DORA Compliance Guide 2026: Requirements & Deadlines

DORA Compliance Guide 2026: Requirements, Deadlines & Checklist

Quick answer: DORA compliance means meeting the Digital Operational Resilience Act (Regulation (EU) 2022/2554), which has applied directly across the EU since 17 January 2025. Financial entities must run an ICT risk management framework, report major ICT incidents on strict deadlines, test their operational resilience, govern third-party ICT risk, and maintain a Register of Information for ICT third-party arrangements. Because DORA is directly applicable as an EU regulation, the core obligations are harmonised across Member States; national competent authorities still define local submission windows, penalties, and supervisory processes.

The Digital Operational Resilience Act (DORA) — Regulation (EU) 2022/2554 — is the EU's dedicated framework for ICT risk management in the financial sector. It has applied since 17 January 2025 and affects virtually every regulated financial entity in the European Union.

Unlike NIS2, DORA is a regulation, not a directive. It applies directly across all Member States without requiring national transposition. Regulation (EU) 2022/2554, Article 64 sets 17 January 2025 as the application date. If you are in the financial sector, DORA compliance is not optional — and in 2026, regulators have shifted from guidance to enforcement.

---

What Is DORA?

DORA establishes a comprehensive framework to ensure that financial entities can withstand, respond to, and recover from ICT-related disruptions and threats. It covers five key pillars:

1. ICT risk management — Governance framework for managing ICT risks
2. ICT-related incident reporting — Standardised reporting of major incidents
3. Digital operational resilience testing — Regular testing of ICT systems
4. ICT third-party risk management — Oversight of critical ICT service providers
5. Information sharing — Voluntary sharing of cyber threat intelligence

The regulation recognises that the financial sector's increasing dependence on technology creates systemic risks that go beyond individual institutions. A single ICT failure or cyberattack can cascade through interconnected financial systems — making operational resilience a matter of financial stability, not just IT security.

---

Who Must Comply With DORA?

DORA applies to 20 categories of financial entities:

Category	Examples
Credit institutions	Banks
Payment institutions	Payment processors, PSPs
Electronic money institutions	E-money issuers
Investment firms	Brokers, asset managers
Crypto-asset service providers	Exchanges, custodians
Insurance and reinsurance undertakings	Insurers, reinsurers
Insurance intermediaries	Brokers, agents
Institutions for occupational retirement	Pension funds
Central counterparties	Clearing houses
Trade repositories	Transaction reporting
Central securities depositories	Securities settlement
Trading venues	Stock exchanges, MTFs
Securitisation repositories	ABS data
Credit rating agencies	Rating providers
Crowdfunding service providers	Crowdfunding platforms
Data reporting service providers	APAs, ARMs
Managers of alternative investment funds	Hedge fund managers, PE managers
Management companies	UCITS managers
Account information service providers	Open banking providers

Additionally, critical ICT third-party service providers (CTPPs) — such as major cloud providers serving the financial sector — are subject to a new oversight framework.

Proportionality

DORA applies the principle of proportionality. Requirements scale based on:

• Size and overall risk profile of the entity
• Nature, scale, and complexity of services
• The entity's ICT risk exposure

Microenterprises (fewer than 10 employees and less than €2M turnover) benefit from a simplified ICT risk management framework under Articles 15-16.

---

The Five Pillars of DORA

Pillar 1: ICT Risk Management (Articles 5–16)

Financial entities must establish a comprehensive ICT risk management framework that includes the following. Most firms build this on an established risk management framework — typically COBIT 2019 for governance paired with ISO/IEC 27005 for the ICT risk-assessment process:

Governance:

• Management body retains ultimate responsibility for ICT risk
• Dedicated ICT risk management function, independent from operational ICT
• ICT risk management strategy reviewed at least annually
• Management body must complete ICT risk training

Identification:

• Identify, classify, and document all ICT-supported business functions
• Map ICT assets and their dependencies
• Identify all sources of ICT risk
• Conduct risk assessments at least annually

Protection and Prevention:

• Implement ICT security policies and procedures
• Patch management with defined timelines
• Network security and access controls
• Data protection and encryption measures

Detection:

• Continuous monitoring of ICT systems
• Anomaly detection mechanisms
• Multiple layers of control

Response and Recovery:

• ICT business continuity policy
• Disaster recovery plans with recovery time objectives (RTOs) and recovery point objectives (RPOs)
• Crisis communication procedures
• Post-incident reviews

Learning and Evolving:

• Gather threat intelligence
• Post-incident root cause analysis
• Continuous improvement of the framework

Pillar 2: ICT-Related Incident Reporting (Articles 17–23)

DORA standardises incident classification and reporting across the financial sector. Financial entities must classify and report major ICT-related incidents according to strict thresholds:

Major Incident Classification Criteria:

• Number of clients or counterparties affected
• Duration of the incident
• Geographical spread
• Volume of data losses
• Impact on critical services
• Economic impact

Reporting Timeline:

Timeline	Report Type	Content
Within 4 hours of classification as major (no later than 24 hours after detection)	Initial notification	Basic facts and classification
Within 72 hours of classification	Intermediate report	Updated assessment and impact
Within 1 month after the intermediate report	Final report	Root cause analysis, remediation measures

Financial entities must also notify affected clients without undue delay when incidents impact their financial interests (Article 19(3)). This horizontal communication obligation — to counterparties, not just regulators — is one of DORA's most operationally demanding requirements.

Pillar 3: Digital Operational Resilience Testing (Articles 24–27)

All financial entities must conduct regular testing:

Basic Testing (all entities):

• Vulnerability assessments and scans
• Open source analyses
• Network security assessments
• Gap analyses
• Physical security reviews
• Scenario-based testing
• Compatibility testing
• Performance testing
• End-to-end testing

Advanced Testing (significant entities only):

• Threat-Led Penetration Testing (TLPT) at least every three years
• Must follow recognised frameworks (TIBER-EU or equivalent national framework)
• Conducted by qualified external testers
• Covers critical ICT systems supporting critical or important functions
• Results reported to competent authorities

TIBER-EU (Threat Intelligence-Based Ethical Red Teaming) is the ECB's framework for TLPT — though national variants (like TIBER-DE, TIBER-NL, TIBER-FR) are equally accepted.

Pillar 4: ICT Third-Party Risk Management (Articles 28–44)

DORA creates a comprehensive framework for managing outsourcing and third-party ICT risk. This is one of the most operationally intensive aspects of DORA compliance:

Pre-Contractual Requirements:

• Risk assessment before entering any ICT service contract
• Due diligence on potential providers
• Concentration risk assessment — avoiding systemic dependence on single providers

Contractual Requirements (Article 30): Contracts with ICT third-party providers must include mandatory provisions covering:

• Full description of services and SLAs
• Location of data processing and storage
• Right to audit and access
• Cooperation obligations during incidents
• Data portability and transition support
• Exit strategies and transition plans — for critical/important services, Article 28(8) additionally requires documented, tested exit plans per arrangement; our free DORA exit strategy template (DOCX + PDF + MD) covers the strategy, the per-arrangement plan form, and the testing log

Register of Information (Article 28(3)): Financial entities must maintain a structured, continuously updated register of all ICT third-party service provider arrangements. This register is a key supervisory tool — it must be available for inspection at any time and submitted annually to national authorities.

Oversight of Critical ICT Third-Party Providers (CTPPs): The European Supervisory Authorities (EBA, EIOPA, ESMA) can designate providers as CTPPs, subjecting them to direct oversight including:

• Annual risk analyses
• Comprehensive reporting obligations
• On-site and remote inspections
• Joint Examination Teams (JETs)
• Periodic penalty payments of up to 1% of average daily worldwide turnover for non-cooperation

Pillar 5: Information Sharing (Article 45)

DORA encourages — but does not mandate — financial entities to share cyber threat intelligence:

• Share indicators of compromise, tactics, techniques, and procedures (TTPs)
• Exchange information on cyber threats within trusted communities
• Participate in information sharing arrangements
• Notify competent authorities about participation

---

DORA in 2026: What Has Changed

19 Critical ICT Third-Party Providers Designated

On 18 November 2025, the EBA, EIOPA, and ESMA published the first official list of 19 designated Critical ICT Third-Party Providers under DORA. The list includes major cloud and platform service providers:

• Hyperscale cloud: AWS, Microsoft Azure, Google Cloud
• Financial data and technology: Bloomberg, London Stock Exchange Group, IBM
• IT services and telecom: Tata Consultancy Services, Orange

These providers are now subject to direct oversight by Joint Examination Teams (JETs). Financial entities that rely heavily on any designated CTPP must document this dependency in their Register of Information and assess concentration risk accordingly.

Register of Information — 2026 Submission Planning

The official EBA Register of Information reporting resources confirm that DORA became applicable on 17 January 2025 and that financial entities in scope must keep a comprehensive register of ICT third-party arrangements available at entity, sub-consolidated, and consolidated levels. The EBA resources also provide the ITS, data model, validation rules, data-quality feedback, and 2024 dry-run materials used for RoI reporting.

For 2026, treat the RoI as a national-supervisor submission obligation rather than a single universal EU deadline. Confirm the applicable date and file format with your national competent authority, then validate the register against the EBA reporting package before submission.

To maintain the register between submissions, download our free DORA Register of Information starter (XLSX + PDF + MD) — a human-readable working register mapped to the ITS template groups (B_01–B_07), with the S01–S19 service taxonomy, the provider identifier rules, and a pre-submission checklist built in.

Planning item	Source-backed guidance
Official reporting basis	DORA Article 28 and the EBA RoI reporting resources
Submission route	National competent authorities collect registers from financial entities and provide information to the ESAs for CTPP designation
2026 timing	Follow the submission window communicated by your national competent authority
Quality control	Run the EBA validation rules and data-quality checks before submission

Data-quality warning: The ESAs' 2024 dry-run materials and EBA RoI resources highlight common issues in RoI reporting, including incomplete contract data, missing subcontractor information, and incorrect criticality classifications. Treat the 2026 register as a data-quality exercise, not a document upload.

Enforcement Has Shifted

DORA is now an active supervisory requirement, not a future implementation project. The official EBA RoI resources list validation rules, data-quality feedback, and common reporting issues, which means firms should be ready to show structured evidence rather than policy documents alone.

Operationally, that means:

• Keep the Register of Information complete and validation-ready
• Maintain evidence for ICT risk management decisions and resilience tests
• Document subcontractors, service locations, and criticality classifications
• Review board-level accountability and remediation tracking regularly

---

DORA vs NIS2: Understanding the Relationship

For financial entities, both DORA and NIS2 may be relevant. DORA is lex specialis — it takes precedence where its requirements are more specific:

Aspect	DORA	NIS2
Legal form	Regulation (directly applicable)	Directive (requires transposition)
Scope	Financial sector + critical ICT providers	18 cross-sector categories
Incident reporting	4h initial (from classification) / 72h intermediate / 1 month final	24h early warning / 72h notification / 1 month final
Testing	TLPT every 3 years for significant entities	Effectiveness assessment (less prescriptive)
Third-party risk	Detailed framework with oversight regime	Supply chain security requirements
Precedence	Takes priority for financial entities	Applies where DORA doesn't cover

Financial entities comply with DORA for ICT-related requirements. NIS2 may still apply for aspects not specifically covered by DORA — and GDPR obligations run in parallel for personal data processing. For a detailed side-by-side analysis of scope, incident timelines, penalties, and dual-obligation strategy, see our DORA vs NIS2 comparison guide.

---

DORA Compliance Penalties

DORA does not fully harmonise monetary penalties for financial entities at EU level. Article 50 instead requires Member States to establish effective, proportionate, and dissuasive penalties and remedial measures, so exact fines depend on national law and the relevant competent authority.

For Financial Entities:

• Remediation orders and binding deadlines
• Public statements and supervisory notices
• Restrictions on management functions
• Suspension or withdrawal of authorisation
• Administrative penalties under applicable national law

For Critical ICT Third-Party Providers:

• Lead overseer recommendations and follow-up measures
• Remediation requirements under the oversight framework
• Periodic penalty payments for non-compliance or non-cooperation

Senior management accountability is explicit under DORA, but the exact monetary exposure for financial entities depends on the national regime.

---

DORA Compliance Roadmap

Step 1: Assess Applicability and Proportionality

Determine which DORA requirements apply to your entity based on:

• Entity type (which of the 20 financial-entity categories applies)
• Size (microenterprise vs. standard vs. significant entity)
• ICT risk exposure and criticality of operations

Step 2: Conduct a DORA Gap Analysis

Map your current ICT risk management framework against DORA's five pillars. Common gaps identified in 2025 supervisory assessments include:

• Incomplete or absent Register of Information
• Incident classification thresholds not defined
• No TLPT programme for entities qualifying as significant
• Third-party contracts missing DORA-mandatory provisions
• Concentration risk not formally assessed

Step 3: Build Your ICT Risk Management Framework

Establish or update your framework to cover Articles 5–16 requirements:

• Document the management body's formal ICT risk oversight role
• Create or update ICT risk strategy, appetite, and policies
• Establish independent ICT risk management function
• Implement continuous monitoring and anomaly detection

Step 4: Build Incident Reporting Capability

The 4-hour initial notification (from classification as major) is operationally demanding — it requires:

• Pre-defined incident classification criteria and thresholds
• 24/7 detection and escalation procedures
• Pre-agreed notification templates
• Named regulatory contacts at each NCA
• Client notification workflows (Article 19(3))

Step 5: Implement a Resilience Testing Programme

For all entities:

• Annual vulnerability assessments and network security testing
• Scenario-based business continuity exercises

For significant entities:

• Identify and engage qualified TLPT testers
• Align with TIBER-EU or national equivalent
• Agree scope with competent authority in advance

Step 6: Fix Your Register of Information

This is the most urgent practical priority in 2026. Requirements:

• Document all ICT third-party service arrangements using the official EBA RoI reporting resources
• Include: provider details, contract scope, service locations, subcontractors, criticality classification
• Assess concentration risk for providers serving multiple critical functions
• Submit by your national NCA's deadline

Step 7: Implement Continuous Compliance

DORA compliance is not a point-in-time exercise. Build continuous processes for:

• Ongoing monitoring of ICT third-party providers' security posture
• Quarterly review of the Register of Information
• Annual review of the ICT risk management framework
• Annual review of incident classification thresholds

---

How Orbiq Supports DORA Compliance

Orbiq helps financial entities manage DORA's operational requirements continuously:

• Register of Information management: Maintain a complete, structured inventory of ICT third-party arrangements — always ready for supervisory submission
• Vendor monitoring: Continuous assessment of third-party ICT providers' security posture and compliance status, including designated CTPPs
• Evidence management: Automated collection and organisation of compliance evidence for regulatory inspections and TLPT processes
• Trust Center: Demonstrate your operational resilience posture to counterparties, auditors, and regulators — fulfilling the Article 19(3) horizontal communication obligation
• Supply chain visibility: Real-time view of your ICT dependency landscape, concentration risk scoring, and CTPP exposure mapping
• Continuous monitoring: Automated controls monitoring that generates inspection-ready evidence without manual effort

Built for European financial services from day one, with EU data residency and GDPR-native architecture. If you're also evaluating EU compliance software across NIS2, GDPR, and CRA — not just DORA — see our EU Compliance Software Buyer's Guide for a structured comparison framework.

---

Key DORA Deadlines in 2026

Deadline	Requirement
NCA-specific window	Register of Information submission, where requested by your national competent authority
Ongoing	Continuous monitoring of ICT third-party providers
Annually	ICT risk management framework review
Every 3 years	TLPT for significant entities

---

Further Reading

• DORA Incident Reporting and Provider Monitoring: Articles 19, 28, 30
• Risk Management Frameworks: COSO, ISO 31000, COBIT, and More — Comparison of frameworks used to structure DORA-compliant ICT risk management
• Security Questionnaire Guide 2026 — How to manage the questionnaire volume that DORA third-party obligations generate
• NIS2 Compliance Guide — For requirements beyond DORA's scope
• NIS2 Supply Chain Security — Complementary third-party risk guidance
• Vendor Assurance Platform — How Orbiq manages ICT third-party risk at scale
• Best ISMS Software 2026 — Compare platforms by ISO 27001 depth, NIS2/DORA coverage, and EU data residency

---

Free download: the DORA ICT Provider Evidence Checklist template turns the Article 28–30 obligations into a working, RoI-aligned provider register — XLSX with criticality and evidence cadence, plus PDF and a machine-readable Markdown variant.

Sources & References

1. Regulation (EU) 2022/2554 — DORA Full Text — Official EU Journal source for all article references
2. EIOPA Digital Operational Resilience Act overview — Official ESA overview of DORA scope, application date, and covered requirements
3. EBA preparations for reporting DORA registers of information — Official RoI reporting tools, ITS, validation rules, data-quality materials, and dry-run resources
4. ESAs designate critical ICT third-party providers under DORA, 18 November 2025 — First CTPP designation source
5. Regulation (EU) 2022/2554, Article 64 — Application date
6. TIBER-EU Framework — European Central Bank — TLPT recognised framework reference

---