🇪🇺European Union
DORA compliance in the EU
DORA (Regulation 2022/2554) creates a unified ICT risk management framework for all EU financial entities. It applies to over 22,000 entities including banks, insurers, investment firms, crypto-asset providers, and their critical ICT suppliers.
Enforcement authority
ESAs (EBA, ESMA, EIOPA) for oversight framework designation; national competent authorities (NCAs) for enforcement
Maximum sanctions
National authorities determine penalties. Critical ICT providers face fines up to 1% of average daily worldwide turnover for up to 6 months. Periodic penalty payments of up to 0.5% of daily turnover.
Key obligations
What DORA requires from organizations operating in the EU.
Implement a comprehensive ICT risk management framework with board-level oversight
Report major ICT incidents to national authorities within strict timelines
Conduct advanced threat-led penetration testing (TLPT) every 3 years for significant entities
Maintain a register of all ICT third-party contracts and conduct concentration risk analysis
Share cyber threat intelligence with other financial entities and authorities
Local context in the EU
DORA became applicable on January 17, 2025. The ESAs have published Regulatory Technical Standards (RTS) and Implementing Technical Standards (ITS) that detail specific requirements. Critical ICT third-party providers are directly supervised at EU level.
Frequently asked questions
How does DORA apply in the EU?
DORA (Regulation 2022/2554) creates a unified ICT risk management framework for all EU financial entities. It applies to over 22,000 entities including banks, insurers, investment firms, crypto-asset providers, and their critical ICT suppliers.
Who enforces DORA in the EU?
ESAs (EBA, ESMA, EIOPA) for oversight framework designation; national competent authorities (NCAs) for enforcement
What are the penalties for DORA non-compliance?
National authorities determine penalties. Critical ICT providers face fines up to 1% of average daily worldwide turnover for up to 6 months. Periodic penalty payments of up to 0.5% of daily turnover.
DORA in other jurisdictions
Check your DORA compliance now
Start free scan to see your risk score and applicable obligations.