The Comprehensive Guide to DORA Compliance & Maintenance in 2026

Executive Summary:
What You Need to Know About DORA Compliance in 2026

As of 2026, the Digital Operational Resilience Act (DORA) is a fully established regulatory framework across the European Union, having entered into application on January 17, 2025.

The era of “grace periods” and implementation planning has ended. We have entered the supervisory phase, where EU financial entities and their critical Information and Communication Technology (ICT) providers must show their controls work in real operations.

DORA non-compliance can lead to serious penalties, including fines of up to 2% of total annual worldwide turnover for firms, or up to €1,000,000 for individuals.
Financial entities must maintain a sound and well-documented ICT risk management framework that includes strategies for identifying, protecting, and detecting risks to information assets.
A harmonized reporting regime is in place, requiring these entities to submit initial notifications and detailed reports on major ICT-related incidents to their competent authorities.
Organizations are also required to manage a comprehensive register of information for all contractual arrangements with ICT third-party service providers.
Regular digital operational resilience testing is mandatory for all ICT systems supporting critical or important functions, with high-priority systemic entities required to complete advanced threat-led penetration testing at least every three years.
For critical ICT third-party service providers, a Union-wide oversight framework is active, involving direct investigations and on-site inspections by joint examination teams.
The European Commission’s 2026 review may expand DORA’s scope to include statutory auditors and audit firms. This signals a clear direction: the “digital resilience” perimeter is expanding across the entire financial ecosystem.

What Is DORA Compliance?

DORA compliance is the mandatory process of aligning a financial entity’s operations with the Digital Operational Resilience Act (DORA), a European Union regulation that entered into application on January 17, 2025. DORA harmonizes rules for 20 different types of financial entities and their ICT service providers across all Member States, acting as a specialized law (lex specialis) for the financial sector.

Achieving DORA compliance means an organization has implemented the necessary internal controls, reporting structures, and security protocols to withstand, respond to, and recover from all types of digital threats such as cyberattacks or system failures.

Who Must Comply with DORA in 2026?

As of 2026, DORA has cast one of the widest nets in the history of EU financial regulation. Unlike previous frameworks that focused primarily on “systemic” banks, DORA’s reach extends to virtually every corner of the financial ecosystem and, critically, the technology companies that support them.

If your organization handles, processes, or facilitates financial data within the European Union, you are likely in scope.

Who Is Covered by DORA?

DORA applies to a specific group of 20 different types of financial entities, which are collectively required to meet uniform standards for digital security and operational resilience.

The 20 types of financial entities covered are:

Credit institutions.
Payment institutions, including those exempted under Directive (EU) 2015/2366.
Account information service providers.
Electronic money institutions, including those exempted under Directive 2009/110/EC.
Investment firms.
Crypto-asset service providers (as authorized under Union law) and issuers of asset-referenced tokens.
Central securities depositories.
Central counterparties.
Trading venues.
Trade repositories.
Managers of alternative investment funds.
Management companies.
Data reporting service providers.
Insurance and reinsurance undertakings.
Insurance intermediaries, reinsurance intermediaries, and ancillary insurance intermediaries.
Institutions for occupational retirement provision.
Credit rating agencies.
Administrators of critical benchmarks.
Crowdfunding service providers.
Securitization repositories.

While ICT third-party service providers are also within the scope of the regulation and subject to its requirements, they are categorized separately from the 20 types of “financial entities” listed above.

Who Is NOT Covered by DORA?

DORA does not apply to:

Specific Fund Managers: Alternative investment fund managers as referred to in Article 3(2) of Directive 2011/61/EU.
Exempted Insurers: Insurance and reinsurance undertakings referred to in Article 4 of Directive 2009/138/EC.
Small Retirement Schemes: Institutions for occupational retirement provision that operate pension schemes with 15 members or fewer in total.
Exempted Investment Persons: Natural or legal persons exempted pursuant to Articles 2 and 3 of Directive 2014/65/EU.
Small Insurance Intermediaries: Insurance intermediaries, reinsurance intermediaries, and ancillary insurance intermediaries that qualify as microenterprises or small or medium-sized enterprises.
Specialized Institutions: Post office giro institutions as referred to in Article 2(5), point (3), of Directive 2013/36/EU.
Member State Exclusions: Entities that Member States choose to exclude, such as certain specialized national credit or public sector entities listed in Article 2(5), points (4) to (23), of Directive 2013/36/EU.

What Are the 5 Pillars of DORA?

DORA is built upon five non-negotiable pillars that govern the entire ICT lifecycle:

ICT Risk Management

Incident Reporting

Digital Operational Resilience Testing

Third-Party Risk Management

Information Sharing

What Are The Key Requirements of DORA Compliance?

To be DORA compliant, entities must meet the requirements across the five primary pillars.

DORA Pillar 1: ICT Risk Management

Financial entities must maintain a sound, comprehensive, and well-documented ICT risk management framework as part of their overall risk management system.

Management Responsibility: The management body bears ultimate responsibility for managing ICT risk, approving the digital operational resilience strategy, and allocating an adequate budget for ICT security and staff training.
Continuous Governance: In 2026, senior management is expected to stay actively updated on ICT risks through regular training, as they face individual liability and personal fines of up to €1 million for compliance failures.
Core Functions: The framework must include strategies for identification, protection, detection, response, and recovery. Entities must maintain updated inventories of all ICT assets and business functions, mapping their interdependencies.

DORA Pillar 2: Incident Reporting

Financial entities must implement a process to detect, manage, and notify authorities of ICT-related incidents.

Standardized Reporting: Major incidents must be reported through a streamlined framework involving an initial notification, intermediate reports, and a final report.
Classification Criteria: Incidents are classified based on the number of clients affected, the geographical spread (particularly if affecting more than two Member States), the duration of downtime, and the economic impact.
2026 Challenges: Industry feedback indicates that the reporting process has faced challenges, such as the burden of weekend reporting and the difficulty of identifying root causes from third-party providers within strict timelines.

DORA Pillar 3: Digital Operational Resilience Testing

To identify vulnerabilities, entities must establish a comprehensive testing program as an integral part of their risk management framework.

Basic Testing: All financial entities (excluding microenterprises) must conduct appropriate tests, such as vulnerability scans, network security assessments, and gap analyses, on all critical ICT systems at least yearly.
Advanced Testing (TLPT): Entities identified as “significant,” such as large systemic banks or market infrastructures, must undergo Threat-Led Penetration Testing (TLPT) at least every three years. In 2026, many of these entities are in the midst of their first TIBER-EU testing cycles to meet the initial three-year deadline of January 17, 2028.

DORA Pillar 4: Third-Party Risk Management

DORA treats third-party risk as an integral component of ICT risk, requiring entities to remain fully responsible for compliance even when services are outsourced.

Register of Information (RoI): Entities must maintain a detailed register of all contractual arrangements with ICT third-party service providers. In 2026, the focus has shifted toward the ongoing maintenance and accuracy of these registers following the first major submission in April 2025.
Oversight of Critical Providers: Critical ICT third-party service providers (CTPPs) are subject to a Union Oversight Framework led by European Supervisory Authorities (ESAs), which can conduct on-site inspections and issue recommendations.
Exit Strategies: For services supporting critical or important functions, entities must have robust, tested exit plans to transfer services to alternative providers or reincorporate them in-house without business disruption.

DORA Pillar 5: Information Sharing

The final pillar encourages financial entities to voluntarily exchange cyber threat information and intelligence amongst themselves.

Collective Defense: Sharing intelligence on tactics, techniques, procedures, and security alerts aims to enhance the collective defense capabilities of the financial community.
Trusted Communities: These arrangements must take place within trusted communities and be implemented through platforms that protect business confidentiality and comply with data protection and competition laws. Entities are required to notify their competent authorities of their participation in these sharing groups.

What Is the Cost of DORA Non-Compliance?

DORA establishes a comprehensive framework for penalties that includes financial sanctions, non-financial measures, and potential criminal penalties for non-compliance.

Financial Penalties for DORA Non-Compliance

The administrative fines are categorized based on whether they apply to financial entities, critical ICT third-party service providers (CTPPs), or individuals in management roles:

1. Fines for Financial Entities

Financial institutions found to be in breach of DORA may face significant pecuniary penalties administered by National Competent Authorities (NCAs).

Turnover-Based Fines: For the most serious violations, entities can be fined up to 2% of their total annual worldwide turnover.
Daily Penalties: Certain breaches may result in fines of up to 1% of the average daily turnover worldwide.
Fixed Fines: Member States may also impose fixed administrative fines of up to €5 million, depending on the nature of the violation.

2. Fines for Critical ICT Third-Party Providers

Providers designated as “critical” are overseen by a Lead Overseer (one of the European Supervisory Authorities) and face a distinct penalty regime aimed at compelling compliance with oversight requests.

Periodic Penalty Payments: To compel a CTPP to comply with investigation or inspection requests, the Lead Overseer can impose a periodic penalty payment of up to 1% of the average daily worldwide turnover of the provider in the preceding business year.
Duration: These daily payments can be imposed for no more than six months following the notification of the decision.
Compliance Fines: Non-compliance with oversight requirements can also lead to fines of up to €5 million.

3. Personal Liability and Individual Fines

DORA explicitly includes provisions for individual liability to ensure senior management takes active responsibility for digital resilience.

Management Fines: Senior management and key function holders can face personal fines of up to €1 million for compliance failures.
Professional Restrictions: Individuals may also be subject to temporary bans from holding management positions.

Non-Financial Penalties for DORA Non-Compliance

Supervisory authorities have extensive powers to intervene in the operations of both financial entities and critical ICT third-party service providers (CTPPs). Aside from financial penalties, other enforcement measures include:

1. Supervisory and Investigatory Actions

Authorities can use several tools to identify and address non-compliance in real time:

On-Site Inspections: Regulators may conduct unannounced examinations of an entity’s operations, business premises, and land.
Information Requests and Interviews: Authorities have the power to mandate the production of documents, examine records, and summon staff or management for interviews to provide oral or written explanations.
Remediation and Cease-and-Desist Orders: Competent authorities can issue remediation orders requiring mandatory corrective actions or orders requiring a person or entity to cease conduct that breaches the regulation and desist from repeating it.

2. Public Disclosure (“Naming and Shaming”)

To ensure public awareness and market discipline, authorities can utilize public notices:

Public Statements: Regulators may issue public statements indicating the identity of the natural or legal person responsible for a breach and the nature of the violation.
Notice of Non-Compliance: If a CTPP fails to follow recommendations, the Lead Overseer may publish a notice describing the type and nature of the non-compliance.

3. Operational and Contractual Restrictions

In more severe cases, authorities can directly restrict business activities:

Suspension or Termination of Services: As a “measure of last resort,” a competent authority can require a financial entity to temporarily suspend or completely terminate its use of a specific service provided by a critical ICT third-party provider until identified risks are addressed.
License Suspension: In extreme circumstances, regulators have the power to withdraw or suspend an entity’s professional authorization (license).
Business Restrictions for Providers: CTPPs can face restrictions that limit their ability to provide services to financial entities if they fail to meet oversight requirements.

4. Individual and Management Liability

DORA places significant personal accountability on senior leaders:

Temporary Management Bans: Beyond personal fines, senior management and key function holders can be subject to temporary bans from holding management positions.
Mandatory Training: Management bodies are legally required to maintain sufficient knowledge to assess ICT risks, and failure to engage in regular training can be a point of regulatory scrutiny.

5. Criminal Penalties

For the most severe violations, DORA allows Member States to pursue criminal sanctions. These measures may include:

Imprisonment for individuals in extreme cases.
Director disqualification orders.
Corporate criminal liability.

Table:
Summary of Key DORA Penalties

This table summarizes the key penalties available under the Digital Operational Resilience Act (DORA):

Key Penalties under DORA

Penalty Type	Description	Relevant Example
Pecuniary Measures (Fines)	Monetary penalties applied to financial entities to ensure continued compliance with legal requirements.	Failing to document or regularly review the ICT risk management framework.
Periodic Penalty Payments	Daily fines for critical ICT third-party service providers, up to 1% of their average daily worldwide turnover, for up to six months.	A critical provider refusing to grant the Lead Overseer access to its Operation Centers for inspection.
Cease and Desist Orders	Formal orders requiring an entity to stop a specific conduct that breaches the law and to avoid repeating it.	Continuing to use unauthorized software that has been identified as a security risk.
Public Censure	Public notices or statements identifying the responsible party and describing the nature of their violation.	Significant or repeated failure to report major ICT-related incidents to competent authorities.
Contractual Termination	A measure of last resort requiring a financial entity to terminate its relationship with a critical third-party provider.	Using a third-party provider that fails to address serious weaknesses in its risk management systems.
Personal Liability	Administrative and remedial measures applied to members of the management body or other responsible individuals.	A senior manager neglecting their responsibility to oversee ICT risk exposure.
Operational Suspension	Requiring a financial entity to temporarily stop using a specific service provided by a critical third party.	A provider fails to provide necessary security audit reports, creating an unmitigated risk to the financial entity.
Data Record Demands	Requiring data traffic records from telecommunications operators, where permitted by national law.	Investigating a potential breach where there is reasonable suspicion of non-compliance.

What DORA Violations Lead to Fines?

DORA fines are imposed for a range of violations related to operational resilience and regulatory oversight. These penalties apply to both financial entities and critical ICT third-party service providers that fail to meet the legal standards set by the framework.

Violations by Financial Entities

Competent authorities have the power to impose administrative penalties and remedial measures for any breach of the regulation’s requirements. Specifically, they may adopt measures of a pecuniary nature (commonly known as fines) to ensure that financial entities continue to comply with their legal obligations. The decision to fine an entity is based on factors such as the materiality and duration of the breach, the degree of responsibility, and the financial strength of the organization.

Violations by Critical ICT Third-Party Service Providers

Critical ICT third-party service providers are subject to a specific set of “periodic penalty payments” designed to compel cooperation with the Lead Overseer. These fines are triggered by the following specific violations:

Failure to Provide Information: Fines are imposed if a provider fails to supply all relevant business documents, contracts, policies, or ICT security audit reports required by the Lead Overseer.
Non-Compliance with Investigations: Providers face penalties if they do not submit to general investigations, fail to produce requested records and data, or fail to provide adequate oral or written explanations during interviews.
Opposition to Inspections: Fines are applied if a provider opposes or fails to submit to mandatory on-site inspections of their Operation Centers, head offices, or other premises.
Failure to Implement Recommendations: Periodic payments may also be used to compel a provider to implement remedies or actions specified in previous oversight recommendations.

Table:
What Factors Influence the Penalty Amounts for DORA Non-Compliance?

Competent authorities are required to ensure that all administrative penalties and remedial measures are effective, proportionate, and dissuasive. To achieve this balance, they evaluate the specific circumstances of a breach using the following mitigating and aggravating factors.

Aggravating Factors for DORA Non-Compliance

Factor	Impact on Penalty Severity
Intentional Conduct	Penalties are increased if the breach was committed intentionally rather than through negligence.
Gravity and Duration	Sanctions are more severe for breaches that are high in materiality or have lasted for a long period.
Previous Breaches	A history of prior violations by the responsible natural or legal person leads to higher penalties.
Financial Impact	Higher fines are imposed when significant profits were gained, or losses were avoided, due to the breach.
Third-Party Loss	The magnitude of losses caused to third parties by the incident is a primary consideration for increasing sanctions.
Systemic Flaws	Serious weaknesses identified in management systems, risk management, or internal controls will intensify remedial measures.
Criminal Association	If a breach facilitated or was attributable to a financial crime, it justifies the most severe measures, including contract termination.

Mitigating Factors for DORA Non-Compliance

Factor	Impact on Penalty Severity
Negligence	If the breach was a result of negligence rather than a deliberate act, authorities may apply more lenient measures.
Cooperation	A high degree of cooperation with the competent authority or Lead Overseer can reduce the final penalty level.
Financial Strength	The financial strength of the responsible party is considered to ensure the fine is proportionate to their ability to pay.
Business Continuity	Regulators may refrain from terminating a contract if doing so introduces an unacceptable risk to the continuity of the financial entity’s operations.

Future-Proofing:
How Will DORA Evolve With AI and Emerging Cyber Threats?

DORA was designed to be technology-neutral, meaning its principles apply whether you are using a mainframe from the 1990s or a generative AI model from 2026. However, as the financial sector hits the “AI Inflection Point,” the way you implement DORA must evolve to remain effective.

DORA and AI Act Convergence

By August 2026, the EU AI Act will be fully applicable, creating a dual-regulatory environment for financial institutions. If you use AI for “high-risk” functions, such as credit scoring or risk assessment, your DORA ICT Risk Management framework must include AI-specific controls.

Algorithmic Resilience

DORA’s requirement for “robust ICT systems” (Article 6) now extends to the integrity of AI models.

You must protect against Data Poisoning (corrupting training data) and Model Evasion (manipulating inputs to bypass security).

Transparency & Bias

Under the AI Act, “high-risk” systems require technical documentation and human oversight. From a DORA perspective, this means your Register of Information (RoI) should specifically flag AI-driven ICT services to ensure they are subject to deeper resilience testing.

Defending Against AI-Powered Cyber Threats

In 2026, the “threat landscape” is being industrialized by Large Language Models (LLMs) and deepfake technology. Your DORA strategy must account for these emerging vectors:

Deepfake Phishing

Standard security awareness training is no longer enough. DORA-mandated training programs must now include simulations of AI-driven voice and video impersonation targeting C-suite executives and payment authorization teams.

Automated Exploit Generation

Threat actors now use AI to scan for vulnerabilities and rewrite malware in real-time. To remain compliant with DORA’s Protection and Prevention pillar (Article 9), firms are increasingly shifting to AI-driven XDR (Extended Detection and Response) to match the speed of the attackers.

Zero Trust: The Final Frontier of Future-Proofing

To move beyond “checklist compliance,” forward-thinking firms are adopting a Zero Trust Architecture (ZTA) as their baseline for DORA.

Continuous Verification

DORA’s “Identity and Access Management” (Article 9) is best satisfied by ZTA, which assumes the network is already compromised and requires every user and device to be verified at every step.

Micro-Segmentation

This ensures that if an AI-driven breach occurs, the impact is “contained,” satisfying DORA’s Continuity and Recovery requirements.

2026 DORA Compliance Questionnaire and Checklist

As of 2026, the European Supervisory Authorities (ESAs) have shifted focus from “Implementation” to “Supervision and Evidence.” Use this questionnaire and checklist to ensure your organization is ready for a potential audit by your National Competent Authority (NCA).

Questionnaire: Are You DORA Compliant in 2026?

ICT Risk Management & Governance

Board-Level Accountability: Does the management body have a documented record of approving and reviewing the ICT Risk Management Framework in the last 12 months?
Risk Tolerance Levels: Have you explicitly defined and documented your “risk appetite” for ICT disruptions, and is it aligned with your current business impact analysis (BIA)?
Digital Resilience Strategy: Is there a clear, written strategy that outlines how the firm will evolve its defenses against emerging 2026 threats (e.g., AI-driven phishing or quantum-ready encryption)?
Legacy System Mapping: Are all “End-of-Life” (EOL) or legacy systems documented with a specific risk-mitigation plan?

ICT Incident Reporting (The 2026 Timeline)

Classification Criteria: Have you updated your internal incident response plan to match the Major Incident thresholds defined in the latest RTS?
Reporting Speed: Can your team realistically hit the mandatory reporting windows?
- Initial Notification: Within 4 hours of classification (or 24 hours of awareness).
- Intermediate Report: Within 72 hours.
- Final Report: Within one month for root cause analysis.
Client Communication: Do you have automated templates ready to inform clients “without undue delay” when a major incident affects their financial interests?

Digital Operational Resilience Testing

Annual Basic Testing: Have all critical ICT systems and applications undergone vulnerability assessments and scenario-based testing in the last year?
TLPT Readiness (if applicable): If your firm is designated as “systemically important,” have you scheduled your Threat-Led Penetration Test (TLPT)? (Required every 3 years.)
Remediation Tracking: Is there a “closed-loop” log showing that every vulnerability found in previous tests has been either remediated or formally “risk-accepted” by the board?

Third-Party Risk Management (TPRM)

Register of Information (RoI): Was your RoI finalized in the mandatory .csv format by the January 31, 2026, submission deadline?
Contractual Gap Analysis: Do all contracts with “Critical ICT Third-Party Providers” now include mandatory clauses for:

Full audit and inspection rights.
Specific Service Level Agreements (SLAs) for resilience.
Termination and “stressed exit” strategies.

Concentration Risk: Have you documented an assessment of your dependency on “Mega-Vendors” (e.g., AWS, Azure, Google Cloud) and identified alternative providers?

Information Sharing

Threat Intelligence Feeds: Is your organization participating in at least one voluntary cyber threat information-sharing community (e.g., an ISAC)?
Policy Privacy: Does your sharing arrangement comply with GDPR while still providing actionable intelligence to the financial community?

Pro Tip for 2026: Regulators are looking for “Operational Maturity.” It is no longer enough to have a policy; you must show the logs, audit trails, and board minutes that prove the policy is being lived.

Checklist:
Your Mandatory To-Do List for DORA Compliance

To comply with the Digital Operational Resilience Act (DORA), financial entities must implement a comprehensive framework that integrates information and communication technology (ICT) security into their broader operational strategy. This checklist, derived from the sources, outlines the mandatory actions required for regulatory compliance.

1. Governance and Risk Management

Establish an ICT Risk Management Framework: Develop and document a sound, comprehensive framework as part of the overall risk management system to address ICT risk quickly and ensure high digital resilience.
Assign Management Body Responsibility: Ensure the management body bears ultimate responsibility for managing ICT risk, defining the risk tolerance level, and approving the digital operational resilience strategy.
Allocate Resources and Training: Review and allocate the budget necessary for digital resilience needs, including compulsory ICT security awareness programs and training for all staff and senior management.
Identify and Classify Assets: Maintain a detailed inventory of all ICT-supported business functions and information assets, specifically mapping and classifying those considered critical.
Implement an Information Security Policy: Develop a policy that defines rules to protect the availability, authenticity, integrity, and confidentiality of data and information assets.
Manage Legacy Systems: Conduct specific ICT risk assessments on all legacy ICT systems at least yearly, particularly before and after connecting new technologies.

2. Protection, Detection, and Recovery

Deploy Security Tools: Implement ICT security policies and tools that ensure the resilience and availability of systems, including network connection infrastructures that can be instantaneously segmented or severed.
Enforce Access Controls: Limit physical and logical access to ICT assets to legitimate functions only, using strong authentication mechanisms and secure management of cryptographic keys.
Establish Detection Mechanisms: Put in place mechanisms to promptly detect anomalous activities and material single points of failure, enabling multiple layers of control.
Maintain Business Continuity and Recovery Plans: Implement dedicated ICT response and recovery plans that allow for the resumption of critical functions with minimum downtime and high data integrity.
Perform Backup and Restoration: Develop backup policies specifying data scope and frequency, and ensure restoration systems are physically and logically segregated from source systems.

3. Incident Management and Reporting

Implement Incident Management Processes: Define and operate a process to detect, manage, and notify ICT-related incidents, ensuring root causes are identified and addressed.
Classify Incidents and Threats: Use standardized criteria, such as clients affected, duration, data loss, and economic impact, to classify incidents as major or cyber threats as significant.
Adhere to Reporting Timelines:
- Initial Notification: Submit as early as possible, but no later than 24 hours after becoming aware of a major incident.
- Intermediate Report: Submit within 72 hours of the initial notification.
- Final Report: Submit no later than one month after the intermediate report.
Notify Affected Clients: Inform clients without undue delay when a major incident impacts their financial interests.

4. Digital Operational Resilience Testing

Execute Yearly Testing: Conduct appropriate tests, such as vulnerability assessments, network security reviews, and performance testing, at least yearly on all ICT systems supporting critical or important functions.
Engage Independent Testers: Ensure tests are performed by independent internal or external parties, avoiding conflicts of interest throughout the design and execution phases.
Conduct Advanced Testing (TLPT): If identified as a systemic entity by competent authorities, carry out advanced Threat-Led Penetration Testing (TLPT) at least every three years.

5. ICT Third-Party Risk Management

Maintain a Register of Information (RoI): Keep a detailed, updated register of all contractual arrangements with ICT third-party service providers at entity, sub-consolidated, and consolidated levels.
Standardize Contractual Clauses: Ensure all written contracts include clear descriptions of services, data processing locations, service level agreements, and unrestricted rights of access, inspection, and audit.
Conduct Pre-Contract Due Diligence: Assess the suitability and security standards of prospective providers and weigh the risks of potential subcontracting before entering arrangements.
Establish Exit Strategies: Develop comprehensive, documented exit plans for ICT services supporting critical or important functions to allow for provider migration or in-house reincorporation without business disruption.
Follow Lead Overseer Recommendations: Critical ICT third-party providers must notify the Lead Overseer within 60 days of their intention to follow issued recommendations.

6. Information Sharing

Participate in Intelligence Exchange: On a voluntary basis, exchange cyber threat information and intelligence within trusted communities to enhance collective defense capabilities.

DORA 2026 FAQ

What is DORA in 2026?

The Digital Operational Resilience Act (DORA) is an EU regulation that mandates financial entities implement strict standards to withstand, respond to, and recover from all types of Information and Communication Technology (ICT) disruptions. As of 2026, the regulation is fully applicable, requiring harmonized digital resilience across 20 different types of financial institutions and their critical ICT service providers.

What are the DORA incident reporting timelines in 2026?

Financial entities must follow a strict three-stage reporting process for major ICT-related incidents. An initial notification must be submitted as early as possible, generally within four hours of classifying the incident as major, and no later than 24 hours after becoming aware of it. An intermediate report is required within 72 hours of the initial notification, and a final report providing a root-cause analysis must be submitted within one month.

Which 20 types of financial entities must comply with DORA?

DORA applies to a broad range of market participants, including credit institutions, payment institutions, and account information service providers. It also covers investment firms, crypto-asset service providers, central securities depositories, and central counterparties. Additionally, the scope includes trading venues, trade repositories, fund managers, insurance undertakings, insurance intermediaries, credit rating agencies, and crowdfunding service providers.

Is a crypto-asset or fintech app covered by DORA?

Yes, if a fintech app functions as a regulated payment institution or an e-money institution, it is within the scope of DORA. Furthermore, any crypto-asset service provider authorized under Union law is explicitly required to comply with these digital resilience standards.

Who is exempt from DORA requirements?

DORA excludes certain small or specialized entities to ensure regulatory proportionality. Exemptions apply to alternative investment fund managers as defined in Article 3(2) of Directive 2011/61/EU, small retirement schemes with fewer than 15 members, and insurance intermediaries that qualify as microenterprises or small-to-medium enterprises. Additionally, Member States may choose to exclude specific national credit or public sector entities.

What criteria make an ICT incident “major” under DORA?

An incident is classified as “major” based on factors such as the number of clients or financial counterparts affected and the duration of the service downtime. Other critical factors include the geographical spread (impacting two or more Member States), the materiality of data losses (such as integrity or confidentiality breaches), and the total economic impact, which is significant if costs exceed €100,000.

How much are the DORA non-compliance fines in 2026?

For critical ICT third-party service providers (CTPPs), regulators can impose periodic penalty payments of up to 1% of the provider’s average daily worldwide turnover from the preceding business year. These fines are applied daily for up to six months until compliance is achieved. Financial entities may also face various pecuniary measures and administrative sanctions, such as cease-and-desist orders or public censures.

What are the DORA testing requirements for systemic banks?

Entities identified as having a systemic impact on the financial sector must perform advanced “Threat-Led Penetration Testing” (TLPT) at least every three years. This testing must cover critical or important functions and be performed on live production systems to simulate real-life cyberattacks.

Does DORA apply to my cloud service provider?

Yes, ICT third-party service providers, including cloud computing and data analytics providers, are within the scope of the regulation. Providers designated as “critical” by European Supervisory Authorities (ESAs) are subject to a Union-wide oversight framework that includes direct inspections and recommendations from a Lead Overseer.

What is the “simplified ICT risk management framework”?

Small or non-interconnected investment firms and other smaller financial entities may follow a simplified framework to reduce administrative burdens. While these entities must still maintain sound ICT security and business continuity plans, their requirements are more flexible and proportionate to their size and risk profile.