A defensible way to decide if DORA applies to you - and what layer applies.
Built for regulators and audits: scope memo, evidence inputs, and owner assignments.
Structured answer sets in this page tree.
Cited legal and guidance references.
DORA scope is not a vibe-check. It's a written classification of (1) whether you are a covered financial entity under Article 2, (2) what proportionality/simplified framework applies, and (3) which services in your group are in scope (entity, sub-consolidated and consolidated). This page helps you produce a scope memo you can defend and maintain as your business evolves.
DORA is a sector-specific operational resilience regulation for the financial sector. Its workstreams are concrete: ICT risk management controls, ICT incident management and reporting, resilience testing including TLPT, and ICT third-party risk governance.
Scope decisions drive the cost profile of compliance. For example: TLPT readiness, incident reporting pipelines, and register of information build-outs are not "optional" once in scope.
Research Copilot can take EU DORA Scope & Covered Entities from clarifying scope and applicability with cited answers to a reusable workflow inside Sorena. Teams working on EU DORA can keep owners, evidence, and next steps aligned without copying this guide into separate documents.
Start from EU DORA Scope & Covered Entities and answer scope, timing, and interpretation questions with cited outputs.
Review your current process, evidence gaps, and next steps for EU DORA Scope & Covered Entities.
DORA's primary scope is financial entities listed in Article 2. Start by identifying your authorization/licensing category and map it to the Article 2 list.
Many organizations have multiple regulated entities (bank + investment firm + payment services). Scope each regulated entity separately, then build a group view.
DORA is explicit about proportionality. Requirements are applied considering the nature, scale, complexity and risk profile of the entity and its ICT dependencies.
Some entities can use simplified ICT risk management frameworks and reduced testing requirements; document the basis for the simplification.
DORA third-party risk governance and the register of information explicitly operate at multiple levels: entity level and (where relevant) sub-consolidated and consolidated levels.
This is where programs fail if the operating model is unclear: procurement and vendor management often sit centrally while supervision is entity-based.
DORA also creates an EU oversight framework for critical ICT third-party service providers (CTPPs). Even if you're not a financial entity, you can be impacted if you provide ICT services supporting critical or important functions for in-scope entities.
Financial entities must manage third-party risk and maintain a register of information covering all contractual arrangements for ICT services.
A scope memo is a short document you update over time. It is your single source of truth for: what applies, to whom, and what program owners must deliver.
Use this structure to avoid ambiguity and scope drift.