Digital Operational Resilience Act
Regulation (EU) 2022/2554 — applicable since 17 January 2025 — sets binding ICT risk-management, incident-reporting, resilience-testing, and third-party oversight rules for the entire EU financial sector.
DORA is a regulation, not a directive — it applies directly and uniformly across every EU member state without a national transposition step, which is why its compliance date (17 January 2025) is the same everywhere. It covers banks, insurers, investment firms, payment institutions, crypto-asset service providers, and — critically — the critical ICT third-party providers those financial entities depend on, including cloud providers.
DORA is built around five pillars: ICT risk management, ICT-related incident reporting, digital operational resilience testing (including, for larger entities, threat-led penetration testing — TLPT), ICT third-party risk management, and information-sharing arrangements. The third-party pillar is the most structurally novel: the European Supervisory Authorities can designate certain ICT providers as "critical" and oversee them directly, a first for EU financial regulation.
Who is impacted
Nearly every regulated EU financial entity — credit institutions, payment and e-money institutions, investment firms, insurance and reinsurance undertakings, crypto-asset service providers, trading venues, central counterparties, and more — plus their critical ICT third-party providers, who can be brought into direct regulatory scope even without being financial institutions themselves.
Requirements
A documented ICT risk-management framework approved by the management body; incident classification and reporting to competent authorities on a defined timeline; regular resilience testing scaled to the entity's size and risk profile, with advanced TLPT required for the largest, most systemically important entities; contractual and oversight requirements for ICT third-party providers, including exit strategies; and participation in threat-intelligence information sharing where applicable.
Key deadlines
Regulation enters into force
DORA becomes applicable
Executive guides & research
DORA: The Complete Executive Guide
A practitioner's guide to the Digital Operational Resilience Act — the five pillars, incident reporting, resilience testing, and what it means for both financial entities and their ICT vendors.
Glossary
Critical ICT Third-Party Provider
An ICT provider (which can include a cloud provider) designated by the European Supervisory Authorities as critical to the EU financial system, bringing it under direct regulatory oversight even though it isn't itself a financial entity.
Threat-Led Penetration Testing (TLPT)
DORA's most advanced resilience-testing requirement — a real, intelligence-led red-team exercise against an entity's live production systems, required for the largest, most systemically important financial entities on a multi-year cycle.
Related regulations
Related
Stay ahead of DORA changes
Get Regulatory Alerts the moment something about Digital Operational Resilience Act changes — new deadlines, guidance updates, enforcement actions.