The EU Digital Operational Resilience Act, DORA, brings ICT-risk governance, incident reporting, resilience testing and third-party risk into a financial-sector framework. It links continuity and recovery controls with major-incident classification, reporting and dependency registers.
TL;DR:
- Since January 2025, covered entities must govern ICT risk, incidents, testing and third-party services.
- Contracts, supplier records and exit plans support retained management responsibility.
- Designated critical ICT providers face a separate EU oversight framework.
Summary
Resilience across a financial service
Regulation (EU) 2022/2554 establishes common digital operational-resilience requirements for covered financial entities. Applicable from 17 January 2025, it addresses the ability to withstand, respond to and recover from ICT disruption. Its scope, proportionality principles and simplified arrangements matter: not every technology supplier or financial business is treated identically. In payments, the useful unit is the service the customer depends on, including its internal systems and external dependencies.
Governance, incidents and testing
Management is accountable for the ICT risk-management framework. Identification of critical functions and assets connects protection and detection with response, recovery and learning. Major ICT-related incidents must be classified and reported under the prescribed process, while resilience testing checks whether arrangements work in practice. Selected entities face advanced threat-led penetration testing. These requirements link documented governance with evidence about service performance, rather than treating a written continuity plan as sufficient by itself.
Responsibility when technology is outsourced
A financial entity keeps responsibility when it uses an ICT third party. DORA connects supplier due diligence, contractual terms, registers of information, concentration risk, access and audit rights and exit strategies. Services supporting critical or important functions receive particular attention. A contract with a large cloud or processing provider therefore remains a dependency to understand and manage; it does not transfer the regulated institution's accountability for its service to the supplier.
Supervision and the end-to-end payment chain
DORA adds European oversight of designated critical ICT providers alongside supervision of the financial entities that use them. A payment chain can rely on authentication vendors, processors, communications, customer interfaces and settlement support, with different failure and recovery points. Its resilience depends on those connections and the institution's ability to recover the financial function. The relevant technical standards and reporting arrangements develop the Regulation's detail and should be read with its scope and proportionality provisions.
Keywords
- DORA
- ICT governance
- incident reporting
- resilience testing
- third-party risk
- supplier contracts
- exit arrangements
- critical providers
- financial continuity
- management accountability