DORA: Digital Operational Resilience Act

At a glance

Full text

Official full text: Digital Operational Resilience Act (PDF, en)¹ · 1,458 KB · file checked 2026-09-24

Official page: eur-lex.europa.eu¹

Summary

DORA sets one EU-wide rulebook for information and communication technology (ICT) risk in the financial sector. Coverage is broad. It reaches banks, payment and e-money institutions, investment firms, fund managers and crypto-asset service providers alike. Each firm needs an ICT risk-management framework. It must classify and report major ICT-related incidents. Testing follows too, and the most significant firms face threat-led penetration testing on top of the rest. ICT third-party risk is managed through contract terms and a register of arrangements. Critical ICT third-party providers, large cloud firms among them, fall under direct EU oversight.

Summary written by the Atlas from the official text; the law itself prevails.

Main articles

• Art. 2: Defines who DORA covers, including crypto-asset service providers licensed under MiCA.
• Art. 5-16: Requires each firm to run an ICT risk-management framework, with the management body held accountable for it.
• Art. 17-23: Sets out how firms classify major ICT-related incidents and report them to regulators.
• Art. 24-27: Requires firms to test their digital resilience, and the largest face threat-led penetration testing under Art. 26.
• Art. 28-30: Covers how firms manage ICT third-party risk and what their contracts have to include.
• Art. 31: Lets EU authorities designate and directly oversee critical ICT third-party providers.

Licences it governs

• EMI · Lithuania

  Electronic money institution licence for non-limited activity

  LB · capital EUR 350,000

• VASP · Germany

  Qualified crypto custody licence

  BaFin

• VASP · Ireland

  Virtual Asset Service Provider AML/CFT Registration

  CBI

Regulators that apply it

• Netherlands

  Authority for the Financial Markets (AFM)

  The Autoriteit Financiële Markten (AFM) is the Netherlands' autonomous conduct-of-business supervisory authority (zelfstandig bestuursorgaan

• France

  Financial Markets Authority (AMF)

  The Autorité des marchés financiers (AMF) is France's independent financial markets authority. It protects savings invested in financial pro

• Germany

  Federal Financial Supervisory Authority (BaFin)

  BaFin is Germany's unified federal financial supervisor and sits under the Federal Ministry of Finance. It supervises credit institutions, f

• Spain

  Bank of Spain (BdE)

  Banco de España is Spain's national central bank and banking supervisor, operating as an integral part of the European System of Central Ban

• Lithuania

  Bank of Lithuania (LB)

  Lietuvos bankas, the Bank of Lithuania, is the central bank of the Republic of Lithuania and a member of the Eurosystem. It supervises credi

• Ireland

  Central Bank of Ireland (CBI)

  The Central Bank of Ireland is Ireland's central bank and its integrated financial conduct and prudential regulator, within the Eurosystem a

• Czech Republic

  Czech National Bank (CNB)

  The Czech National Bank acts as the central bank and unified supervisory authority of the Czech financial market under Act No. 6/1993 Coll.

• Spain

  National Securities Market Commission (CNMV)

  The National Securities Market Commission is the Spanish agency responsible for supervising and inspecting secondary securities markets, inv

• Italy

  National Commission for Companies and the Stock Exchange (CONSOB)

  CONSOB is Italy's independent administrative authority tasked with safeguarding investor protection, market transparency, fair conduct among

• Luxembourg

  Commission de Surveillance du Secteur Financier (CSSF)

  The CSSF is Luxembourg's unified public supervisory authority for the financial centre. It carries out prudential supervision and market con

• Cyprus

  Cyprus Securities and Exchange Commission (CySEC)

  The Cyprus Securities and Exchange Commission is the independent public supervisory authority responsible for the regulation and supervision

• Netherlands

  De Nederlandsche Bank (DNB)

  De Nederlandsche Bank acts as the central bank of the Netherlands and integral member of the Eurosystem and ESCB, exercising prudential supe

• European Union

  European Banking Authority (EBA)

  The European Banking Authority is an independent EU agency that creates the European Single Rulebook for banking and payments, fosters super

• European Union

  European Securities and Markets Authority (ESMA)

  ESMA operates as an independent European Union supervisory authority that protects the public interest by contributing to the stability and

• Estonia

  Finantsinspektsioon (FI)

  Finantsinspektsioon is Estonia's independent financial supervision and crisis resolution authority operating with autonomous responsibilitie

• Poland

  Polish Financial Supervision Authority (KNF)

  KNF ensures the proper functioning, stability, security, and transparency of the Polish financial market, safeguards public confidence in fi

• Latvia

  Latvijas Banka (LB)

  Latvijas Banka is the central bank of the Republic of Latvia and a member of the Eurosystem. It has stood as the single integrated financial

• Malta

  Malta Financial Services Authority (MFSA)

  The Malta Financial Services Authority is the single autonomous financial regulator in Malta, entrusted with prudential and conduct supervis

• Slovakia

  National Bank of Slovakia (NBS)

  Národná banka Slovenska is the central bank and integrated financial supervisor of the Slovak Republic. Price stability and financial system