The European Union requires approximately 20 categories of regulated financial entities to achieve full Digital Operational Resilience Act compliance by January 2027. Regulation (EU) 2022/2554 has applied directly since 17 January 2025, covering credit institutions, payment institutions, investment firms, insurers and crypto-asset service providers across all member states.
DORA Compliance Requirements for Financial Entities
Financial firms must implement an ICT risk management framework that includes governance arrangements, documented policies and procedures for identifying, protecting against and recovering from ICT-related incidents. Major incidents require initial notification within four hours of classification and within 24 hours of awareness, followed by an intermediate report at 72 hours and a final report within one month.
Resilience testing forms a core obligation, with threat-led penetration testing mandatory for certain larger entities. Firms must also maintain a register of information on all ICT third-party providers and ensure contractual arrangements meet minimum standards on audit rights, exit strategies and service continuity. Voluntary threat information sharing arrangements operate alongside these mandatory elements.
National competent authorities conduct ongoing supervisory reviews, on-site inspections and scrutiny of registers of information. Penalties vary by member state, with some jurisdictions setting maximum fines at €10 million or 10 percent of annual turnover. As of October 2026, enforcement activity includes active reviews and limited public fines, such as the reported Austrian case.
CTPP Designations and Current Enforcement Status
The European Supervisory Authorities designated the first 19 Critical ICT Third-Party Providers on 18 November 2025, including AWS, Microsoft and Google Cloud. These providers now fall under a joint oversight framework led by designated Lead Overseers and Joint Examination Teams that conduct direct supervision.
The European Securities and Markets Authority has placed DORA supervision at the centre of its 2027 work programme. Annual register submissions remain due in March in several jurisdictions, while the European Commission must complete its first formal review of the regulation by 17 January 2028 under Article 58.
The first major incident overview report, published by the ESAs in June 2026, recorded 3,383 ICT incidents across the sector in 2025. This data informs supervisory priorities and highlights the practical impact of the new incident classification and reporting timelines on day-to-day operations.
Practical Steps for Firms Ahead of 2027 Milestones
Financial entities should verify that all existing ICT contracts satisfy DORA requirements, as no transitional period or grandfathering applies. Updates to internal policies, incident response playbooks and third-party due diligence processes are immediate priorities for risk and compliance teams.
Organisations that rely on the newly designated CTPPs can expect increased information requests and possible joint examinations in the coming quarters. Early engagement with national competent authorities on testing methodologies and register formats reduces the risk of supervisory findings during the 2027 cycle.
Regular internal audits of the ICT risk framework, combined with scenario-based resilience testing, help firms demonstrate compliance when authorities request evidence. These measures directly support operational continuity and protect client assets under the broader digital finance package.
Frequently asked questions
Which financial entities must comply with DORA?
DORA applies directly to roughly 20 categories of EU-regulated entities, including banks, payment institutions, investment firms, insurers and crypto-asset service providers, as well as their critical ICT third-party providers.
What are the main reporting deadlines under DORA?
Initial notification of a major ICT incident must occur within four hours of classification and 24 hours of awareness, with an intermediate report due at 72 hours and a final report within one month.
When were the first Critical ICT Third-Party Providers designated?
The European Supervisory Authorities designated the first 19 Critical ICT Third-Party Providers on 18 November 2025, triggering the joint oversight framework.
What penalties apply for non-compliance with DORA?
Penalties are set at national level and can reach €10 million or 10 percent of annual turnover in some member states, while designated CTPPs face daily fines of up to 1 percent of worldwide turnover.
By YasTech Editorial
Comments 3