-scope institutions must implement the full framework, and entities identified by competent authorities must perform advanced resilience testing (TLPT) under Articles 26-27.
DORA Reaches Into Your Tech Supply Chain
DORA's Chapter V brings ICT third-party service providers into scope through oversight of Critical Third-Party Providers (CTPPs). On 18 November 2025, the European Supervisory Authorities designated the first 19 CTPPs, including AWS, Google Cloud, and Microsoft.
Extraterritorial reach (Article 31(12)): Non-EU CTPPs must establish a subsidiary within the European Union within 12 months of designation. This means a US cloud provider serving EU financial institutions cannot simply comply from abroad; they must have an EU legal presence.
Contractual obligations (Article 30): Article 30(2) requires baseline contractual clauses (description of services, locations, monitoring, exit strategies) in all ICT service contracts. Article 30(3) adds enhanced provisions, including audit rights and detailed exit strategies, for services supporting critical or important functions.
The Five Substantive Chapters of the Digital Operational Resilience Act
DORA does not formally use the term “pillars”. The five substantive obligation areas live in Chapters II to VI of Regulation (EU) 2022/2554.
ICT Risk Management
- -Comprehensive ICT risk management framework
- -Management body accountability and oversight
- -Identify, protect, detect, respond, and recover
- -Business continuity and disaster recovery plans
Incident Reporting
- -Classify incidents based on severity criteria
- -Initial notification within 4 hours of classification (and within 24 hours of awareness)
- -Intermediate report within 72 hours of the initial notification
- -Final report within 1 month of the latest updated intermediate report
Resilience Testing
- -Regular testing of ICT tools and systems
- -Threat-Led Penetration Testing (TLPT) at least every 3 years for entities identified by competent authorities
- -If internal testers are used, external testers are required every third TLPT; significant credit institutions use external testers only
- -Testing on live production systems with safeguards
- -Follow DORA TLPT RTS (Commission Delegated Regulation (EU) 2025/1190) for execution and closure
Third-Party Risk
- -Article 28(3) Register of Information for all ICT service arrangements
- -Due diligence before onboarding providers
- -Continuous monitoring of provider performance
- -Direct oversight of designated critical ICT third-party providers by the lead overseer
Information Sharing
- -Voluntary cyber threat intelligence sharing
- -Within trusted financial sector communities
- -Compliant with data protection rules
- -Collective defense across the sector
Incident Reporting Timeline
Article 19 of DORA and Commission Delegated Regulation (EU) 2025/301 Article 5 set a three-stage reporting timeline for major ICT-related incidents.
Initial Notification
Report within 4 hours of classifying a major ICT incident and no later than 24 hours after becoming aware of it.
Intermediate Report
Submit an updated assessment within 72 hours from the initial notification.
Final Report
Deliver the final report within one month of the latest updated intermediate report.
Penalties for Non-Compliance
DORA sets the enforcement framework, but sanctions for most financial entities are defined by Member State law rather than a single EU-wide fine table.
Financial Entities
Member States must provide effective, proportionate, and dissuasive penalties for breaches by in-scope financial entities.
Critical ICT Providers
Lead overseers can impose periodic penalty payments on designated critical ICT third-party providers under Article 35.
Periodic Penalty Window
The periodic penalty payment for designated critical ICT providers can run daily for up to six months.
How Modulos Helps with DORA Compliance
Modulos gives risk and compliance teams one workflow for requirements, controls, evidence, reviews, and exports. This helps you operationalize DORA with clearer accountability and defensible audit trails.
Book a DORA DemoBreak DORA obligations into structured requirements and mapped controls with clear ownership, implementation status, and evidence expectations.
FAQ about the Digital Operational Resilience Act
The Digital Operational Resilience Act (DORA), Regulation (EU) 2022/2554, is the EU regulation governing the operational resilience of financial entities. It applies to banks, investment firms, insurance and reinsurance undertakings, payment and e-money institutions, crypto-asset service providers, and other financial entities listed in Article 2, plus their ICT third-party service providers under the Chapter V oversight framework. DORA entered application on 17 January 2025.
How DORA fits with other frameworks
Most financial entities run DORA alongside other regimes rather than instead of them.
For financial entities subject to both DORA and the NIS2 Directive, DORA is lex specialis: DORA Article 1(2) and NIS2 Article 4 disapply equivalent NIS2 provisions where DORA covers the same matter. NIS2 governance and supply-chain provisions outside DORA may still apply alongside.
ICT risk management under DORA Chapter II maps directly onto ISO/IEC 27001 controls, with ISO/IEC 42001 supporting the AI-management portion where the financial entity uses AI in its ICT systems. Risk operating models such as NIST AI RMF support the AI risk-analysis duty inside DORA.
When financial entities deploy AI systems that touch personal data or fall under high-risk categories, the EU AI Act and GDPR apply alongside DORA without substituting for any of them.
For US-attestation work, SOC 2 control sets often share evidence with DORA Chapter II ICT risk-management controls, especially around access, change, and incident management.
Comparing platforms? See how 20 AI governance platforms address AI risk inside the DORA stack in our 2026 enterprise buyer’s guide.
Need a Defensible DORA Execution Workflow?
In a live walkthrough, see how teams track ICT risk controls, third-party evidence, and reporting artifacts before supervisory reviews.