Digital compliance for fintech and financial firms
DORA (Regulation (EU) 2022/2554) requires digital operational resilience from banks, insurers, fund managers, payment institutions, crypto-asset service providers and other European financial entities, and, through their contracts, from the technology providers that serve them. It has been mandatory since January 17, 2025.
This guide summarizes the regulation in plain language and does not replace legal advice. Always check the official text before making decisions.
What DORA is
It applies to European financial entities of any size and their technology providers, and rests on five pillars.
ICT risk management
A governance framework to identify, protect, detect, respond to and recover from technology incidents.
ICT incident management and reporting
Classify incidents and report major ones to your supervisor within hours: initial notification, intermediate report and final report.
Digital resilience testing
Periodic testing of your critical systems, with advanced penetration testing (TLPT) for the most significant entities.
ICT third-party risk
A register of information on all your ICT providers —flagging those that support critical or important functions— and mandatory contractual clauses.
Information sharing
Voluntary arrangements to share cyber-threat and vulnerability intelligence with other financial entities.
Timeline and deadlines
01 / December 2022
Regulation published
Regulation (EU) 2022/2554 (DORA) is published alongside its accompanying directive.
02 / 2023 – 2024
Adaptation period
Financial entities prepare while the European Supervisory Authorities (ESAs) publish the technical standards.
03 / January 17, 2025
Full application
DORA becomes directly applicable across the EU, with no national transposition. It has been mandatory since then: supervisors can already enforce it on entities still adapting.
Jan 2025
Full application
5
DORA pillars
24 hours
Major incident alert
1% daily
Max. fine, critical ICT
Sanctions
DORA doesn’t set a single fine for financial entities — each national supervisor (or European, for the ESAs) applies its own regime. It’s different for critical ICT providers under direct EU oversight.
| Entity type | Sanction | Examples |
|---|---|---|
| Financial entities | Sanctions regime set by each national competent authority | Banks, insurers, fund managers, investment firms, payment institutions, crypto-asset service providers and licensed fintechs. |
| Critical ICT providers | Up to 1% of average daily global turnover, per day, for up to 6 months | Technology providers designated as critical, under direct oversight of the European Supervisory Authorities (ESAs). |
What ISO 27001 gives you for DORA
ISO 27001 is a good base for DORA: many of its security measures apply here too. But it doesn’t cover all of it: the regulation adds obligations of its own that ISO 27001 doesn’t address, such as reporting major incidents to your supervisor, advanced penetration testing (TLPT) or the register of information on ICT providers.
What it means for your SME
If you’re a licensed financial entity (bank, insurer, fund manager, payments fintech), DORA applies to you directly, regardless of size, though the principle of proportionality reduces requirements for smaller ones.
If you’re a technology provider serving a financial entity, you’ll likely be asked to meet DORA contractual clauses, even if you’re not directly regulated.
6 minimum requirements
- A register of information on all your ICT providers
- An ICT risk management policy
- A digital resilience testing plan
- An ICT continuity plan
- A major incident notification procedure
- DORA contractual clauses with your ICT providers
Official sources
This guide is a summary. For the legal detail, consult the regulation’s text directly.
Official DORA text on EUR-Lex →ISO 27001 as the base, DORA included
Kardu organizes your compliance evidence around ISO 27001 and maps it to DORA and any other frameworks that apply to you, so you don’t duplicate work across regulations.