DORA Compliance: A 2026 Executive Summary for Leaders of Financial Institutions

DORA is fully in force. As of January 17, 2025, the Digital Operational Resilience Act applies across the European Union, and financial institutions that have not achieved compliance are now operating at significant regulatory and operational risk.

For executives at banks, insurance companies, investment firms, and other financial entities, DORA represents the most significant shift in ICT risk governance in a generation. The numbers make the urgency clear: according to the IMF's 2024 Global Financial Stability Report, the financial sector has experienced over 20,000 cyberattacks over the past two decades, resulting in $12 billion in direct losses. With cyber threats increasing in both frequency and sophistication, DORA establishes the regulatory framework that the EU's financial system needs to withstand digital disruption.

This executive summary gives financial leaders a clear understanding of DORA's scope, requirements, and enforcement landscape as we move deeper into 2026.

What DORA Is and Why It Matters

DORA (Regulation EU 2022/2554) is a European Union regulation designed to strengthen how financial entities manage information and communication technology (ICT) security. According to the European Insurance and Occupational Pensions Authority, DORA ensures that banks, insurance companies, investment firms, and other financial entities can withstand, respond to, and recover from ICT disruptions, including cyberattacks and system failures.

Before DORA, ICT risk management rules varied significantly across EU member states, creating inconsistencies and compliance complexity for institutions operating in multiple jurisdictions. DORA replaces that fragmentation with a single, binding framework applicable across all 27 EU member states without requiring national transposition. This means identical compliance requirements regardless of where your institution operates within the EU.

The regulation was published on December 27, 2022, and entered into force on January 16, 2023. Financial entities had a two-year transition period before the January 17, 2025, application date. No grace period applies after this date. National Competent Authorities (NCAs) have begun supervisory reviews, and enforcement actions are now active.

Who Must Comply: The 20 Entity Types Under DORA

DORA applies to approximately 22,000 financial entities across the EU, covering 20 distinct categories of regulated organizations. According to the European Securities and Markets Authority, this includes:

• Core Financial Institutions: Credit institutions (including neo-banks), payment institutions, e-money institutions, investment firms, and asset managers, including UCITS managers and alternative investment fund managers.

• Insurance Sector: Insurance and reinsurance undertakings, as well as certain insurance intermediaries meeting specific thresholds.

• Market Infrastructure: Trading venues, central counterparties (CCPs), central securities depositories, trade repositories, and data reporting service providers.

• Emerging Digital Finance: Crypto-asset service providers brought into scope by the EU's Markets in Crypto-Assets Regulation, crowdfunding service providers, and credit rating agencies.

• ICT Third-Party Providers: Cloud service providers, data centers, software platforms, and managed services supporting core financial functions. Location provides no exemption. DORA applies to ICT providers outside the EU if they serve EU financial entities.

While DORA applies regardless of organizational size, proportionality principles allow smaller entities to implement less complex frameworks based on their risk profile and operational complexity. Smaller institutions should not assume automatic exemption. All covered entities must demonstrate compliance with core requirements.

From Implementation to Supervision: The 2025 to 2026 Shift

January 17, 2025, marked a fundamental transition in DORA's lifecycle, from implementation to active supervision. According to the European Supervisory Authorities (ESAs), NCAs began conducting compliance reviews immediately upon the application date.

Key supervisory milestones include:

• April 30, 2025: Competent Authorities submitted Registers of Information (RoI) on ICT third-party arrangements received from financial entities to the ESAs. This mandatory CSV-format register documents every contractual arrangement with ICT service providers.

• July 2025: The ESAs conducted criticality assessments and began notifying ICT third-party service providers of potential classification as Critical ICT Third-Party Providers (CTPPs). Providers received a six-week period to object with supporting documentation.

• November 2025: The ESAs designated 19 ICT service providers as critical under DORA, including major cloud platforms such as AWS, Microsoft Azure, and Google Cloud. These CTPPs are now subject to direct EU supervisory oversight.

• Late 2025 Onward: Selected financial entities began receiving designation for Threat-Led Penetration Testing (TLPT) from their NCAs, requiring advanced testing of digital operational resilience on live production systems using the TIBER-EU framework.

The European Central Bank has confirmed that operational resilience remains a supervisory priority for 2025 to 2027, with intensified scrutiny of banks' technology environments, outsourcing arrangements, and cyber resilience capabilities.

The Five Pillars of DORA Compliance

DORA establishes requirements across five interconnected pillars that together form a comprehensive framework for digital operational resilience.

1. ICT Risk Management and Governance: Financial entities must implement formal ICT risk management frameworks integrated with their enterprise risk strategy. DORA places ultimate responsibility for ICT risk with the management body. Board members and senior executives are personally accountable, with potential individual fines up to €1 million for compliance failures.

2. ICT Incident Management and Reporting: Organizations must classify, document, and report major ICT-related incidents to regulatory authorities within specified timeframes. Initial notification is required within 4 to 24 hours of classifying an incident as major, with intermediate and final reports due at defined intervals.

3. Digital Operational Resilience Testing: All covered entities must conduct regular testing of their ICT systems, including vulnerability assessments, network security evaluations, and gap analyses. Significant entities must additionally perform TLPT every three years.

4. Third-Party Risk Management: Institutions must maintain the RoI documenting all ICT third-party arrangements, assess concentration risks from vendor dependencies, and ensure contracts include mandatory provisions covering audit rights, SLAs, exit strategies, and incident notification. ECB supervisory data indicate that more than 30% of total outsourcing budgets at significant banks are concentrated in just 10 providers, which is precisely the type of concentration risk DORA is designed to address.

5. Information Sharing: DORA encourages financial entities to participate in information-sharing arrangements, exchanging cyber threat intelligence and vulnerability information while complying with confidentiality, competition law, and data protection requirements.

Penalties for Non-Compliance: Financial and Operational Consequences

DORA establishes a strict penalty regime that makes non-compliance financially and operationally untenable. The International Association of Privacy Professionals notes that DORA implements a two-part penalty system targeting both entities and individuals.

• Financial Penalties for Entities: Administrative fines may reach up to 2% of total annual worldwide turnover or up to 1% of average daily worldwide turnover as periodic penalty payments. For CTPPs, the ESAs can impose periodic penalty payments of up to 1% of average daily worldwide turnover for a maximum period of six months until compliance is achieved.

• Individual Accountability: Senior managers and board members face personal fines of up to €1 million for compliance failures, with direct liability extending to those responsible for ICT risk governance and digital operational resilience.

• Non-Financial Consequences: Beyond fines, regulators can issue binding orders to remedy deficiencies, suspend business activities, and in the most serious cases, revoke authorization or licenses. Regulators may also compel financial entities to terminate relationships with non-compliant ICT providers, a particularly severe consequence given the operational dependencies most institutions have on their technology vendors.

Turning Compliance into a Strategic Advantage

DORA imposes significant compliance obligations, but the institutions best positioned for 2026 and beyond are those that treat operational resilience as a business imperative, not just a regulatory requirement. The ECB's supervisory priorities for 2026 to 2028 make clear that institutions that strengthen cyber governance, modernize technology infrastructure, and tighten third-party oversight will operate with greater confidence across an increasingly volatile digital landscape.

The shift from reactive fixes to genuine, organization-wide resilience requires governance that starts at the top, clear visibility into third-party dependencies, and security embedded into digital transformation from the start rather than added as an afterthought.

Konfer Clear helps financial institutions close DORA compliance gaps faster, with AI-powered gap analysis, automated review of contracts and protocol documents against regulatory requirements, and compliance reports completed in significantly less time than a manual audit.

For institutions that need to translate DORA's regulatory requirements into structured governance controls and compliance workflows, Konfer Playbook automatically generates the governance playbooks and control questionnaires your teams need to operationalize compliance across the organization.

And for institutions that require continuous oversight of all internal assets across multiple regulations and policies at scale, Konfer Confidence provides a fully integrated, real-time compliance monitoring solution.

Ready to assess your DORA compliance posture? Schedule a demo today.

Published: April 21, 2026