DORA has applied to financial entities since 17 January 2025

Regulation (EU) 2022/2554 (DORA) has applied since 17 January 2025. It sets uniform requirements for the digital operational resilience of financial entities across ICT risk management, ICT-related incident classification and reporting, digital operational resilience testing, management of ICT third-party risk — including the register of information on all contractual arrangements with ICT providers — and oversight of critical ICT third-party providers. The framework has since been completed by technical standards in the Official Journal (incident-reporting RTS/ITS, February 2025) and activated in supervision (first critical-provider designations, November 2025) — both recorded as separate items in this feed.

DORA is live law with an active supervisory apparatus: competent authorities can request the register of information, incident reports and testing evidence at any time. The obligation is continuous — the question is not whether a DORA project was done, but whether the evidence is current today.

Banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers and other financial entities in the EU, plus the ICT providers serving them — with day-to-day ownership usually split between risk, security and vendor-management teams.