EU DORA Scope and Covered Entities

DORA Article 2 lists the covered financial entity categories and separately includes ICT third-party service providers. The financial-entity list covers banks, payment and e-money institutions, account information service providers, investment firms, crypto-asset service providers and issuers of asset-referenced tokens, central securities depositories, central counterparties, trading venues, trade repositories, fund managers and management companies, data reporting service providers, insurance and reinsurance undertakings, insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries, IORPs, credit rating agencies, administrators of critical benchmarks, crowdfunding service providers, and securitisation repositories.

A scope record should therefore identify the exact authorised entity, its regulated category, its competent-authority perimeter, and any branch or group role. Do not classify a product team, platform, or supplier as in scope until the legal entity using or providing the ICT service has been named.

DORA excludes specific categories from Article 2 scope, including AIFMs referred to in Article 3(2) of the AIFMD, insurance and reinsurance undertakings referred to in Article 4 of Solvency II, IORPs operating schemes with no more than 15 members in total, MiFID-exempt natural or legal persons, insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries that are micro, small, or medium-sized enterprises, and post office giro institutions. Member States may also exclude certain CRD Article 2(5) entities located in their territory.

Proportionality is not an exemption from DORA. Article 4 ties implementation to the financial entity's size, overall risk profile, and the nature, scale, and complexity of its services, activities, and operations. The practical output is a narrower or simpler control and evidence set where justified, not a blank scope decision.

DORA defines a critical or important function by the consequence of disruption or defective performance: material impairment to the financial entity's performance, soundness, service continuity, authorisation conditions, or other financial-services obligations. Scope analysis should therefore connect each ICT service to the business function it supports and to the consequence of losing that service.

The register-of-information templates make this classification operational. They ask for the function identifier, the financial entity using the ICT service, whether the service supports a critical or important function, data location and sensitivity where relevant, reliance level, substitutability, alternatives, and subcontractors that effectively underpin services supporting critical or important functions.

DORA defines an ICT third-party service provider as an undertaking providing ICT services and defines ICT services broadly as digital and data services provided through ICT systems on an ongoing basis, excluding traditional analogue telephone services. Intragroup ICT service providers are not outside the analysis; the DORA contract-policy RTS says intragroup providers should be considered ICT third-party service providers for the policy.

For ICT services supporting critical or important functions, the record should show the direct provider, any intragroup links, the ICT service supply chain, and subcontractors that effectively underpin the service. Subcontracting risk does not transfer ultimate responsibility away from the financial entity's management body.

A financial entity's DORA scope decision is separate from the EU process for designating critical ICT third-party service providers. A cloud, software, data-centre, managed-security, or other ICT provider may be important to one financial entity even if it has not been designated critical by the ESAs. Conversely, ESA criticality designation is assessed using systemic criteria across financial entities and categories.

Delegated Regulation 2024/1502 specifies a two-step ESA assessment for critical ICT third-party providers. It uses factors such as the share of financial entities using the same ICT services for critical or important functions, systemic character of the financial entities relying on those services, the critical nature of the ICT service, and substitutability or migration difficulty.