DORA REGULATION

DORA is a legislative framework that sets rules regarding cybersecurity and IT risk management for numerous financial entities. What is the DORA regulation? What is its effective date and scope of application? What obligations does it impose? We answer all your questions!

Who is affected by the DORA regulation?

Financial entities

DORA targets a broad range of financial sector stakeholders directly exposed to risks arising from the increasing digitalization of services. Entities covered include:

• Credit institutions: Traditional banks and financial institutions managing massive volumes of sensitive data.
• Payment institutions: Electronic payment solution providers, such as fintech companies.
• Crypto-asset service providers: Trading platforms and digital wallet providers.
• Insurance and reinsurance undertakings: Entities offering financial protection against various risks.
• Asset managers: Investment funds and wealth managers.
• ICT third-party service providers: Vendors specializing in IT infrastructure, cloud computing, or cybersecurity.

Exceptions and thresholds

Certain small businesses or non-systemic entities, depending on their size or potential impact on the overall financial system, may be exempt from the strictest requirements. These exemptions are intended to ensure a proportionate application of DORA, while maintaining an adequate level of security.

Geographical scope

DORA's geographical scope covers all European Union Member States. This means that any entity operating within these jurisdictions—even if headquartered outside the EU—must comply with the regulation's requirements if it provides financial or technology services within the EU.

3 reasons why DORA is critical for the financial sector

DORA's broad scope reflects the critical importance of digital resilience in an increasingly interconnected financial ecosystem. Here is why this regulation is vital:

1. Protecting sensitive data: Financial entities handle large volumes of personal and financial data. Safeguarding this information is paramount to maintaining consumer trust.
2. Preventing service disruptions: Cyberattacks or technological outages can severely disrupt operations. DORA aims to minimize these interruptions through robust business continuity policies.
3. Mitigating systemic risks: By ensuring that even third-party providers adhere to high cybersecurity standards, DORA limits the potential impact of an attack across the entire financial system.

Key dates to remember

DORA Key Dates Timeline

The European Union has established crucial milestones to ensure compliance for the entities concerned. Here are the deadlines you need to keep in mind:

• September 24, 2020: Proposal for a Regulation of the European Parliament and of the Council on digital operational resilience for the financial sector (DORA)
• February 24, 2021: Opinion of the European Economic and Social Committee
• May 10, 2021: Opinion of the European Data Protection Supervisor
• June 4, 2021: Opinion of the European Central Bank
• May 10, 2022: Provisional agreement reached between the European Parliament and the Council
• November 10, 2022: Plenary vote and adoption of the regulation
• December 14, 2022: Regulation of the European Parliament and of the Council
• December 27, 2022: Publication in the Official Journal of the European Union
• January 16, 2023: Entry into force of DORA
• January 17, 2025: DORA enters into application

Key obligations under this European regulation

The DORA regulation imposes strict obligations on financial institutions and ICT service providers to strengthen their resilience against digital threats. Here is an overview of the main requirements:

Risk governance
Financial entities must implement a sound Information and Communication Technology (ICT) risk management framework. This includes developing a digital resilience strategy aligned with the overall corporate strategy, establishing business continuity and disaster recovery plans, and ensuring direct oversight of ICT policies by management bodies.

Incident management
Entities must detect, manage, and classify ICT-related incidents according to their severity, notify major incidents to competent authorities within strict timeframes (typically within 24 hours of detection), and provide detailed reports on the nature, impact, and remediation measures taken.

Resilience testing
Entities must conduct regular resilience testing of their IT systems, including advanced threat-led penetration testing (TLPT) for entities identified as critical or systemic. These tests simulate real-world attacks to assess system robustness against sophisticated cyber threats.

Third-party risk management
With the increasing outsourcing of ICT services, DORA introduces stringent requirements. Organizations must assess risks associated with their ICT third-party service providers and include specific contractual arrangements on ICT risk management, data confidentiality, and service continuity, while remaining fully responsible for DORA compliance even when services are outsourced.

Information sharing
DORA encourages the voluntary sharing of information among financial institutions regarding cyber threats, vulnerabilities, and best practices, as well as cooperation with authorities and other entities to enhance the collective response to cyber risks.

Sanctions provided for by DORA

In the event of non-compliance, DORA provides for deterrent sanctions to ensure adherence to obligations. Key measures include:

Financial penalties: Financial entities that fail to comply with DORA requirements may face fines of up to €10 million or 5% of their total annual turnover.

Periodic penalty payments for critical third-party providers: ICT third-party service providers designated as critical that fail to comply with their obligations may be subject to daily penalty payments for up to six months, amounting to 1% of their average daily worldwide turnover.

Powers of competent authorities: National supervisory authorities hold broad investigative and sanctioning powers, including on-site inspections, formal injunctions, and the authority to temporarily or permanently suspend practices deemed contrary to DORA.