DORA Compliance Requirements for Financial Institutions

DORA compliance requirements have been enforceable across all 27 EU Member States since 17 January 2025. Regulation (EU) 2022/2554 sets prescriptive rules for how financial institutions manage ICT risk, report incidents, test resilience, and govern their technology supply chains. Seventeen months in, no formal fines have been published. National supervisors spent 2025 running readiness assessments and supervisory dialogue. In 2026, they are running enforcement.

(A note on naming: “DORA” in this article refers exclusively to the EU financial-sector regulation. It has nothing to do with the DevOps Research and Assessment metrics used in software engineering, or with any website or domain product.)

DORA Applies to 21 Types of Financial Entity and Their ICT Providers

Around 21 categories of financial entity fall under DORA, alongside every ICT third-party provider that serves them, including providers based outside the EU.

The full scope under Article 2(1): credit institutions, payment institutions, account information service providers, e-money institutions, investment firms, crypto-asset service providers and issuers of asset-referenced tokens, central securities depositories, central counterparties, trading venues, trade repositories, AIFMs, UCITS management companies, data reporting service providers, insurance and reinsurance undertakings, insurance intermediaries, institutions for occupational retirement provision, credit rating agencies, administrators of critical benchmarks, crowdfunding service providers, and securitisation repositories. If your organisation provides ICT services to any of these, you are in scope too. Cloud providers, managed service firms, data analytics vendors. Headquarters location is irrelevant.

Proportionality exists but covers less ground than most compliance teams assume. Microenterprises (fewer than 10 employees and annual turnover or balance sheet total under €2 million) qualify for a simplified ICT risk management framework under Article 16. That simplification trims documentation and governance requirements. It does not remove the obligation to manage ICT risk. And certain entity types, including trading venues, CCPs, trade repositories, and CSDs, cannot use the microenterprise exemption regardless of size.

Not sure whether your organisation falls in scope? The DORA compliance self-assessment checks scope, proportionality, and exemptions in under ten minutes.

Five Pillars of DORA Compliance and a 4-Hour Reporting Clock

DORA is commonly organised around five pillars. This is an industry framing, not a term from the regulation itself, but it maps cleanly to the text and it is how most national supervisors discuss the requirements in practice.

Pillar 1: ICT risk management (Articles 5–16). A comprehensive framework covering the full lifecycle: identify, protect, detect, respond, recover. The management body carries personal accountability under Article 5(2). Not delegable to IT. Not reducible to a policy document. Board members who treat ICT risk as a second-tier agenda item are the ones Article 5 was written for.

Pillar 2: ICT incident management, classification, and reporting (Articles 17–23). Major ICT incidents must be reported on a three-stage timeline: initial notification to the national competent authority within 4 hours of classification as major (no later than 24 hours after detection), intermediate report within 72 hours, final report within one month. Classification uses defined thresholds covering number of affected clients, duration, geographical spread, data losses, and criticality of impacted services. If your incident response playbook was designed around GDPR’s 72-hour window, DORA’s 4-hour clock demands a fundamentally different escalation structure.

Pillar 3: Digital operational resilience testing (Articles 24–27). Critical ICT systems require annual testing. Significant financial entities must also conduct threat-led penetration testing (TLPT) at least every three years under the TIBER-EU framework, using independent external testers. The qualified tester pool in Europe is not large, and it is getting booked out.

Pillar 4: ICT third-party risk management (Articles 28–44). The pillar that absorbs the most compliance resources and the one regulators have built the most supervisory infrastructure around. It requires a documented ICT third-party risk strategy, pre-contract due diligence, mandatory contractual clauses per Article 30, subcontractor visibility, exit strategies, and ongoing maintenance of a Register of Information recording every ICT third-party arrangement. Article 30(2) sets baseline contractual requirements. Article 30(3) layers on stricter terms for services supporting critical or important functions: full SLAs with measurable objectives, unrestricted audit and access rights, cooperation during TLPT, and documented exit plans. The subcontracting rules under Delegated Regulation (EU) 2025/532, in force since 22 July 2025, add visibility requirements into material subcontractors down the chain.

Pillar 5: Information-sharing arrangements (Articles 45–49). Voluntary threat intelligence sharing among financial entities. Indicators of compromise, tactics, techniques. In practice, most institutions treat it as the lowest priority, and the regulation is least prescriptive about it.

In our assessment, Pillar 4 is the harder implementation problem. The 2024 ESA dry run showed only 6.5% of analysed Registers of Information passing all data-quality validation checks, which points to a structural gap in vendor data, ownership mapping, and contract governance that documentation alone will not fix. The 4-hour incident reporting deadline under Pillar 2 creates more immediate crisis pressure, but for mid-sized institutions it is a more solvable problem: escalation rules, rehearsals, classification templates. A weak third-party register, on the other hand, is a years-long remediation programme that starts with data most firms do not currently hold in one place.

19 ICT Providers Named as Critical Under EU Oversight

On 18 November 2025, the three European Supervisory Authorities designated 19 ICT providers as critical third-party providers (CTPPs) under Article 31(9). This was the first official list under DORA’s oversight framework.

The 19 designated providers, per the official EBA document: Accenture, Amazon Web Services EMEA, Bloomberg, Capgemini, Colt Technology Services, Deutsche Telekom, Equinix (EMEA), FIS, Google Cloud EMEA, IBM, InterXion, Kyndryl, LSEG Data and Risk, Microsoft Ireland Operations, NTT DATA, Oracle Nederland, Orange, SAP, and Tata Consultancy Services.

A note on accuracy, because the misinformation is already spreading: several secondary sources have added Euroclear and Clearstream to this list. They are not on it. Others cite “12 providers.” The verified count is 19. If your compliance brief cites a different number, check the EBA source linked above.

Each CTPP receives a Lead Overseer (EBA, ESMA, or EIOPA) with powers to issue recommendations, require remediation plans, and as a last resort request that financial entities suspend or terminate arrangements. Designation follows four criteria under Article 31(2): potential systemic impact of a large-scale failure, systemic importance of reliant financial entities, concentration of reliance, and substitutability. The list is reviewed annually.

The Register of Information that feeds the CTPP assessment runs on an annual cycle. Financial entities submitted first registers to national competent authorities by 30 April 2025. The second cycle, referencing 31 December 2025 data, closed around 31 March 2026, though national deadlines varied (BaFin: 30 March, DNB: 20 March, MFSA: 21 March, CSSF portal opened 11 February). In the 2024 dry run, only 6.5% of roughly 1,000 participating firms passed all 116 data-quality validation checks. The other 93.5% would start their first supervisory conversation about third-party risk with a data problem. That is not a gap a cover letter fixes.

No Fines Published Yet but Penalty Ceilings Reach €20 Million

National competent authorities supervise financial entities. The three ESAs run the EU-level oversight framework for critical ICT third-party providers.

DORA does not set a single EU-wide penalty ceiling the way GDPR does. Article 50 requires each Member State to establish administrative penalties that are “effective, proportionate and dissuasive.” Twenty-seven Member States read those three words and arrived at penalty ceilings that range from €2 million in the Czech Republic to €20 million in Italy, with turnover-based caps spanning from 5% of annual turnover in Spain to 10% in Sweden, per DLA Piper’s cross-jurisdictional analysis. So much for harmonisation. Penalties can also be imposed on natural persons, meaning individual managers and board members, with amounts varying by jurisdiction.

For CTPPs, the regulation is more direct. Article 35(8) sets periodic penalty payments of up to 1% of the provider’s average daily worldwide turnover, per day, for a maximum of six months. For a hyperscaler reporting nine-figure daily revenue, that is arithmetic worth doing before the letter arrives.

As of mid-June 2026, no formal fines against named financial entities have been publicly reported. Supervisors spent 2025 on baseline readiness assessments and dialogue. National competent authorities have signalled that 2026 is the year enforcement becomes operational, and the ECB has incorporated DORA into its SREP cycle for significant credit institutions as a Pillar 2 factor, which means ICT resilience gaps now feed directly into capital requirements. Our read: the absence of published fines should not be mistaken for leniency. It is regulators building their case files from the data firms have already submitted.

DORA and GDPR Both Apply but the Reporting Clocks Are Worlds Apart

Both regulations carry EU-wide direct effect, but they govern different risks through different supervisory structures. The most consequential practical difference is reporting speed.

Dimension	DORA (Regulation (EU) 2022/2554)	GDPR (Regulation (EU) 2016/679)
Focus	ICT operational resilience of the financial sector	Protection of personal data and individual rights
Scope	~21 categories of financial entities + ICT providers	Any organisation processing EU personal data
Approach	Prescriptive, rule-based ICT requirements	Principle-based data protection
Incident reporting	4h initial, 72h intermediate, 1-month final	72 hours for personal data breaches
Enforcement	National financial supervisors + ESAs (CTPP oversight)	National data protection authorities + EDPB
Penalties	Set by Member States (5–10% turnover range nationally)	Up to 4% global turnover or €20M

GDPR gives you 72 hours from awareness of a personal data breach. DORA gives you 4 hours from classification of a major ICT incident, with 24 hours as the absolute backstop from detection. If your incident response workflow was built to satisfy one regulation, it does not automatically satisfy the other. Financial institutions subject to both need two reporting tracks running in parallel whenever an ICT incident also involves personal data.

Start with the Incident Workflow. The Register Comes Second.

The application deadline passed in January 2025. The question for every financial institution is whether its compliance programme holds under supervisory scrutiny that is no longer hypothetical.

This quarter, in our assessment, prioritise the 4-hour incident reporting workflow. The Register of Information remains the harder long-term programme, but a reporting failure is the faster supervisory trigger. And the overlooked gap is not the notification template. It is the operational question of who classifies a major ICT incident at 2 AM on a Saturday, who approves the notification, and who actually files it. If those three names are not written down, tested, and reachable out of hours, the 4-hour clock is decoration.

If the incident workflow or the register of information needs outside hands, our directory of vetted DORA compliance providers covers specialist firms across the EU, including the boutique consultancies that take on smaller financial entities.

Audit your Register of Information data quality. The next annual submission cycle starts in early 2027, referencing 31 December 2026 data. If your firm was among the 93.5% that failed data-quality validations in the dry run, remediation should already be underway. Clean data is not a formatting exercise. It is the entry point regulators use to examine your entire third-party landscape.

Review ICT third-party contracts against Article 30 requirements. Prioritise services supporting critical or important functions. Unrestricted audit rights, measurable SLA targets, documented exit strategies, and subcontractor visibility per Delegated Regulation (EU) 2025/532 must exist in the contract language. Not in a side letter. Not as a verbal understanding.

Confirm your TLPT timeline. If your institution qualifies as significant under your national supervisory framework, your first threat-led penetration testing cycle may already be approaching. Independent TIBER-EU testers are in limited supply across Europe. Waiting for a quote in Q4 is waiting too long.

Run the DORA compliance self-assessment to score your current readiness across all five pillars and surface specific gaps before your regulator surfaces them for you.

For a cross-regulation view of upcoming deadlines under DORA, NIS2, the AI Act, and other EU frameworks, see the EU compliance deadline tracker.