# DORA: Digital Operational Resilience Act

Source page: https://protegra.io/licensing/laws/eu-dora-2022-2554/

DORA, Regulation (EU) 2022/2554, is the EU law on digital operational resilience that has applied since 17 January 2025 to almost every licensed financial firm, including payment and e-money institutions, investment firms and crypto-asset service providers. It requires an ICT risk framework, incident reporting, resilience testing and control of ICT third-party providers such as cloud services.

## At a glance

| Official title | Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 [1] |
| --- | --- |
| English title | Digital Operational Resilience Act |
| Citation | Regulation (EU) 2022/2554 |
| Jurisdiction | European Union (applies in every EU/EEA state) |
| Type | regulation |
| Adopted | 2022-12-14 |
| In force from | 2023-01-16 |
| Status | In force; applies from 17 January 2025 |

## Full text

**Official full text:** [Digital Operational Resilience Act (PDF, en)](https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32022R2554) [1] · 1,458 KB · file checked 2026-09-24

Official page: [eur-lex.europa.eu](https://eur-lex.europa.eu/eli/reg/2022/2554/oj) [1]

## Summary

DORA sets one set of rules on information and communication technology (ICT) risk for almost every regulated financial entity in the EU, including banks, payment and e-money institutions, investment firms, fund managers and crypto-asset service providers. Firms must run an ICT risk-management framework, classify and report major ICT-related incidents, test their digital operational resilience: with threat-led penetration testing for the most significant firms: and manage the risk of ICT third-party providers through contract requirements and a register of arrangements. Critical ICT third-party providers such as large cloud providers come under direct EU oversight.

Summary written by the Atlas from the official text; the law itself prevails.

## Main articles

- **Art. 2**: Scope: the financial entities covered, including CASPs under MiCA.
- **Art. 5-16**: ICT risk-management framework and governance.
- **Art. 17-23**: ICT-related incident management, classification and reporting.
- **Art. 24-27**: Digital operational resilience testing; threat-led penetration testing under Art. 26.
- **Art. 28-30**: Managing ICT third-party risk and key contractual provisions.
- **Art. 31**: Designation and oversight of critical ICT third-party providers.

## Licences it governs

- [EMI · LithuaniaElectronic money institution licence for non-limited activityLB · capital EUR 350,000](https://protegra.io/licensing/licences/emi/lithuania/)
- [VASP · GermanyQualified crypto custody licence (Erlaubnis für das qualifizierte Kryptoverwahrgeschäft nach § 1 Absatz 1a Satz 2 Nummer 6 KWG)BaFin](https://protegra.io/licensing/licences/vasp/germany-custody/)
- [VASP · IrelandVirtual Asset Service Provider AML/CFT RegistrationCBI](https://protegra.io/licensing/licences/vasp/ireland/)

## Regulators that apply it

- [NetherlandsAuthority for the Financial Markets (AFM)The Autoriteit Financiële Markten (AFM) is the Netherlands' autonomous conduct-of-business supervisory authority (zelfstandig bestuursorgaan](https://protegra.io/licensing/regulators/afm-netherlands/)
- [FranceFinancial Markets Authority (AMF)The Autorité des marchés financiers (AMF) is France's independent financial markets authority, tasked with safeguarding savings invested in](https://protegra.io/licensing/regulators/amf-france/)
- [GermanyFederal Financial Supervisory Authority (BaFin)BaFin operates as Germany's unified federal financial supervisor under the Federal Ministry of Finance, supervising credit institutions, fin](https://protegra.io/licensing/regulators/bafin-germany/)
- [SpainBank of Spain (BdE)Banco de España is Spain's national central bank and banking supervisor, operating as an integral part of the European System of Central Ban](https://protegra.io/licensing/regulators/banco-de-espana/)
- [LithuaniaBank of Lithuania (LB)The Bank of Lithuania operates as the central bank of the Republic of Lithuania and member of the Eurosystem, conducting integrated prudenti](https://protegra.io/licensing/regulators/bank-of-lithuania/)
- [IrelandCentral Bank of Ireland (CBI)The Central Bank of Ireland serves the public interest by maintaining monetary and financial stability while ensuring that the financial sys](https://protegra.io/licensing/regulators/central-bank-of-ireland/)
- [Czech RepublicCzech National Bank (CNB)The Czech National Bank acts as the central bank and unified supervisory authority of the Czech financial market under Act No. 6/1993 Coll.](https://protegra.io/licensing/regulators/cnb-czechia/)
- [SpainNational Securities Market Commission (CNMV)The National Securities Market Commission is the Spanish agency responsible for supervising and inspecting secondary securities markets, inv](https://protegra.io/licensing/regulators/cnmv-spain/)
- [ItalyNational Commission for Companies and the Stock Exchange (CONSOB)CONSOB is Italy's independent administrative authority tasked with safeguarding investor protection, market transparency, fair conduct among](https://protegra.io/licensing/regulators/consob-italy/)
- [LuxembourgCommission de Surveillance du Secteur Financier (CSSF)The CSSF operates as the unified public supervisory authority for the Luxembourg financial centre, conducting prudential supervision and mar](https://protegra.io/licensing/regulators/cssf-luxembourg/)
- [CyprusCyprus Securities and Exchange Commission (CySEC)The Cyprus Securities and Exchange Commission is the independent public supervisory authority responsible for the regulation and supervision](https://protegra.io/licensing/regulators/cysec-cyprus/)
- [NetherlandsDe Nederlandsche Bank (DNB)De Nederlandsche Bank acts as the central bank of the Netherlands and integral member of the Eurosystem and ESCB, exercising prudential supe](https://protegra.io/licensing/regulators/dnb-netherlands/)
- [European UnionEuropean Banking Authority (EBA)The European Banking Authority is an independent EU agency that creates the European Single Rulebook for banking and payments, fosters super](https://protegra.io/licensing/regulators/eba/)
- [European UnionEuropean Securities and Markets Authority (ESMA)ESMA operates as an independent European Union supervisory authority that protects the public interest by contributing to the stability and](https://protegra.io/licensing/regulators/esma/)
- [EstoniaFinantsinspektsioon (FI)Finantsinspektsioon is Estonia's independent financial supervision and crisis resolution authority operating with autonomous responsibilitie](https://protegra.io/licensing/regulators/finantsinspektsioon-estonia/)
- [PolandPolish Financial Supervision Authority (KNF)KNF ensures the proper functioning, stability, security, and transparency of the Polish financial market, safeguards public confidence in fi](https://protegra.io/licensing/regulators/knf-poland/)
- [LatviaLatvijas Banka (LB)Latvijas Banka is the central bank of the Republic of Latvia and member of the Eurosystem, operating as the single integrated financial supe](https://protegra.io/licensing/regulators/latvijas-banka/)
- [MaltaMalta Financial Services Authority (MFSA)The Malta Financial Services Authority is the single autonomous financial regulator in Malta, entrusted with prudential and conduct supervis](https://protegra.io/licensing/regulators/mfsa-malta/)
- [SlovakiaNational Bank of Slovakia (NBS)Národná banka Slovenska acts as the central bank and integrated financial supervisory authority of the Slovak Republic. It safeguards price](https://protegra.io/licensing/regulators/nbs-slovakia/)

## Sources

1. [eur-lex.europa.eu: TXT (32022R2554)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R2554): retrieved 2026-09-24

Last verified 2026-09-24 · Author: Danil Marmysh · Reviewed by Anastasia Sidorenkova · © Protegra. Data: CC BY 4.0, cite "Protegra Licensing Atlas". Not legal advice.