---
title: "DORA"
url: "https://mahouse.world/glossary/dora"
type: "glossary term"
author: "Ihor Vlasov"
reviewed: "2026-09-30"
published: "2026-09-25"
---

# DORA

DORA — the Digital Operational Resilience Act, Regulation (EU) 2022/2554 — is the EU regulation, applicable since 17 January 2025, that sets common rules for how banks, payment and e-money institutions, insurers, investment firms, crypto-asset service providers and other financial entities manage technology risk, report ICT incidents, test their resilience and control their dependence on outside technology providers.

**Also known as:** Digital Operational Resilience Act, Regulation (EU) 2022/2554, EU DORA

## Key facts

- **Binding:** yes — a directly applicable EU regulation of 14 December 2022, in application from 17 January 2025, covering 20 types of financial entity, with a simplified framework for smaller firms
- **Five areas:** ICT risk management (Articles 5–16), incident management and reporting (17–23), resilience testing (24–27), ICT third-party risk (28–44) and information sharing (45); the management body bears ultimate responsibility for ICT risk
- **Incident reporting:** a major ICT-related incident is notified within four hours of being classified as major and no later than 24 hours after the firm becomes aware of it, followed by an intermediate report within 72 hours and a final report within a month
- **Third parties:** a register of information covering every ICT contract; mandatory contract terms, termination rights and documented, tested exit strategies for services supporting critical or important functions
- **Testing:** threat-led penetration testing on live production systems at least every three years for the firms supervisors identify
- **Provider oversight:** the European Supervisory Authorities designate critical ICT third-party providers and oversee them directly, with periodic penalty payments of up to 1% of average daily worldwide turnover for non-compliance

## How DORA works in practice

DORA turns operational resilience from a policy document into evidence a supervisor can inspect. The first deliverable most firms struggled with was the register of information: every ICT contract, what it supports, which subcontractors sit behind it, and whether the function is critical or important. A payment institution compiling it for 140 software and cloud contracts can discover that its card processing depends on a data centre two subcontracting layers down that it has never assessed.

Contracts for services supporting critical or important functions must give the firm and its supervisor access and audit rights, set service levels and notice obligations, and allow termination; the firm must be able to exit without disrupting clients, under a plan that has been tested. That is where negotiations with large cloud and software providers concentrate, because standard terms rarely offer it.

Incidents change pace too. An outage classified as major at 10:00 must be notified by 14:00, so firms have written classification criteria into their incident processes and put regulatory reporting on the on-call rota.

For an acquirer, DORA is a standing diligence item for any EU-regulated target: the register, the year's incident reports, test results, exit plans for the core providers, and open supervisory findings. A target whose core banking or processing platform sits with one provider, with no tested exit, carries a remediation cost that belongs in the price.

## Example

An e-money institution with €40m of revenue prepares for sale. Its DORA file shows 212 ICT contracts, 19 of them supporting critical or important functions; exit plans exist for 11 and have been tested for 4. Two major incidents were reported during the year — a four-hour card authorisation outage and a data-centre failover that took 90 minutes — both within the deadlines. The buyer's technology diligence prices the gaps: €600k to renegotiate eight contracts without audit and exit clauses, €900k to build and test a secondary processing arrangement for the card platform, and a year's delay to the planned core ledger migration. The parties agree a €1.5m price reduction for the remediation and a specific indemnity for any supervisory penalty arising from pre-closing non-compliance.

## Common mistakes

- Treating DORA as an IT project, when it makes the management body responsible for ICT risk.
- Registering direct suppliers and ignoring the subcontractors behind them.
- Writing exit plans that have never been tested.
- Assuming a provider's certification covers the firm's own obligations.
- Delaying classification to delay reporting; the 24-hour limit runs from awareness.
- Taking size for an exemption; DORA scales its rules for small firms rather than excluding them.

## Related terms

- [RegTech](https://mahouse.world/glossary/regtech.md)
- [Failover](https://mahouse.world/glossary/failover.md)
- [SOC 2 Compliance](https://mahouse.world/glossary/soc-2-compliance.md)
- [PSD2](https://mahouse.world/glossary/psd2.md)
- [Payment Service Provider](https://mahouse.world/glossary/payment-service-provider.md)
- [Legal Due Diligence](https://mahouse.world/glossary/legal-due-diligence.md)

— Ihor Vlasov, M&A FinTech Expert. Last reviewed 2026-09-30. https://mahouse.world/authors/ihor-vlasov