The Digital Operational Resilience Act: content, dates and supervision

DORA stands for Digital Operational Resilience Act. The regulation sets out how financial entities manage ICT risk, report incidents, test their resilience and manage their ICT service providers. Whether DORA applies to your firm, and under which framework, is covered on DORA applicability.

What does the DORA regulation cover?

The DORA regulation lays down uniform requirements for the security of the network and information systems that support the business processes of financial entities (Article 1(1)). For financial entities these are six topics: ICT risk management, reporting of major ICT-related incidents and voluntary notification of significant cyber threats, reporting of payment-related incidents (credit, payment and e-money institutions and account information service providers only), digital operational resilience testing, sharing of cyber threat information and the management of ICT third-party risk. In addition, the regulation sets rules on contracts with ICT third-party service providers, the oversight framework for critical ICT third-party service providers and the rules on supervision.

As a regulation, DORA applies directly and needs no German transposition act (Article 64). BaFin states that it will not issue circulars specifying DORA, because national supervisors have no rule-making power of their own for a European regulation. Detail comes from European legal acts and guidelines. In relation to the NIS2 Directive, DORA is the sector-specific act for financial entities identified as essential or important entities under NIS2 (Article 1(2)) and takes precedence for risk management and incident reporting. For NIS2 itself see NIS2-Readiness (in German).

When does DORA apply?

DORA has applied since 17 January 2025, and BaFin has said there will be no further transition period. Some institutions brought in by German law follow their own dates.

On 6 November 2026 the Official Journal database (Cellar) listed no amending act for DORA. That is the result of our own query, so check the current position before relying on it.

How is the regulation structured?

The regulation has nine chapters. Chapters II to V contain the obligations of financial entities, the others set out principles, supervision and final provisions.

Article 4 sets the proportionality principle: it applies to Chapter II in general, and to Chapters III, IV and Section I of Chapter V only where the individual provisions say so. A firm under Article 16 replaces Articles 5 to 15 only. Chapters III to VI still apply in principle, with the exceptions explained on DORA Article 16.

Reading map: which article answers which question?

The reading map links the questions that usually come first to the article in the regulation and the matching level 2 act. It does not replace reading the text, it shows where to find it. The order is our suggestion for a first pass.

On Article 45: financial entities may share information on cyber threats with each other, such as indicators of compromise and alerts, where this serves resilience. They notify the competent authority when they join such an arrangement and when they leave it (Article 45(3)).

Level 2: which RTS and ITS specify DORA?

The Commission adopts regulatory technical standards (RTS) as delegated regulations and implementing technical standards (ITS) as implementing regulations. Both apply directly, like DORA, and mainly specify Chapters II to V. For most financial entities these eight acts matter:

Further acts deal with the oversight framework for critical ICT third-party service providers and are aimed mainly at supervisors and providers, so they are not listed here. Guidelines of the European Supervisory Authorities come on top. Firms under Article 16 do not apply Delegated Regulation 2024/1773, because Article 28(2) does not apply to them.

German add-ons: the FinmadiG

The German Financial Market Digitalisation Act (FinmadiG, Federal Law Gazette 2024 I No. 438 of 27 December 2024) extends DORA to institutions the regulation itself does not name, such as factoring and finance leasing firms and guarantee banks (section 1a(2a) with section 65a(3) KWG), to regional development banks (section 1a(2) KWG) and to insurance holding companies (section 293(5) of the Insurance Supervision Act, VAG). Who exactly is covered, and under which framework, is set out on DORA applicability.

Supervision in Germany: BaFin, ECB and Bundesbank

Which authority supervises DORA follows from Article 46 and sectoral law. For credit institutions, Article 46(a) points to the national banking supervisor and, for significant credit institutions, to the ECB. The German Banking Act implements this as follows: the competent authorities under Article 46 are the supervisory authorities under section 1(5) KWG, that is the ECB where it is competent within the Single Supervisory Mechanism and BaFin otherwise (section 6(1g) KWG). For TLPT, BaFin works with the Deutsche Bundesbank, which carries out the operational tasks. For other financial entities, Article 46 names the authority competent under the relevant sectoral law.

Reports go to BaFin: major incidents through its reporting and publishing platform (MVP), significant credit institutions also to the national authority, which forwards them to the ECB (Article 19(1)). The register of information is submitted once a year through the MVP. The European Supervisory Authorities designate and oversee critical ICT third-party service providers, and according to BaFin only the supervisors assess criticality.

Which BaFin sources matter?

Our suggestion: keep the sources with date and retrieval date in a register of applicable rules. The supervisory notices help with restructuring, but the wording of DORA and the level 2 acts is what counts.

What are the penalties?

DORA gives competent authorities supervisory, investigatory and sanctioning powers (Article 50(1)). Member States lay down administrative penalties and remedial measures that are effective, proportionate and dissuasive (Article 50(3)). These include at least orders to cease conduct, measures including those of a pecuniary nature and public notices naming the person and the nature of the breach (Article 50(4)). Subject to national law, penalties can also be imposed on members of the management body (Article 50(5)). We do not describe the German fine provisions here.

Example: a small investment firm reads the regulation

Fictitious example. A wealth manager licensed as an investment firm, with twelve staff, has to record for its auditor which DORA provisions it applies. Using the reading map, management works through it like this:

1. Article 2(1)(e): investment firms are financial entities, so DORA applies.
2. Article 3(34) and Article 16(1): if the firm meets the conditions of Article 12(1) of Regulation (EU) 2019/2033, it is small and non-interconnected and applies Article 16. It records the result, with figures, in a classification record (Applicability).
3. Delegated Regulation 2024/1774 Title III: Articles 28 to 41 are the checklist for its own framework (Article 16).
4. Chapter III: incident management and reporting apply, Article 16 replaces nothing here. Only the rule on aggregating recurring incidents in Article 8(2) of Delegated Regulation 2024/1772 does not apply to the entities referred to in Article 16(1) DORA, including this investment firm. Whether it also covers factoring and leasing institutions brought in by section 1a(2a) KWG is an open question.
5. Chapter IV: TLPT does not apply (Article 26(1)). Articles 24 and 25 contain no exception for Article 16 firms, the reasoning is on Article 16.
6. Chapter V Section I: Articles 28 to 30 apply, without the strategy under Article 28(2).
7. Article 46(c): the competent authority is the one designated for investment firms.

The result is a one-page list of applicable rules with a date that the auditor can follow. Whether the conditions of Article 12(1) of Regulation (EU) 2019/2033 are met depends on the individual case and belongs in the legal review.

Three typical gaps in working with the regulation

How we can help

We compare your documents with the parts of the regulation and the level 2 acts that may apply to you, based on what you tell us. The starting point is the DORA gap analysis. This is general information. The legal assessment of your case remains with your legal advisers.