DORA, Regulation (EU) 2022/2554 on digital operational resilience for the financial sector, requires the financial entities within its scope to manage the risk of information and communication technology (ICT): incidents, resilience testing and technology suppliers. It has applied since 17 January 2025. It is not a certification and it is not achieved by buying a tool.
This entry is general information and is not legal advice. Verified on 15 October 2026 against the text of the Regulation in the Official Journal of the EU (copy published by the Spanish BOE), in particular Articles 2, 4, 17, 19, 24, 26, 28, 30, 31 and 64.
Who it applies to
Article 2 lists the entities affected: credit, payment and electronic money institutions, investment firms, insurers and fund managers, among others, with some exclusions. A company working for the financial sector, or calling itself a fintech, does not become a financial entity for that reason alone. The rules apply proportionately to size and risk profile (Article 4), which is not a general exemption.
What it requires
The Regulation rests mainly on four blocks: a documented ICT risk management framework; handling of all ICT incidents and reporting of major ones to the competent authority (Articles 17 and 19); a resilience testing programme, not required as such of micro-enterprises, with tests at least once a year of the systems supporting critical or important functions and, for entities the authority designates, advanced threat-led penetration testing at least every three years (Articles 24 and 26); and management of ICT supplier risk.
That includes a register of all contractual arrangements with ICT service providers (Article 28) and minimum contract clauses (Article 30): a description of the services, where data is processed, assistance during incidents, data recovery and termination rights. The entity remains responsible for compliance even when it outsources.
Example
Illustrative example, not a real case. A financial entity within DORA's scope hosts its platform with a cloud provider. It must record that arrangement in its register, distinguish whether it supports a critical or important function, check that the contract contains the required clauses and confirm that it can recover its data if the provider stops delivering the service.
Limits
DORA is completed by technical standards and by each authority's supervision, and those texts evolve: always confirm the current ones. Only ICT providers designated as critical by the European authorities (Article 31) come under their direct oversight; the rest are affected mainly through contracts.
When to call an expert
Ask for help if you do not know whether your entity is within DORA's scope, if a financial customer sends you an addendum or a questionnaire or if it is unclear how systems are recovered after a major incident. The scope and the specific obligations must be confirmed by your compliance team or a legal professional.
At Impulso Tecnológico we work on diagnosis, technical controls and training: we review access, backups and recovery, put in the technical controls that are missing and train the team. We do not give legal advice; our work is technical and training-based. See our cybersecurity service, the page on financial services (sector information, not a DORA compliance service) or tell us about your case.
Learn more
Related glossary terms: NIS2, ISO 27001 and RPO and RTO.
Official sources: Regulation (EU) 2022/2554 in the Official Journal (Spanish-language copy; other languages are on EUR-Lex), the ESMA page on DORA and the EBA page.