DORA Regulation (EU) 2022/2554: digital operational resilience for financial entities
Obliges banks, insurers, investment firms and other financial entities to manage ICT risk, report incidents, test resilience and control ICT suppliers by contract; data centre operators meet DORA mainly as contracted suppliers, and only a designated critical provider is overseen directly.
- 5requirementsin our own words
- 1edition Regulation (EU) 2022/2554
- 29places where it is a duty of 30 assessed
- 18 Oct 2026last checkedat the sources below
Where it applies
It is a duty in 29 of 30 places, and 1 needs a closer read. The outcome holds under the conditions shown and says nothing about any one site.
| Where | Outcome | Basis | Conditions | Authority and route |
|---|---|---|---|---|
| All 27 EU Member States | Applies | Required by law In force | Duty group: financial entityEntity: financial entity (Art. 2: banks, insurers, investment firms, payment and others) WhyDirect duties on the financial entity: ICT risk management, incident reporting, testing, third-party risk. | national financial supervisor for the entity type |
| All 27 EU Member States | Applies | Required by contract or customer In force | Duty group: supplier flowdownEntity: ICT third-party service provider to a financial entity (includes data centre and colocation operators)Sector: financial sector WhyFinancial entities must put DORA contract terms (Art. 30) and exit rights into contracts with their ICT suppliers; the supplier meets DORA through those terms. | financial entity (client) |
| All 27 EU Member States | Applies | Required by law In force | Duty group: critical providerEntity: ICT third-party service provider designated as critical by the ESAsSector: financial sector WhyOnly designated critical providers are overseen directly by a Lead Overseer; designation is by the ESAs. | ESAs Lead Overseer |
| Switzerland, United Kingdom | Applies | Required by contract or customer In force | Duty group: supplier flowdownEntity: ICT third-party service provider to a financial entity (includes data centre and colocation operators)Sector: EU financial entities WhyA provider outside the EU is bound through contract when it serves EU financial entities. | Not stated |
| Norway | Needs review | Required by law Status not confirmed | Duty group: financial entityEntity: financial entity (Art. 2: banks, insurers, investment firms, payment and others) WhyEEA incorporation of DORA not checked in this pass. | Not stated |
| Norway | Needs review | Required by contract or customer Status not confirmed | Duty group: supplier flowdownEntity: ICT third-party service provider to a financial entity (includes data centre and colocation operators) WhyEEA incorporation of DORA not checked in this pass. | Not stated |
| Norway | Needs review | Required by law Status not confirmed | Duty group: critical providerEntity: ICT third-party service provider designated as critical by the ESAs WhyEEA incorporation of DORA not checked in this pass. | Not stated |
| Switzerland, United Kingdom | Does not apply | Required by law In force | Duty group: financial entityEntity: financial entity (Art. 2: banks, insurers, investment firms, payment and others) WhyEU regulation; not directly applicable to entities outside the EU for this duty group. | Not stated |
| Switzerland, United Kingdom | Does not apply | Required by law In force | Duty group: critical providerEntity: ICT third-party service provider designated as critical by the ESAs WhyEU regulation; not directly applicable to entities outside the EU for this duty group. | Not stated |
What it asks for
5 requirements, each in our own words with the evidence an assessor would expect and who on a site usually owns it. Read the clause itself on the scheme owner's page.
| Requirement | Evidence expected | Owner | When |
|---|---|---|---|
| Work out which DORA role you have for each client: you are normally an ICT third-party service provider; a financial entity has the primary duties. | Role mapping per client Record, checked by document review | Compliance manager | Every year Governance, the organisation |
| Expect contract terms from financial clients on service description, locations, security, incident help, audit and exit. | Contract addendum Contract, checked by document review | Compliance manager | On each change Contractual, the organisation |
| Support clients' incident reporting by informing them quickly and with usable detail. | Client notification procedure Policy, checked by document review | Security lead | Continuous Contractual, the organisation |
| Support clients' resilience testing and exit plans. | Test participation records Test report, checked by document review | IT operations | Every year Contractual, the organisation |
| If designated as a critical ICT third-party provider, you come under direct EU oversight. | Designation watch note Record, checked by document review | Compliance manager | Every year Governance, the organisation |
Editions
Which text is in force, from when, and which one it replaced.
| Edition | Status | Published | In effect | Replaces |
|---|---|---|---|---|
| Regulation (EU) 2022/2554 | Current | 27 Dec 2022 | 17 Jan 2025 | None named |
About the programme
- Scheme owner
- European Parliament and Council
- Assessed by
- A regulator or authority
- Scope
- financial entity; ICT third-party service provider
- Levels
- three duty groups: financial entities, contractual flow-down to ICT providers, oversight of designated critical ICT third-party providers
- Validity
- Applies since 17 January 2025.
- Regulator
- Financial supervisors per Member State; European Supervisory Authorities as lead overseers for critical ICT providers
- Official body
- European Parliament and Council
- Who asks for it
- Financial-sector clients, Regulator
- Where it is used
- EU27 (financial entities); suppliers anywhere through contracts
Sources
Official bodies behind this page, each with the date we last read it.
- EUR-Lex (Official Journal of the EU)read 18 Oct 2026
Not legal advice. Confirm each duty against the text itself.