DORA

Digital Operational Resilience Act (Regulation (EU) 2022/2554)

In application since 17 January 2025

DORA is the EU's digital operational resilience regime for the financial sector: ICT risk management, incident reporting, resilience testing, and — its sharpest edge — direct oversight of critical third-party ICT providers. It applies to banks, payment and e-money institutions, investment firms, crypto-asset service providers and insurers operating in the EU.

Since 17 January 2025 DORA applies directly, and supervisory attention has shifted to implementation detail: registers of information, threat-led penetration testing, subcontracting chains and incident-classification practice. Third-country firms serving EU clients feel it through their EU entities and vendors.

This page tracks DORA-related supervisory publications, guidance and equivalent operational-resilience regimes emerging in other jurisdictions, updated same-day.

Instrument:

Regulation (EU) 2022/2554 — directly applicable

In application:

17 January 2025

Scope:

Banks, PSPs/EMIs, investment firms, CASPs, insurers + critical ICT providers

Analogues:

APRA CPS 230 (AU), Bank of England/PRA operational-resilience rules (UK)