All regulations / EU Financial sector
DORA
Know the rule before it knows you.
Operational resilience rules for finance, pushed down the supply chain to every ICT provider.
What it is
DORA harmonises how banks, insurers, investment firms, payment and crypto-asset service providers manage ICT risk, report incidents, test resilience and control third-party ICT providers. Those providers, including SaaS and cloud vendors, must accept detailed contractual terms, and the most critical ones fall under direct EU oversight.
This applies to you if
- You are a regulated financial entity, including a fintech, payment institution or crypto-asset service provider
- You sell software, cloud, data or managed services to banks, insurers or other financial entities
- You process or host data that supports a financial entity's critical functions
What it asks of you
- An ICT risk management framework approved and overseen by the board
- Classification and reporting of major ICT incidents within tight deadlines
- Regular resilience testing, including threat-led penetration testing for larger entities
- A register of ICT third-party arrangements and mandatory contract clauses: service levels, audit rights, exit and termination, incident support, data location
- For ICT providers: contractual readiness, security evidence and cooperation with audits
What it costs to ignore
Supervisory measures and fines set by national regulators (DNB and AFM in the Netherlands); for critical third-party providers, EU-level periodic penalties.
Key dates
Applicable since 17 January 2025. Contract remediation with existing suppliers is a live topic throughout 2026.
How we help
Not sure which apply to you? Send us three lines about what you sell and to whom, and we will tell you which rules matter and which do not.
Have a regulatory question?
Send a short description of your situation. We reply within one working day, usually with a view on scope and a fixed fee where possible.