EU DORA FAQ

DORA applies to listed financial entities such as credit institutions, payment institutions, account information service providers, electronic money institutions, investment firms, crypto-asset service providers, central securities depositories, central counterparties, trading venues, trade repositories, fund managers, management companies, insurance and reinsurance undertakings, insurance intermediaries, occupational pension institutions, credit rating agencies, critical benchmark administrators, crowdfunding service providers, securitisation repositories, and ICT third-party service providers.

DORA also contains exclusions and proportionality rules. Some small or exempt entities are outside scope, and financial entities apply the ICT risk management, testing, incident, and third-party-risk rules in proportion to their size, risk profile, and the nature, scale, and complexity of their services.

DORA is not only an incident-reporting rule. Financial entities need a documented ICT risk management framework, governance and control arrangements, ICT asset and function inventories, business continuity and response-and-recovery plans, detection and incident-management processes, post-incident learning, and testing.

Evidence should be specific enough for a supervisor to trace a DORA requirement to an operational control: management-body approvals, ICT risk framework reviews, inventories, business impact analysis records, continuity test results, incident logs, classification worksheets, remediation plans, and audit follow-up for critical ICT findings.

DORA requires financial entities to classify ICT-related incidents, report major ICT-related incidents to the relevant competent authority, and notify significant cyber threats voluntarily when they consider the threat relevant to the financial system, service users, or clients.

The incident decision should be based on DORA classification criteria and the RTS thresholds, not on an informal severity label. Keep the incident timeline, affected service and function, client or financial-counterpart impact, downtime, geography, data-loss assessment, economic impact, root cause, and report submissions together.

DORA keeps responsibility with the financial entity even when ICT services are outsourced. Before contracting, entities should decide whether the service supports a critical or important function, assess concentration and subcontracting risk, run due diligence, and make sure required contract rights are written into one durable contract.

The register of information is a structured inventory of ICT third-party contractual arrangements. It distinguishes critical or important functions, links contracts, providers, functions, services, subcontractors, supply-chain ranks, identifiers, audit dates, exit plans, substitutability, and discontinuation impact.

Threat-led penetration testing is the advanced DORA test for selected financial entities. It is not required for every entity; competent authorities identify entities based on impact, possible financial-stability concerns, ICT risk profile, ICT maturity, and technology features.

DORA enforcement is not expressed as one EU-wide administrative fine cap. Member States set administrative penalties and remedial measures, while competent authorities need supervisory, investigatory, and sanctioning powers such as document access, inspections, corrective measures, orders to stop breaches, measures including pecuniary measures, and public notices.