DORA has applied to financial entities since 17 January 2025

Regulation (EU) 2022/2554 (DORA) has applied since 17 January 2025. It sets uniform requirements for the digital operational resilience of financial entities and their critical ICT third-party providers: ICT risk management, incident classification and reporting, resilience testing, and third-party risk oversight including the register of information.

DORA is live law: supervisors can already ask financial entities for evidence — the register of information, incident reports, testing results. This is an ongoing evidence obligation, not a one-off project.

Banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers and other financial entities in the EU — plus the ICT providers that serve them.

Confirm your register of information is current, your incident classification and reporting flow matches the technical standards now in the Official Journal, and your resilience-testing programme is documented.