This page helps classify DORA scope by entity type, ICT service dependency, critical or important function, and group-level evidence.
Based on DORA, register-of-information templates, and EU technical standards for ICT third-party providers supporting critical or important functions.
Structured answer sets in this page tree.
Cited legal and guidance references.
DORA has applied since 17 January 2025. Scope work should start with a classification record, not a generic cyber checklist. The useful question is whether the legal entity is a DORA , whether an ICT third-party provider is involved, whether the ICT service supports a critical or important function, and whether the evidence must be held at entity, branch, sub-consolidated, or consolidated level.
DORA Article 2 lists the covered categories and separately includes ICT third-party service providers. The financial-entity list covers banks, payment and e-money institutions, account information service providers, investment firms, crypto-asset service providers and issuers of asset-referenced tokens, central securities depositories, central counterparties, trading venues, trade repositories, fund managers and management companies, data reporting service providers, insurance and reinsurance undertakings, insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries, IORPs, credit rating agencies, administrators of critical benchmarks, crowdfunding service providers, and securitisation repositories.
A scope record should therefore identify the exact authorised entity, its regulated category, its competent-authority perimeter, and any branch or group role. Do not classify a product team, platform, or supplier as in scope until the legal entity using or providing the ICT service has been named.
Article 2, its exclusions, Article 4 proportionality, and Article 16's simplified-framework branch are binding legal tests. The classification record and evidence fields below are practical documentation controls, not a separate legal category or supervisory approval.
DORA excludes specific categories from Article 2 scope, including AIFMs referred to in Article 3(2) of the AIFMD, insurance and reinsurance undertakings referred to in Article 4 of Solvency II, IORPs operating schemes with no more than 15 members in total, MiFID-exempt natural or legal persons, insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries that are micro, small, or medium-sized enterprises, and post office giro institutions. Member States may also exclude certain CRD Article 2(5) entities located in their territory.
Proportionality is not an exemption from DORA. Article 4 ties implementation to the 's size, overall risk profile, and the nature, scale, and complexity of its services, activities, and operations. Article 16 separately assigns a simplified ICT risk management framework to defined categories, including small and non-interconnected investment firms, certain sectorally exempt payment and electronic money institutions, certain small IORPs, and institutions exempted under Directive 2013/36/EU. The scope record must distinguish an Article 2 exclusion, an Article 16 simplified-framework classification, and ordinary proportionate implementation.
DORA defines a critical or important function by the consequence of disruption or defective performance: material impairment to the 's performance, soundness, service continuity, authorisation conditions, or other financial-services obligations. Scope analysis should therefore connect each ICT service to the business function it supports and to the consequence of losing that service.
The register-of-information templates make this classification operational. They ask for the function identifier, the using the ICT service, whether the service supports a critical or important function, data location and sensitivity where relevant, reliance level, substitutability, alternatives, and subcontractors that effectively underpin services supporting critical or important functions.
DORA defines an ICT third-party service provider as an undertaking providing ICT services and defines ICT services broadly as digital and data services provided through ICT systems on an ongoing basis, excluding traditional analogue telephone services. Intragroup ICT service providers are not outside the analysis; the DORA contract-policy RTS says intragroup providers should be considered ICT third-party service providers for the policy.
For ICT services supporting critical or important functions, the record should show the direct provider, any intragroup links, the ICT service supply chain, and subcontractors that effectively underpin the service. Subcontracting risk does not transfer ultimate responsibility away from the 's management body.
A 's DORA scope decision is separate from the EU process for designating critical ICT third-party service providers. A cloud, software, data-centre, managed-security, or other ICT provider may be important to one financial entity even if it has not been designated critical by the ESAs. Conversely, ESA criticality designation is assessed using systemic criteria across financial entities and categories.
Delegated Regulation 2024/1502 specifies a two-step ESA assessment for critical ICT third-party providers. It uses factors such as the share of financial entities using the same ICT services for critical or important functions, systemic character of the financial entities relying on those services, the critical nature of the ICT service, and substitutability or migration difficulty.
No. DORA Article 2 covers many types, including payment, e-money, investment, crypto-asset, market infrastructure, fund, insurance, pension, rating, benchmark, crowdfunding, and securitisation-repository entities, plus ICT third-party service providers.
No. A supplier can support a 's critical or important function without being designated critical by the ESAs. Critical-provider designation is a separate supervisory process based on systemic impact, financial-entity reliance, service criticality, and substitutability.
Keep the legal-entity classification, regulated activity, branch or group role, Article 2 category or exclusion, function map, ICT service and provider identifiers, contractual reference numbers, critical-or-important-function assessment, reliance level, alternatives assessment, and approval history.
Sorena can help convert DORA scope questions into cited entity classifications, provider maps, critical-function decisions, and register-ready evidence fields.
Ask questions tied to cited sources about DORA entity scope, ICT provider classification, critical or important functions, and register evidence.
Review your DORA scope classification, group register structure, and ICT third-party evidence gaps with Sorena.
"two-step approach"
"ICT intra-group service providers"
"ultimate responsibility"
"designation of critical"
"critical or important function"