DORA: What EU Financial Services Companies Need to Know Now

If you have been treating DORA as a distant regulatory horizon, the horizon has arrived. The EU DORA timeline is no longer a projection.

The Digital Operational Resilience Act entered into force in January 2023 and became fully applicable on January 17, 2025.

DORA applies to financial entities in the EU, but it does not stop at their borders. It extends directly to the ICT third-party service providers that serve them. If your company is either:

• An EU financial institution, or
• A technology company providing services to EU financial institutions,

…you are not preparing for DORA compliance requirements. You are already in scope.

DORA at a Glance

A Regulation, not a Directive

This distinction matters. Unlike NIS2, DORA is a Regulation, which means it applies uniformly across all EU member states, with no national transposition required. There is no waiting for local parliaments to interpret the rules. It is the same standard, everywhere.

It establishes a comprehensive framework for digital operational resilience in the financial sector.

The five pillars

DORA is built around five pillars:

1. ICT risk management
2. ICT-related incident reporting
3. Digital operational resilience testing
4. ICT third-party risk management
5. Information sharing arrangements

Who is in scope: financial entities

DORA covers a broad range of financial entities, including:

• Credit institutions (banks)
• Payment institutions
• Electronic money institutions
• Investment firms
• Asset management companies
• Insurance undertakings and insurance intermediaries
• A range of other entities listed in Article 2 of the Regulation

In short, it covers the majority of regulated financial services entities in the EU.

Who is in scope: ICT third-party providers

Technology providers are pulled into the framework in two ways:

• All providers face baseline security requirements that flow downstream through their contracts with the financial entities they serve.
• Critical ICT Third-Party Service Providers (CTPPs), designated by the European Supervisory Authorities, face direct oversight under a new pan-EU oversight framework. The first list of designated CTPPs was published in November 2025.

Pillar 1: DORA ICT Risk Management, the Core Framework

DORA requires EU financial entities to implement a comprehensive ICT risk management framework. The key requirements are operational mandates, not just paperwork.

A risk management framework with real governance

Covering strategy, governance, tolerance levels, and alignment with the overall business strategy. ICT risk must be integrated with the broader enterprise risk management framework. It can no longer be managed off to one side by the IT department.

A comprehensive ICT asset inventory

Covering all ICT assets, including those operated by third parties. The inventory must document dependencies, criticality, and the interconnections between systems. You cannot protect a dependency you do not know exists.

ICT continuity and business continuity

Documented business continuity plans (BCPs) and disaster recovery plans (DRPs) specifically for ICT systems, backed by regular testing. DORA specifies minimum testing frequencies and methodologies. A plan that has not been tested is just a theory.

Asset classification

An information and ICT asset management capability that classifies assets by criticality and sensitivity.

Already have ISO 27001 and BCM frameworks? Good news. DORA’s ICT risk management requirements build on similar foundations, adding sector-specific requirements on top. You are not starting from zero, but you are being held to a higher standard of proof.

Pillar 2: Incident Reporting, the Most Operationally Demanding Requirement

DORA creates a harmonized ICT-related incident reporting framework. Major ICT incidents must be reported to the competent authority (your national financial regulator) using a standardized template.

The clock is tight

Reporting happens in three tiers:

What makes an incident “major”?

The criteria include:

• The number of clients affected
• The volume of data affected
• The geographic spread
• The reputational and financial impact

The European Supervisory Authorities have published regulatory technical standards that set out these classification criteria in detail.

What this means in practice

Supporting the DORA incident reporting 4 hours timeline requires incident detection, classification, and reporting capabilities that are genuinely fast.

That is far more demanding than GDPR’s 72-hour timeline. It calls for well-defined incident response procedures and clear escalation paths to your compliance and legal functions. If your process relies on finding the right person on a Monday morning, it will not keep up. Time is the ultimate metric of resilience.

Pillar 3: Digital Operational Resilience Testing

DORA requires financial entities to test the resilience of their ICT systems. How much testing depends on the entity’s size and systemic importance.

Basic testing: required for everyone

Includes vulnerability assessments, network security assessments, and reviews of physical security measures.

Advanced testing: Threat-Led Penetration Testing (TLPT)

Required for financial entities designated as systemically important (typically larger banks and significant financial institutions).

TLPT is a more intensive form of penetration testing that simulates sophisticated threat actors using current threat intelligence. It must be conducted by testers who meet DORA’s requirements, every three years.

What this means for SaaS providers

If you provide services to financial entities, your customers may ask for evidence of your own DORA-aligned resilience testing as part of their third-party risk management. Your resilience is now their compliance requirement.

Pillar 4: DORA Third Party Risk Management, Where Customers’ Requirements Become Yours

This is the pillar technology vendors need to pay the closest attention to.

Financial entities must assess, monitor, and manage the risks posed by their ICT third-party service providers. That means they have to impose requirements on you, including:

Contractual requirements

ICT agreements must cover service levels, security standards, incident notification, audit rights, business continuity, and termination provisions. DORA specifies minimum contract provisions in detail.

Exit strategies

Financial entities must maintain and test exit strategies for all critical ICT providers. As a provider, you should be ready to support your customers’ exit strategy testing and documentation.

Concentration risk management

Financial entities cannot create excessive dependency on a single provider. That puts pressure on providers to show they do not create systemic concentration risk.

The bottom line for vendors

The DORA requirements your EU financial services customers face will flow downstream through their contracts with you. Expect:

• Requests for SOC 2 reports, ISO 27001 certificates, and penetration test results
• Requests for cooperation with audit rights
• DORA-specific contract addenda covering notification timelines, exit cooperation, and resilience testing cooperation

Being ready for these requests before they land is not just good compliance. It is a competitive advantage in every financial services deal.

Ready to Simplify Compliance?

True operational resilience requires aligning your policies, controls, and evidence so that they reflect reality, not just a checklist.

Regodit helps both EU financial entities implementing DORA and technology providers supporting their downstream requirements. If you need a compliance program that addresses DORA’s comprehensive operational resilience requirements without the administrative friction, explore Regodit and schedule a demo with the team.