The short answer
DORA, the Digital Operational Resilience Act (Regulation (EU) 2022/2554), sets rules for how EU financial entities manage technology risk, including risk from their ICT suppliers. It has applied since 17 January 2025 and covers 20 types of financial entity.
What is DORA?
DORA is the Digital Operational Resilience Act, Regulation (EU) 2022/2554. It sets rules for how financial entities in the EU manage the risks that come from information and communication technology (ICT), including the technology suppliers they depend on. It was signed on 14 December 2022 and has applied since 17 January 2025. As an EU regulation it is directly applicable in every member state.
Who does DORA apply to?
Article 2 lists 20 types of financial entity. They include credit institutions, payment and e-money institutions, investment firms, crypto-asset service providers, central securities depositories, central counterparties, trading venues, fund managers, insurers and insurance intermediaries, occupational pension funds, credit rating agencies, crowdfunding service providers and securitisation repositories. It also covers ICT third-party service providers.
Some entities are excluded, for example insurance intermediaries that are micro, small or medium-sized enterprises.
What does DORA require?
- ICT risk management: a framework for identifying, protecting against and recovering from ICT risk.
- Incident management and reporting: classifying ICT incidents and reporting major ones to the regulator.
- Digital operational resilience testing, including threat-led penetration testing (TLPT) on live production systems at least every three years for entities in scope of that requirement.
- ICT third-party risk: managing the risk from technology suppliers, keeping a register of information about every ICT contract, and including minimum terms in those contracts.
- Information sharing about cyber threats between financial entities.
What are the DORA incident reporting deadlines?
| Report | Deadline |
|---|---|
| Initial notification | Within 4 hours of classifying an incident as major, and no later than 24 hours after becoming aware of it |
| Intermediate report | Within 72 hours of the initial notification |
| Final report | Within one month of the latest intermediate report |
These timings are set out in Delegated Regulation (EU) 2025/301.
What is the DORA register of information?
Article 28(3) requires financial entities to keep a register of information on all their contracts with ICT third-party service providers, and to report new arrangements to their regulator at least once a year. National regulators had to send the first registers to the European Supervisory Authorities (ESAs) by 30 April 2025.
What must contracts with technology suppliers contain?
Article 30 sets minimum contract terms for ICT services. They include a description of the services and any subcontracting, where data will be processed, data protection, and access to and return of data. Suppliers selling ICT services to EU financial entities can expect these terms in their contracts.
Who are the critical ICT third-party providers?
The ESAs designate critical ICT third-party providers (CTPPs) each year, based on their systemic impact, how many systemically important institutions rely on them, whether they support critical functions and how hard they would be to replace. The first list, published on 18 November 2025, named 19 providers, including AWS, Google Cloud, Microsoft, Oracle, SAP, IBM, Bloomberg, LSEG Data and Risk, Accenture and TCS.
EU financial entities may use a critical provider established outside the EU only if it sets up an EU subsidiary within 12 months of being designated.
Does DORA apply to UK firms?
DORA is EU law and applies to financial entities in the EU. UK suppliers selling ICT services to those entities meet DORA through their customers, for example through the Article 30 contract terms.
The UK has its own critical third parties regime. The Bank of England, PRA and FCA rules came into force on 1 January 2025 and apply to a provider once HM Treasury designates it. HM Treasury has designated AWS EMEA SARL, Google Cloud EMEA Ltd, Microsoft Ireland Operations Ltd and Oracle Corporation UK Ltd, with oversight starting on 13 July 2026. In January 2026 the UK regulators signed a memorandum of understanding with the ESAs on overseeing providers covered by both regimes. Designation is not an endorsement: financial firms remain responsible for their own third-party risk.
How does DORA relate to NIS2?
For financial entities, DORA is the more specific law and takes precedence over NIS2 where they overlap.
Sources
- EUR-Lex: Regulation (EU) 2022/2554 (DORA)
- EUR-Lex: Delegated Regulation (EU) 2025/301 (incident reporting)
- ESMA: timeline for collecting registers of information (November 2024)
- ESMA: list of designated critical ICT third-party providers (November 2025)
- Bank of England: critical third parties policy statement (November 2024)
- gov.uk: HM Treasury designates critical third parties (July 2026)
- Bank of England: UK and EU regulators sign MoU (January 2026)
This is general information, not legal or professional advice. Rules change, so check the sources and take advice for your situation. Spotted something out of date? Email hello@asand.io.