DORA (Digital Operational Resilience Act)
Also known as: DORA, Digital Operational Resilience Act, Regulation (EU) 2022/2554, EU financial resilience regulation
DORA, the Digital Operational Resilience Act, is an EU regulation that requires banks, insurers, investment firms, payment companies, and other financial entities to withstand, respond to, and recover from technology disruptions.
While earlier rules treated IT risk as a footnote to financial risk, DORA treats it as a core prudential concern. It also reaches beyond banks to the critical tech providers they depend on, such as major cloud companies.
DORA (Digital Operational Resilience Act), explained at three levels
At home
Think of DORA as a fire drill rulebook for banks' technology. Financial firms must plan for systems crashing, cyberattacks, or a key supplier going down, practise their response, and recover quickly. So if your bank's app fails, DORA is the reason the bank should have a tested plan to restore service, and it must report serious incidents to its regulator.
At work
DORA is an EU regulation that sets one rulebook for the digital resilience of about 20 types of financial entities, including banks, insurers, investment firms, and payment and crypto-asset firms. It requires them to manage information and communication technology (ICT) risk, report major incidents, test their defences, and control risk from tech suppliers. Businesses care because it applies directly across the EU and reaches the tech vendors serving those firms.
At home
DORA's incident rules work in stages. When a financial firm classifies an IT problem as 'major,' based on criteria like how many clients are affected, how long it lasts, and whether data was lost, it must send an initial notification to its regulator within hours, then an intermediate report and a final report. If clients' financial interests are affected, the firm must tell them too. Regulators pool these reports to spot problems hitting several firms at once.
At work
DORA rests on five pillars: ICT risk management under a framework approved by the management body, incident classification and reporting, resilience testing including threat-led penetration testing at least every three years for significant firms, ICT third-party risk management, and voluntary information sharing. Contracts with tech providers must include specific terms, such as service descriptions, data locations, audit and access rights, incident support, and exit strategies, with stronger terms for services supporting critical or important functions.
At home
The deeper worry behind DORA is concentration risk. Much of European finance runs on a few cloud providers, so one major outage could hit many banks at once. DORA responds by designating critical ICT third-party providers and putting them under direct oversight by EU supervisors, who can inspect them and issue recommendations. In my view, treating that as a system-wide risk is right, but it can't remove the dependency, only make it visible and better managed.
At work
Day-to-day compliance centres on the register of information, a standardized inventory of every ICT contract and the functions it supports, submitted to supervisors each year. Firms must map critical or important functions, document exit strategies, and run incident workflows that meet DORA's tight timelines. Critical ICT providers face oversight led by the European Supervisory Authorities, with periodic penalties of up to 1% of average daily worldwide turnover. For non-EU vendors, DORA arrives through contract clauses even if they are not directly regulated.
Real-world examples
At home
Lena, living in Amsterdam, couldn't access her bank's app for several hours one morning. The bank later sent a notice explaining the outage and what it was doing to prevent a repeat. Under DORA, the bank also had to report the incident to its regulator.
At work
Jerome is a vendor manager at a Canadian software company that sells to European banks. After DORA took effect, his clients demanded new contract clauses covering audit rights, incident reporting, and exit support. His team created a standard DORA addendum to speed up negotiations.
How it compares
| feature | DORA (Digital Operational Resilience Act) | NIS2 Directive |
|---|---|---|
| Who it covers | EU financial entities and critical ICT providers | Many sectors, including energy, health, transport, and digital |
| Legal form | Regulation, applies directly | Directive, implemented by national laws |
| Focus | Operational resilience of finance | Cybersecurity across critical sectors |
| Third-party oversight | Direct oversight of critical ICT providers | Supply chain security requirements |
| Applies from | January 17, 2025 | National laws due by October 2024 |
DORA is the financial sector's specialized resilience law; NIS2 is the broader cybersecurity law.
For analysts
DORA's register of information is a gift if you use it well. I'd treat it as a living map of your technology dependencies, not a once-a-year filing, because it answers the question every incident manager asks first: what else does this outage break?
History & origin
The European Commission proposed DORA in September 2020 as part of its digital finance package, after years of growing concern about cyberattacks and the financial sector's dependence on a handful of cloud providers. DORA was adopted in December 2022 and applied from January 17, 2025, along with detailed technical standards developed by the European Supervisory Authorities. Financial entities had to submit registers of their ICT third-party arrangements in 2025, and the authorities published the first list of designated critical ICT third-party providers, which come under direct EU oversight, in late 2025. In my opinion, DORA's oversight of critical tech providers is the most significant part. It's the first time EU financial regulators can directly supervise the cloud companies that the system runs on.