Digital Operational Resilience Act
DORA
The EU's unified framework for ICT risk management across the entire financial sector. Applicable since 17 January 2025, DORA ensures that banks, insurers, investment firms, payment providers, crypto-asset service providers, and their critical ICT suppliers can withstand, respond to, and recover from all types of digital disruptions and cyber threats.
If your company provides financial services in the EU -- or supplies technology to companies that do -- DORA is the regulation you need to understand. It sets out rules designed to make sure banks, insurers, payment companies, and similar firms can keep running even when their computer systems are attacked or fail. Think of it as a safety standard for the digital side of finance.
Before DORA, each type of financial firm followed different rules about cybersecurity and IT risk. That made things complicated and left gaps. DORA replaces that patchwork with a single set of requirements that applies across the board. It covers everything from how firms manage their IT risks day-to-day, to how quickly they must report a cyber incident, to how they test whether their systems can withstand a real attack.
One of DORA's most notable features is that it does not stop at the financial firms themselves. It also brings the major technology providers -- the cloud platforms, core banking vendors, and data analytics companies that the financial sector depends on -- under direct regulatory oversight for the first time. If a single cloud outage could disrupt dozens of banks, regulators now have the power to inspect and penalise that provider directly.
DORA has been fully applicable since 17 January 2025. Firms that fall within its scope are expected to have compliance frameworks in place now. For those still catching up, the practical priorities are incident reporting workflows, third-party contract remediation, and building out the Register of Information that documents every ICT provider relationship.
Switzerland is not an EU member state, so DORA does not apply directly to Swiss-domiciled financial institutions. However, Swiss banks, insurers, and asset managers with EU branches or subsidiaries will find that those entities are fully subject to DORA. More broadly, Swiss firms providing ICT services to EU-regulated financial entities -- cloud hosting, core banking platforms, payment processing infrastructure -- risk being designated as critical ICT third-party providers and falling under direct ESA oversight.
FINMA's existing operational resilience expectations (particularly FINMA Circular 2023/1 on operational risks and resilience) overlap with several DORA requirements, but do not match DORA's prescriptive incident reporting timelines, Register of Information obligations, or mandatory threat-led penetration testing. Swiss financial institutions serving EU clients should map their current FINMA compliance against DORA's five pillars and close any gaps, especially around the 4-hour incident notification deadline and third-party contract clauses that EU counterparties will increasingly require.
DORA is structured around five interconnected pillars. Together, they create a comprehensive operational resilience framework.
DORA imposes one of the tightest incident reporting regimes in EU regulation. The clock starts ticking at detection.
ICT-related incident detected through monitoring or user reports.
Incident classified as major or significant using ESA multi-criteria methodology (clients affected, data loss, criticality, duration, economic impact, geographic spread). Classification must occur promptly and no later than 24 hours after detection.
Submit initial report to competent authority with basic facts: incident type, affected services, estimated impact, initial mitigation actions taken. The absolute backstop is 24 hours from detection even if classification is delayed.
Detailed update including root cause analysis (if available), full impact scope, ongoing recovery measures, and timeline for resolution. Must be submitted even if the incident is still ongoing.
Complete post-incident analysis: root cause, total financial losses, remedial actions, lessons learned, and any changes to the ICT risk management framework.
DORA applies to 21 categories of financial entities -- the broadest scope of any EU financial regulation on ICT risk. Select a category for details.
Despite the January 2025 application date, full compliance remains a work in progress for much of the financial sector.