Loading...
Regulation on digital operational resilience for the financial sector
The Digital Operational Resilience Act establishes a comprehensive ICT risk management framework for financial entities across the EU. It applies to 20 types of financial entities and their critical ICT third-party service providers, requiring robust incident management, resilience testing, and third-party oversight.
64
Articles
20
Entity Types in Scope
9
Chapters
Jan 2025
Enforced
27 December 2022
Published in Official Journal of the EU
16 January 2023
Entered into force
17 January 2024
First batch of RTS/ITS published by ESAs
17 July 2024
Second batch of RTS/ITS published by ESAs
17 January 2025
Full application - all requirements enforceable
Comprehensive governance and organisation for ICT risk, covering identification, protection, detection, response, recovery, and communication. Includes simplified framework for smaller entities (Art. 16).
Mandatory incident management process, classification of ICT incidents and cyber threats, and reporting of major incidents to competent authorities. Includes harmonised reporting templates.
Annual testing of all ICT systems supporting critical functions. Includes advanced threat-led penetration testing (TLPT) for systemically important entities.
Strategy and policy for ICT third-party risk. Mandatory contractual provisions, due diligence, continuous monitoring, and an EU oversight framework for critical ICT providers.
Voluntary exchange of cyber threat information and intelligence between financial entities to enhance collective digital operational resilience.
Member State discretion
Article 50 delegates penalty-setting to Member States. Penalties must be effective, proportionate and dissuasive. Member States may also impose criminal penalties (Art. 52).
1% avg daily worldwide turnover
Lead Overseer can impose periodic penalties of up to 1% of average daily worldwide turnover for up to 6 months for non-compliance (Art. 35(8)).
Schedule a consultation with our regulatory experts to assess your DORA compliance posture and build a practical roadmap.