DORA (Digital Operational Resilience Act): Overview, requirements, and implementation

What is DORA?

The Digital Operational Resilience Act (DORA) is an EU regulation (Regulation (EU) 2022/2554) designed to strengthen digital operational resilience in the financial sector. Since 17 January 2025, it has applied directly to 20 types of financial entities – from banks and insurers to payment institutions and crypto-asset service providers – and indirectly to their ICT service providers. DORA requires ICT risk management, the reporting of major IT incidents, regular resilience testing and oversight of IT service providers. You can find the full text on EUR-Lex.

The regulation aims to make the European financial system more resilient to cyberattacks and IT outages through uniform requirements. While earlier rules such as BaFin’s BAIT or VAIT were national in nature, DORA creates a harmonised level of protection across all EU member states. Cybersecurity is therefore no longer just an IT task but a direct governance responsibility of management.

DORA at a glance

• Legal form: As an EU regulation, DORA applies directly and does not require transposition. In Germany, the Financial Market Digitalisation Act (FinmadiG) adapted national law, for example BaFin’s supervisory powers and the rules on fines.
• Scope: In addition to banks and insurers, DORA explicitly covers FinTechs, crypto-asset service providers (CASPs under MiCA), payment and e-money institutions and, indirectly, ICT third-party service providers such as cloud and SaaS providers.
• The 5 pillars: ICT risk management, reporting of ICT-related incidents, digital operational resilience testing, management of ICT third-party risk and information sharing.
• Supervision: In Germany, BaFin supervises compliance with DORA. The European Supervisory Authorities EBA, ESMA and EIOPA develop the technical standards and directly oversee critical ICT third-party service providers. Supervisory reviews focus in particular on registers of information and contracts with ICT service providers.

Who does DORA apply to?

DORA applies to 20 types of financial entities and – directly or indirectly – to their ICT third-party service providers. Affected companies include:

• Credit institutions and investment firms
• Payment institutions and e-money institutions
• Insurance and reinsurance undertakings
• Crypto-asset service providers (CASPs) under the MiCA regulation
• Alternative investment fund managers (AIFMs) and UCITS management companies
• ICT third-party service providers: IT service providers, SaaS vendors, data centres and cloud providers that provide services to the financial sector. Providers designated as critical are overseen directly by the European Supervisory Authorities.

Important note for FinTechs and ICT service providers: Even if your B2B software company is not itself regulated as a financial entity, financial clients will contractually require security evidence, audit rights and exit strategies under Art. 30 DORA. Find out exactly who is affected in our article Who is required to comply with DORA?

What are the 5 pillars of DORA?

DORA organises the requirements for digital operational resilience into five core areas:

How does ICT risk management work under DORA?

ICT risk management (Pillar 1) requires companies to maintain a permanent system for managing IT risks. Specifically, this means:

1. Strategy and governance: Management sets the risk tolerance, approves the ICT strategy and regularly undergoes training on cyber risks.
2. Asset management and identification: All ICT assets and business processes are recorded, classified and continuously checked for vulnerabilities.
3. Business continuity: Companies need continuity and contingency plans as well as tested backup and recovery processes.

What are the reporting deadlines for ICT incidents?

For major ICT-related incidents, DORA provides for a three-stage reporting process to the competent supervisory authority (BaFin in Germany):

• Initial notification: within 4 hours of classifying the incident as major, but no later than 24 hours after the entity became aware of it.
• Intermediate report: within 72 hours of the initial notification – and again once normal operations have been restored or significant changes arise.
• Final report: within 1 month of the latest intermediate report, including a root cause analysis.

What does ICT third-party risk management mean?

Third-party risk (Pillar 4) is one of the most demanding areas. Financial entities must systematically monitor all ICT services they use.

The register of information

Every affected financial entity must maintain a register of information in line with the EU’s implementing technical standards (ITS). It contains all contracts with ICT service providers, broken down by critical and non-critical functions, including subcontracting chains.

Contractual requirements under Art. 30 DORA

Contracts with ICT service providers must include, among other things, the following clauses:

• Access and audit rights: unrestricted inspection and audit rights for the financial entity and the supervisory authority.
• SLAs and security levels: precise service level agreements and security standards.
• Subcontractors: clear rules for subcontracting.
• Exit strategies: guaranteed support at the end of the contract, including orderly data migration.

What is the difference between DORA and NIS2?

The key difference lies in the scope and the principle of specialty (lex specialis):

1. Precedence of DORA: For financial entities covered by DORA, DORA takes precedence over the corresponding NIS2 rules on ICT security and reporting obligations. Find out more in our guide NIS2 vs. DORA.
2. Legal form: DORA is an EU regulation and applies directly. NIS2 is a directive that must be transposed into national law – in Germany through the NIS2 Implementation Act, which among other things revises the BSI Act. The competent authority there is the BSI.
3. Replacement of previous standards: BaFin’s BAIT and VAIT circulars have no longer applied to DORA-regulated entities since 17 January 2025; the DORA requirements take their place.

What sanctions apply for DORA violations?

In the event of violations, authorities can take significant measures:

• Periodic penalty payments for critical ICT third-party service providers: up to 1% of average daily worldwide turnover in the preceding business year, for each day of non-compliance and for up to six months.
• National fines: BaFin can impose fines on financial entities; in Germany, the amounts are set out in the FinmadiG.
• Responsibility of management: Management bears ultimate responsibility for ICT risk management. In cases of serious failures, the supervisory authority can also take action against responsible managers.

Implementing DORA compliance in a structured way with heyData

DORA compliance requires a structured record of service providers, contracts and risk assessments. heyData helps FinTechs, financial entities and ICT service providers set up these processes efficiently:

• Structured register of information: recording and management of all ICT service provider contracts in line with EU requirements.
• Contract review under Art. 30 DORA: review of service provider contracts for audit rights, SLAs and exit strategies.
• Audit readiness checks: rapid identification of security and governance gaps before regulatory audits.

Take the first step: Book a free demo now

Further sources and official documents

• EUR-Lex: Regulation (EU) 2022/2554 (DORA full text)
• BaFin: Digital Operational Resilience Act (DORA) topic page