EU DORA FAQ

DORA's core operational-resilience duties apply to the listed financial entities, including credit institutions, payment institutions, account information service providers, electronic money institutions, investment firms, crypto-asset service providers, central securities depositories, central counterparties, trading venues, trade repositories, fund managers, management companies, insurance and reinsurance undertakings, insurance intermediaries, occupational pension institutions, credit rating agencies, critical benchmark administrators, crowdfunding service providers, and securitisation repositories. Article 2 lists ICT third-party service providers separately: financial entities must govern those dependencies and contracts, while providers designated as critical are subject to the Union oversight framework.

DORA also contains specific exclusions and proportionality rules. Small size alone does not create an exclusion or make an entity eligible for the Article 16 simplified framework. In-scope financial entities apply the relevant ICT risk management, incident, testing, and ICT third-party-risk rules proportionately, but fixed duties and minimum frequencies still apply where DORA states them.

DORA requires much more than incident reporting. Financial entities need a documented ICT risk management framework, governance and control arrangements, ICT asset and function inventories, business continuity and response-and-recovery plans, detection and incident-management processes, post-incident learning, and testing.

Evidence should be specific enough for a supervisor to trace a DORA requirement to an operational control: management-body approvals, ICT risk framework reviews, inventories, business impact analysis records, continuity test results, incident logs, classification worksheets, remediation plans, and audit follow-up for critical ICT findings.

DORA requires financial entities to classify ICT-related incidents, report major ICT-related incidents to the relevant competent authority, and notify significant cyber threats voluntarily when they consider the threat relevant to the financial system, service users, or clients.

The incident decision should be based on DORA classification criteria and the RTS thresholds, not on an informal severity label. Keep the incident timeline, affected service and function, client or financial-counterpart impact, downtime, geography, data-loss assessment, economic impact, root cause, and report submissions together.

DORA keeps responsibility with the financial entity even when ICT services are outsourced. Before contracting, entities should decide whether the service supports a critical or important function, assess concentration and subcontracting risk, run due diligence, and make sure required contract rights are written into one durable contract.

The register of information is a structured inventory of ICT third-party contractual arrangements. It distinguishes critical or important functions, links contracts, providers, functions, services, subcontractors, supply-chain ranks, identifiers, audit dates, exit plans, substitutability, and discontinuation impact.

Threat-led penetration testing is the advanced DORA test for selected financial entities. Article 16 entities and microenterprises are excluded. TLPT authorities identify other entities based on impact, possible financial-stability concerns, ICT risk profile, ICT maturity, and technology features.

DORA enforcement is not expressed as one EU-wide administrative fine cap. Member States set administrative penalties and remedial measures, while competent authorities need supervisory, investigatory, and sanctioning powers such as document access, inspections, corrective measures, orders to stop breaches, measures including pecuniary measures, and public notices.