DORA at a glance
DORA (Digital Operational Resilience Act), or Regulation (EU) 2022/2554, sets a single framework for digital operational resilience across the European financial sector. The regulation defines this as the ability to withstand, respond to and recover from any disruption related to information technology. Published in late 2022, it has applied since January 17, 2025. As a regulation, it applies directly in the member states, with no national transposition.
The regulation's scope covers some 20 categories of financial entities: banks, payment institutions, e-money institutions, investment firms, insurers, crypto-asset service providers (CASPs), and more. For the first time, it also covers the ICT third-party service providers these entities depend on, including the major cloud providers.
The five pillars
DORA is built around five pillars that complement one another. The European Supervisory Authorities (EBA, ESMA, EIOPA) spell out the details in technical standards (RTS / ITS).
| Pillar | Topic | What is expected in practice |
|---|---|---|
| 1. ICT risk management | Risk governance and control | Documented framework, management body accountability, asset mapping |
| 2. Incident management | Detection, classification, reporting | Incident process, severity thresholds, harmonized reporting to authorities |
| 3. Resilience testing | Putting defenses to the test | Regular testing; advanced testing (TLPT) for significant entities |
| 4. Third-party risk | Dependency on ICT providers | Register of information, contractual clauses, concentration management |
| 5. Information sharing | Threat intelligence | Voluntary sharing of cyber threat indicators among entities |
Major incident reporting
DORA harmonizes the reporting of major ICT incidents across the European financial sector. The entity must first classify the incident against common criteria: clients affected, duration, data losses, economic impact and geographic reach. An incident classified as major then triggers a sequence of reporting deadlines to the competent authority.
These templates and deadlines are set by technical standards (RTS/ITS) drafted by the European authorities. The practical challenge is the need to classify incidents quickly and to have a reporting channel already in place. The four-hour window runs during crisis management itself.
Advanced testing (TLPT) and critical ICT providers
The testing pillar culminates in TLPT (Threat-Led Penetration Testing), a penetration test built on realistic threat scenarios and modeled on the European TIBER-EU framework. An offensive team (red team) runs it against the tested entity's production systems. Only the most significant entities are subject to it, at least every three years.
The third-party pillar sets up a direct oversight framework for critical ICT third-party providers (CTPPs), designated at EU level and overseen by a lead overseer drawn from the European Supervisory Authorities. This framework is the regulation's main innovation. It targets concentration risk: an entire sector depends on a handful of large cloud providers whose failure would be systemic.
DORA and NIS2: lex specialis
DORA coexists with the NIS2 Directive (Directive (EU) 2022/2555). This directive is the EU's general cybersecurity framework for essential and important entities in many sectors (energy, health, transport, digital…). For the financial sector, DORA acts as lex specialis, so its more specific rules take precedence over the equivalent provisions of NIS2.
| Criterion | DORA | NIS2 |
|---|---|---|
| Type | Regulation (directly applicable) | Directive (each state must transpose it) |
| Scope | Financial sector + ICT providers | Essential and important sectors (broad) |
| In force | January 17, 2025 | Transposition due by October 17, 2024 |
| Focus | Detailed digital operational resilience | General cybersecurity and governance framework |
| Relationship | Lex specialis for finance | General framework |
Unlike DORA, NIS2 must be transposed into each national law. In France, this work, led with ANSSI (France's national cybersecurity agency) as the competent authority, fell behind the EU deadline of October 17, 2024. The bill on critical infrastructure resilience and cybersecurity, passed by the Senate in March 2025, had still not been finally adopted as of September 2026. For a payment institution, the reference text remains DORA, although a diversified group can fall under both texts depending on its subsidiaries.
Elsewhere in the world. The same mechanism, elsewhere.
The deadline for reporting a major IT incident to the financial supervisor
In the US, the joint rule of the OCC, the Federal Reserve and the FDIC (12 CFR Parts 53, 225 and 304, in effect since May 1, 2022) requires a banking organization to notify its primary federal regulator as soon as possible and no later than 36 hours after determining that a “notification incident” has occurred. The bank service provider, for its part, must notify each affected bank customer as soon as possible once it determines that an incident has caused, or is reasonably likely to cause, a material disruption or degradation of service for four or more hours.
Federal Register, 86 FR 66424, November 23, 2021, https://www.govinfo.gov/content/pkg/FR-2021-11-23/pdf/2021-25510.pdf
In Australia, APRA's prudential standard CPS 234 requires notification as soon as possible and in any case no later than 72 hours after becoming aware of an information security incident that materially affected, or had the potential to materially affect, the entity or the interests of its customers (§ 35). A material information security control weakness that the entity does not expect to fix in a timely manner must be reported within 10 business days (§ 36).
APRA, Prudential Standard CPS 234 Information Security, July 2019, §§ 35-36, https://www.apra.gov.au/sites/default/files/cps_234_july_2019_for_public_release.pdf
In Canada, the Office of the Superintendent of Financial Institutions (OSFI) advisory on technology and cyber security incident reporting requires federally regulated financial institutions to report an incident to OSFI's Technology Risk Division and their Lead Supervisor within 24 hours, or sooner if possible. The reporting threshold includes any incident the institution rates as high or critical severity.
OSFI, advisory “Technology and Cyber Security Incident Reporting,” https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/technology-cyber-security-incident-reporting
Oversight of the IT providers the financial sector depends on
In the UK, the Financial Services and Markets Act 2000 allows HM Treasury to designate a provider as a critical third party. Once designated, it is supervised directly and jointly by the Bank of England, the PRA and the FCA, which can make rules for it, require information, and take enforcement action. UK regulators and the European Supervisory Authorities have signed a memorandum of understanding to coordinate this oversight on both sides.
Bank of England, Critical Third Parties (CTPs), https://www.bankofengland.co.uk/financial-stability/operational-resilience-of-the-financial-sector/critical-third-parties
In Australia, CPS 230, in effect since July 1, 2025, requires entities to keep a register of material service providers and submit it to APRA every year. Core technology services, risk management and internal audit are deemed material by default for all regulated entities. Any new or amended arrangement covering a critical operation must be notified to APRA within 20 business days, and any planned offshoring arrangement before it is entered into.
APRA, Prudential Standard CPS 230 Operational Risk Management, §§ 49-51 and 59, https://www.apra.gov.au/system/files/2023-07/Prudential%20Standard%20CPS%20230%20Operational%20Risk%20Management%20-%20clean.pdf
The US has no sector-wide status for critical IT providers under direct supervision. On June 6, 2023, the OCC, the Federal Reserve and the FDIC issued single interagency guidance on third-party risk management. It replaces each agency's own guidance and sets out principles that each bank applies in proportion to its size, complexity and risk profile.
Federal Reserve Board, press release “Agencies issue final guidance on third-party risk management,” June 6, 2023, https://www.federalreserve.gov/newsevents/pressreleases/bcreg20230606a.htm
The disruption tolerance set for a critical service
In the UK, the PRA's supervisory statement SS1/21, published on March 29, 2021, requires each bank, building society and designated investment firm to identify its important business services and set an impact tolerance for each, meaning the maximum tolerable level of disruption, then show that it can stay within it.
Bank of England / PRA, SS1/21 Operational resilience: Impact tolerances for important business services, https://www.bankofengland.co.uk/prudential-regulation/publication/2021/march/operational-resilience-impact-tolerances-for-important-business-services-ss
In Australia, CPS 230 requires entities to set tolerance levels for each critical operation, then notify APRA as soon as possible and no later than 24 hours after a disruption that exceeds that tolerance. The notification must describe the nature of the disruption, the action taken, the likely impact on the business, and the timeframe for returning to normal operations (§ 42).
APRA, Prudential Standard CPS 230 Operational Risk Management, § 42, https://www.apra.gov.au/system/files/2023-07/Prudential%20Standard%20CPS%20230%20Operational%20Risk%20Management%20-%20clean.pdf
In Canada, OSFI's Guideline E-21, published on August 22, 2024, requires institutions to map their critical operations end to end, including internal and external dependencies, and to set a tolerance for disruption. OSFI defines it as the maximum disruption the institution can absorb in a crisis, a separate threshold that is generally wider than its operational risk appetite.
OSFI, Guideline E-21 on operational risk management and resilience, August 22, 2024, https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/operational-risk-management-resilience-guideline