DORA Compliance: What Financial Institutions Need to Know
The EU's Digital Operational Resilience Act is now in force. We break down the key requirements, timelines, and practical steps for financial services firms to achieve compliance.
What is DORA?
The Digital Operational Resilience Act (DORA) entered into full application on 17 January 2025. It applies to financial entities operating within the EU — including banks, investment firms, insurance companies, payment institutions, and crypto-asset service providers — along with their critical ICT third-party service providers.
DORA creates a harmonised framework applicable across the full spectrum of EU financial services entities, replacing the patchwork of national-level requirements with a unified standard.
Key Pillars of the DORA Framework
ICT Risk Management
Entities must implement a comprehensive ICT risk management framework covering the full lifecycle — identification, protection, detection, response, and recovery. Senior management bears direct accountability for ICT risk management, with boards required to define and oversee the ICT risk strategy.
Key requirements include a complete inventory of ICT assets, business impact analyses for all functions supported by ICT, and documented business continuity plans tested regularly.
Incident Reporting
DORA establishes mandatory reporting timelines for major ICT-related incidents:
- Initial notification within 4 hours of classifying an incident as major
- Intermediate report within 72 hours with updated information
- Final report within 1 month of incident resolution with root cause analysis
Digital Operational Resilience Testing
Basic testing — including vulnerability assessments and penetration testing — must be performed at least annually. Threat-Led Penetration Testing (TLPT) is mandatory every three years for significant institutions and must follow the TIBER-EU framework, covering live production systems.
ICT Third-Party Risk Management
All ICT third-party service providers supporting critical functions must have contractual arrangements updated to include DORA-required provisions — covering service levels, audit rights, incident reporting obligations, and termination rights.
Steps to Compliance
Gap assessment. Map current capabilities against DORA requirements. The DoD's own data suggests average institutions have significant gaps when systematically assessed.
Asset and dependency mapping. Establish a comprehensive ICT asset inventory and map all ICT third-party dependencies. Identify which third parties support critical functions and prioritise contract updates.
Incident classification and reporting. Develop criteria for classifying incidents as major. Establish reporting workflows with template documentation and regulatory notification procedures.
Testing programme. Develop a testing calendar including vulnerability assessments and penetration tests, with TLPT planning if applicable.
Board engagement. DORA places explicit accountability at senior level. Ensure governance structures clearly assign ICT risk ownership.
Common Compliance Gaps
Organisations consistently encounter: incomplete ICT asset inventories missing shadow IT and legacy systems; incident classification criteria misaligned with DORA thresholds; pre-DORA third-party contracts lacking required provisions; and testing programmes that don't extend to live production systems as TLPT requires.