DORA has no single EU fine schedule for every financial-entity breach. It gives competent authorities supervisory, investigatory, sanctioning, and remedial powers, while Member States set the detailed national penalty rules.
This page helps separate financial-entity enforcement exposure from the distinct Lead Overseer penalty-payment regime for critical ICT third-party service providers.
DORA sets competent-authority powers, administrative penalties and remedial measures, sanctioning criteria, publication safeguards, and a separate Lead Overseer for designated critical ICT third-party service providers. It does not harmonise a breach-by-breach fine schedule for financial entities, so any country-specific amount requires the applicable Member State source.
DORA requires Member States to establish appropriate administrative penalties and remedial measures for breaches of the regulation, and to ensure effective implementation. The regulation does not provide one uniform EU-wide maximum fine for every financial entity breach in the way some other EU regimes do.
Assess an actual case in two stages. First, identify the financial entity's competent authority under DORA and the conduct that may breach the regulation. Then check the applicable Member State law for the available administrative amounts, procedures, limitation rules, responsible persons, and any criminal-penalty route. DORA supplies the minimum enforcement toolkit and sanctioning factors, but the regulation alone cannot produce a country-specific fine estimate.
Sources (1)
Articles 50 to 54 ground DORA administrative penalties, remedial measures, criminal-penalty option, notification duties, and publication rules.
Administrative penalties and remedial measures
DORA requires competent authorities to publish on their official websites, without undue delay, a decision imposing an administrative penalty against which there is no appeal after notifying the addressee. The publication must identify the type and nature of the breach, the responsible persons, and the penalty. After a case-by-case assessment, the authority may defer publication, publish anonymously, or refrain from publication under the conditions in Article 54, including disproportionate identity or personal-data effects, financial-market stability risk, an ongoing criminal investigation, or disproportionate damage.
Published penalty information must remain online only for the period necessary to meet the DORA publication rule and cannot exceed five years. If a published decision is appealed, the competent authority must add appeal information and later outcome information, including any judicial annulment.
Sources (1)
Articles 52 and 54 cover the criminal-penalty option and publication of administrative penalties.
Publication of administrative penalties
DORA has a separate EU-level oversight regime for critical ICT third-party service providers. A Lead Overseer can request information, conduct investigations and inspections, request reports on actions or remedies, and issue recommendations. Critical providers must cooperate in good faith.
The periodic penalty-payment rule is narrower than the full list of oversight powers. It applies when a critical ICT third-party service provider wholly or partly fails to comply with a required information or documentation request, general investigation or inspection, or request for a report on actions or remedies after oversight activities, and at least 30 calendar days have passed since the provider received notice of that measure. The Lead Overseer must then impose a daily payment to compel compliance. It runs until compliance for no more than six months and may be up to 1% of the provider's average daily worldwide turnover in the preceding business year.
Sources (2)
Article 35 grounds the Lead Overseer powers and periodic penalty-payment regime for critical ICT third-party service providers.
periodic penalty payment
Grounds the practical existence of the DORA critical ICT third-party provider oversight framework and ESA designation process.
critical ICT third-party providers
Critical ICT third-party service providers can also owe oversight fees under DORA's oversight framework. Those fees fund the Lead Overseer's oversight work and are calculated under a delegated regulation; they should not be described as penalties or fines.
For penalty analysis, keep three buckets separate: national administrative penalties and remedial measures for DORA breaches, criminal penalties where Member State law uses them, and EU-level periodic penalty payments used by the Lead Overseer to compel critical ICT third-party provider compliance with oversight measures.
No. DORA requires Member States to establish appropriate administrative penalties and remedial measures and gives competent authorities a minimum enforcement toolkit, but it does not provide one uniform EU-wide fine cap for all financial-entity breaches.
Yes, where national law allows it. DORA requires Member States to give competent authorities power to apply relevant administrative penalties and remedial measures to management-body members and other individuals who are responsible for a breach under national law.
For whole or partial non-compliance with a required Lead Overseer information or documentation request, general investigation or inspection, or request for a report on actions or remedies after oversight activities, and after at least 30 calendar days from notice of that measure, the payment can be imposed daily until compliance for no more than six months. It can be up to 1% of the critical provider's average daily worldwide turnover in the preceding business year.
Sources (2)
Grounds the distinction between DORA oversight fees for critical ICT third-party service providers and enforcement fines or penalty payments.
oversight fees
Articles 35 and 50 to 54 distinguish Lead Overseer periodic penalty payments, national administrative penalties, remedial measures, criminal penalties, and publication rules.
effective, proportionate and dissuasive
Sorena can help separate national penalty exposure, remedial-measure risk, and critical-provider oversight issues into cited facts, owners, and evidence requests.
Ask questions tied to cited sources about DORA enforcement powers, competent-authority measures, and critical-provider oversight penalties.
Review your DORA enforcement-readiness file, source gaps, and evidence plan with Sorena.
"Administrative penalties and remedial measures"
"supervisory, investigatory and sanctioning powers"
"intentional or results from negligence"
"Publication of administrative penalties"
"periodic penalty payment"
"effective, proportionate and dissuasive"
"oversight fees"
"DORA oversight framework"
"critical ICT third-party providers"
How DORA critical or important functions affect ICT service mapping, third-party contracts, register-of-information records, incidents, testing, and evidence.
Track DORA dates and recurring evidence: 17 January 2025 application, incident reporting clocks, register updates, annual reporting, TLPT cadence, and critical-provider oversight milestones.
A DORA workflow for remediating ICT third-party contracts covering critical or important functions, subcontracting, audit rights, exits, register updates, and evidence.
Official source DORA guide for financial entities in scope, ICT third-party risk, contract clauses, subcontracting controls, register evidence, audit rights, exit planning, and oversight.
Official source guide to DORA ICT incident classification forms: major-incident criteria, significant cyber-threat notifications, report fields, time limits, evidence, and reclassification records.
Official source DORA workflow for starting the major-incident reporting clock, classifying ICT incidents, submitting initial, intermediate, and final reports, and preserving authority evidence.
Official source DORA guide to major ICT-related incident classification, initial notifications, intermediate and final reports, competent authority routing, and significant cyber threat notifications.
Build a DORA register of information from procurement, vendor, contract, service, function, and subcontractor data using the official register templates and validation checks.
Map DORA register fields to official templates for ICT contracts, provider chains, critical functions, dates, statuses, reporting, and evidence.
Compare binding DORA ICT third-party risk duties with the EBA outsourcing baseline for registers, critical functions, contracts, subcontracting, exit, incident reporting, and evidence.
Compare DORA's binding ICT operational resilience duties for financial entities with ISO 22301's business continuity management system requirements.
Compare EU DORA and ISO/IEC 27001 across scope, governance, incident reporting, testing, ICT third-party risk, certification, evidence, overlap, and gaps.
Compare DORA and NIS2 for financial entities, ICT providers, incident reporting, management accountability, third-party risk, supervisory routes, and reusable evidence.
Compare DORA major ICT-related incident reporting with PSD2 major operational or security payment incident reporting, including scope, triggers, report stages, recipients, and evidence.
Test DORA applicability against official sources for financial-entity scope, ICT services, critical or important functions, exclusions, proportionality, and evidence.
Check DORA operating evidence against official sources for ICT risk governance, major-incident reporting, resilience testing, TLPT, third-party contracts, and the register of information.
Map DORA obligations to official sources and operating evidence for ICT risk management, incident reporting, testing, third-party risk, registers, governance, and oversight.
Concise DORA FAQ covering who is in scope, proportionality, ICT third-party contracts, register-of-information records, major ICT incident thresholds and reporting, TLPT, testing, enforcement, and evidence.
An official source DORA control baseline for ICT risk governance, asset and dependency mapping, protection, detection, response, recovery, testing, third-party risk, and evidence.
DORA guide to ICT subcontracting chains for critical or important functions: prior assessment, contract conditions, register fields, monitoring, exit rights, and evidence.
Field-level guide to the EU DORA register of information data model: templates B_01 to B_07, provider identifiers, contract links, subcontracting chains, critical-function assessments, dates, and export evidence.
An official source overview of the main EU DORA requirements for financial entities: governance, ICT risk management, incident reporting, resilience testing, TLPT, ICT third-party risk, register of information, oversight, proportionality, and evidence.
Classify whether DORA applies to a financial entity, ICT third-party provider, group arrangement, branch, or critical ICT service dependency.
Classify DORA covered entities, simplified-framework status, critical or important functions, ICT dependencies, evidence records, and governance approvals.
An official source DORA guide for resilience testing, TLPT eligibility, authority interaction, test evidence, remediation plans, and avoiding unsupported testing cadence.
Check how DORA TLPT authorities identify financial entities for threat-led penetration testing and what evidence supports scope, readiness, providers, and governance.
Build a DORA threat-led penetration testing runbook around authority coordination, scope validation, provider controls, active testing, closure reports, remediation, and attestation.
Build a DORA register of information from contracts, ICT services, providers, functions, subcontractors, risk assessments, audit evidence, exit plans, and export checks.
What DORA requires in ICT third-party contracts, including critical or important functions, audit and access rights, termination, exit, subcontracting, register updates, and evidence.
FAQ on DORA major ICT-related incident classification thresholds, recurring incidents, reporting triggers, and evidence inputs based on EU DORA RTS and ITS texts.
FAQ on the DORA register of information: who maintains it, which ICT third-party arrangements it covers, template fields, critical functions, reporting, data quality, and evidence.
FAQ on DORA threat-led penetration testing selection: who identifies financial entities, what criteria are used, what the TLPT authority validates, and what evidence to keep.
DORA proportionality explained from official sources: what can be scaled, simplified-framework eligibility, supporting evidence, and duties that remain mandatory.