🇪🇺DORA: What Operational Resilience Costs an EU Licence Holder

What DORA is and who falls under it

DORA — Regulation (EU) 2022/2554 on digital operational resilience for the financial sector — has applied since 17 January 2025, directly in every EU member state and with no national transposition. It did not arrive alone, and the companion piece is easy to miss: Directive (EU) 2022/2556 strips the scattered ICT provisions out of eight sectoral directives — UCITS, Solvency II, AIFMD, CRD IV, BRRD, MiFID II, PSD2 and IORP II. Without it a payment institution would still carry its own incident rule in PSD2 and a fund manager its own in AIFMD, and the "single framework" would have fractured into eight mismatched ones. The directive entered into force on 16 January 2023, with transposition timed to the regulation's application date.

The perimeter spans some twenty categories: credit institutions, payment institutions and EMIs, account information service providers, MiCA-licensed CASPs, investment firms, fund managers — including third-party ManCos — insurers and intermediaries, credit rating agencies, trading venues, central securities depositories, benchmark administrators and crowdfunding platforms. Most holders of an EU financial licence are inside the perimeter, but applicability is checked against the specific category and its exclusions. One consequence matters when comparing venues on the licence map: DORA does not vary by member state — a Lithuanian EMI and a Luxembourg one read the same text.

Proportionality is written into the regulation rather than negotiated with the supervisor. A microenterprise — fewer than 10 staff and annual turnover or balance sheet up to €2 million — runs the simplified ICT risk management framework under Article 16 and does no threat-led penetration testing. Some entities sit outside the regulation entirely: insurance intermediaries that are microenterprises, occupational pension institutions with very few members, and a handful of small categories. But reading that as "we are small, this does not apply" is expensive: everyone inside the perimeter files the register of information and reports incidents, simplified regime included.

The underlying demand is single: a holder of an EU financial licence must demonstrably survive IT failures, attacks and cloud outages — and tell the supervisor about them on time. There is no public universal benchmark for the cost of compliance; the load depends on scale, architecture, the number of providers and the criticality of functions.

The key parameters of the regime in one table; each is developed in the sections below.

The five pillars: what is actually required

The regulation splits into five blocks of duties. Four are mandatory, the fifth voluntary. The detail most often missed: the ICT risk management framework is approved by the management body, which carries personal accountability for it under Article 5. Operational execution can be delegated; the management body's accountability and oversight cannot.

The dividing line that governs everything else is whether a service supports a "critical or important function". That single classification decides whether the entity needs the enhanced contractual terms, audit rights and an exit plan. The call is made by the entity itself and in writing — supervisors test the reasoning, not the label.

Incident reporting: thresholds and windows

An incident becomes major against the Article 18 criteria: the number and relevance of clients and financial counterparties affected, duration and service downtime, geographical spread, data losses across availability, authenticity, integrity and confidentiality, criticality of the services affected, and economic impact. Materiality thresholds are set by Delegated Regulation 2024/1772, adopted on 13 March 2024 and in force since 15 July 2024. The content and timing of the reports themselves come from Delegated Regulation 2025/301, adopted on 23 October 2024 and published on 20 February 2025.

Those 24 hours are calendar hours, weekends and public holidays included. Hence a requirement the text never states outright: an on-call rota and pre-drafted templates. An institution that starts working out who is authorised to sign a regulatory notification during the incident has already missed the window.

One piece of good news: the duplication really was removed. On 17 January 2025 the EBA repealed its guidelines on major incident reporting under PSD2, so payment institutions, EMIs, banks and AISPs now report once, under DORA, instead of twice. The remaining exception is narrow — PSPs outside DORA's perimeter, such as post-office giro institutions and credit unions.

The register of ICT contracts: annual filing and data quality

The register of information is DORA's most underestimated obligation. It is not a supplier list but a structured set of linked tables built to ESA templates, carrying an LEI for every provider, function codes, a criticality flag, data processing locations and the subcontracting chain.

The dress rehearsal showed how hard that is. In the ESAs' dry run, published on 17 December 2024, nearly 1,000 EU financial entities submitted registers. Just 6.5% passed all 116 data quality checks — meaning 93.5% contained at least one error. Half of the rest failed fewer than five checks, but the spread explains why the ESAs called the 2025 target "within reach" rather than met.

Then came the live cycles. The first EU-wide collection ran in spring 2025: in Luxembourg the CSSF window ran from 1 to 15 April, after which national regulators passed the data to the ESAs by 30 April. The second cycle ran from 11 February to 31 March 2026 against a 31 December 2025 cut-off. The checks themselves did not change, but they were applied to more fields: files accepted in 2025 were rejected in 2026. Third-country branches were added to scope.

This is not paperwork for its own sake. The register is the dataset from which the ESAs designate critical providers, and the lens through which supervisors see who is concentrated on a single cloud. Errors are the first trigger for questions, and discrepancies between two institutions describing the same provider are reconciled automatically.

Article 30, subcontracting and exit plans: the contracts that must be rewritten

This is the most expensive section of the regulation, because it demands re-papered contracts rather than a new policy. Article 30 sets two tiers.

Every ICT contract must contain:

• a clear and complete description of all functions and services, stating whether subcontracting is permitted and on what conditions;
• the locations where services are provided and data is processed and stored, with advance notice of any change;
• provisions on availability, authenticity, integrity and confidentiality of data;
• guarantees of access to, recovery of and return of data on provider insolvency, resolution or termination;
• service level descriptions and their updates;
• assistance during ICT incidents at no additional cost or at a price fixed ex ante;
• a duty to cooperate fully with competent and resolution authorities;
• termination rights and notice periods;
• participation of the provider's staff in digital resilience awareness and training programmes.

Contracts supporting a critical or important function add:

• full service level descriptions with precise quantitative and qualitative performance targets;
• notification of any development liable to materially affect the service;
• an obligation to implement and test business contingency plans;
• participation in the financial entity's TLPT;
• unrestricted rights of access, inspection and audit for the entity, an appointed third party and the competent authority;
• exit strategies with a mandatory transition period during which the provider keeps delivering while the function is migrated.

The exit plan is where formal compliance breaks at the first inspection. A credible one does not read "we will move clouds in a fortnight". It has four parts:

1. A degradation scenario setting out precisely what stops working and what keeps running.
2. Data extraction in a usable format, with the export actually tested.
3. An identified alternative provider or in-house fallback.
4. Evidence that the transition would neither breach regulatory requirements nor interrupt client service.

The plan is meant to be tested, not filed.

Subcontracting deserves its own note. Delegated Regulation 2025/532 was published in the Official Journal on 2 July 2025 and entered into force on 22 July.

Its path was bumpy: the ESAs submitted a draft in summer 2024, and on 21 January 2025 — four days after DORA began to apply — the Commission rejected it. The reason was Article 5 of the draft, which imposed monitoring duties across the entire subcontracting chain; in the Commission's view this went beyond the mandate the ESAs were given by Article 30(5) DORA and was not specifically linked to the conditions for subcontracting.

The adopted text omits it, but chain monitoring did not leave the RTS: Article 4 requires the contract to oblige the ICT provider itself to monitor every subcontracted service supporting a critical or important function and to report on it to the financial entity. The practical effect is different from the one usually reported: the entity's own duty to assess the chain sits in the regulation (Articles 28 to 30), while ongoing control of subcontractors is placed by the RTS on the provider through contractual terms.

For the layered structures of embedded finance, and for anyone operating under someone else's licence, this means seeing not just the vendor but whoever the vendor stands on.

Critical ICT providers: the cloud under direct EU oversight

On 18 November 2025 the ESAs designated the first group of critical ICT third-party providers (CTPPs). The list itself is published by the ESAs as a separate file: the release names neither a number nor a single provider, so the composition is checked against that list rather than against press summaries. The designation criteria are the provider's systemic importance, its role in supporting critical or important functions and the substitutability of its services; the services in scope run from core infrastructure to business and data services. Designation is reviewed annually.

The oversight machinery works like this. Each designated provider is assigned a Lead Overseer — one of the three ESAs — plus a joint examination team drawn from ESA and national staff. The team runs annual risk assessments, issues information requests, conducts inspections including at the provider's own premises, and publishes recommendations. The provider must nominate an EU legal entity as its coordination point. Providers fund the regime themselves: fees are calculated on turnover under Delegated Regulation 2024/1505. Ignoring a Lead Overseer's recommendations can attract periodic penalty payments of up to 1% of the provider's average daily worldwide turnover under Article 35.

For a licence holder, designation removes nothing. The exit strategy, the concentration assessment and the contractual rights remain the entity's duty: responsibility is not outsourced along with the server, and ESA supervision of the provider is not a substitute for the entity's own supervision of its dependence on that provider. What has changed is bargaining power. DORA addenda at the hyperscalers are now standard paper rather than the product of a six-month negotiation, which means a small institution can obtain terms once reserved for large banks simply by citing the regulation.

Enforcement and what it costs

As of August 2026 there are no publicly known fines issued specifically "for DORA". Sanctions are left to national law under Articles 50 to 52, there is no EU-wide ceiling, several member states allow criminal liability, and regimes differ widely. But coercion is already operating at the entrance.

ESMA's fast-track peer review on a CASP authorisation in Malta, published on 10 July 2025, examined one specific authorisation and found no evidence that several key aspects of the file had been adequately assessed: alongside the business plan, conflicts of interest, governance arrangements and certain AML/CFT controls, the list included risks related to the ICT infrastructure and custody.

The verdict was split by area — supervisory settings and resources were rated as fully meeting expectations and supervisory review and use of powers as largely meeting them, with only the authorisation process itself rated as partially meeting expectations.

What travels beyond Malta is the set of recommendations addressed to all national competent authorities: before granting an authorisation, review the ICT systems, business continuity included, specifically against DORA requirements, with closer scrutiny of the services most critical to the business, such as custody. Since then the ICT section of an application has been a genuine filter: a weak DORA block stops a file as reliably as weak AML. How an application is assembled is covered in the guide to the MiCA CASP licence.

The second lever is data. Registers are cross-checked across the EU automatically, and discrepancies become supervisory orders. The price of non-compliance today is not a fine but months of delay to an authorisation, a passporting notification or a transaction. The same now applies to opening and keeping accounts: counterparties and correspondents increasingly ask for DORA documentation, and banking for a licensed operator has become a conversation about ICT resilience as much as about AML.

What it costs is a question with no honest public answer. The regulation sets no benchmarks, no official cost methodology has been published, and consultants' estimates differ by an order of magnitude and usually arrive attached to a proposal. The useful exercise is not "what does DORA cost" but which permanent lines it creates, each traceable to an article.

The most underestimated line is not the testing but the standing vendor-control function — it never ends and grows with every new supplier.

One common misconception is worth clearing. The oversight fees under Regulation 2024/1505 are paid by the critical providers themselves, not by the financial entities that use them. That levy does not enter the entity's budget; it enters the price of its cloud.

Proportionality offers legitimate savings: the simplified framework for microenterprises, no TLPT absent designation, outsourced monitoring. But alongside the licensed operator's compliance stack and the EU AML package, this is a fixed load that turns a "licence in reserve" into an expensive hobby — and the strongest argument for pricing a rented licence seriously at the outset.

How DORA shows up outside the licence holder: questionnaires, outages and due diligence

DORA confers no direct rights on whoever's money sits with the operator. It is a supervisory regulation, not a consumer one, and no cause of action flows from it. Outside the licence holder's own perimeter it does, however, change three practical things.

First, it explains the questionnaires. When a counterparty, vendor or portfolio company of a financial entity gets questions about its software, integrations, data locations and subcontractors, that is not curiosity — it is someone populating their register of information. Declining to answer increasingly means declining the relationship.

Second, it sets expectations during an outage. The operator must classify the incident, notify the supervisor within hours and recover to a tested plan rather than improvising. A service down for a third day with no coherent status update is itself evidence about the quality of the framework behind it.

Third, it supplies a vocabulary for due diligence. When deciding where to hold operating balances, three questions say more than any brochure: how the last register filing went, whether the entity is designated for TLPT and when the last one ran, and what the exit plan for its principal cloud provider actually says. This matters most when comparing venues: a Lithuanian EMI and a Luxembourg one carry identical DORA obligations, but the maturity of execution and the strictness of supervision differ considerably.

One reminder DORA does not displace: money held at an EMI is not covered by deposit guarantee schemes, and operational resilience is no substitute for safeguarding. A family's own cyber defence is a separate discipline, covered in family cybersecurity and privacy.

The first year of incidents: numbers instead of horror stories

The ESAs' first annual report on major incidents, published on 3 June 2026, closes out the 2025 reporting year: 3,383 major incidents, an average of 0.18 per entity in scope. System failures and external events were the main drivers; cyberattacks accounted for only 10% of reported cases, and third-party risk management is flagged as a concern of its own. Roughly a third of incidents had a cross-border dimension, which the ESAs attribute to shared infrastructures and services, while the direct impact on clients and transactions is described as generally limited.

The distribution shows what the regulation is actually about. DORA is not a "hacker law" but a law about dependence on other people's infrastructure: a vendor's outage is the entity's reportable incident, and the first year's data bears that out.

Overlaps: NIS2, MiCA, PSD2 and GDPR

For the financial sector DORA is lex specialis to NIS2. A licence holder lives under DORA and does not report twice. But non-financial group companies — a holdco, an IT subsidiary, a shared services entity — can fall under NIS2 in their own right through national transposition laws, and that is a separate project with separate deadlines.

The MiCA overlap is direct: a CASP has been inside DORA's perimeter from the same date, and the ICT section of a licence file is assessed against DORA rather than generic information-security language. For anyone entering under someone else's CASP licence, the principal will insist on DORA-compatible contractual undertakings, because it must enter the partner into its own register.

With PSD2 the duplication has been removed, by Directive 2022/2556 and the EBA's repeal of its guidelines on 17 January 2025. Ahead lies PSD3 and the PSR: re-authorisation of EMIs into the single PI regime will put the ICT block through supervision again, and applications filed in 2027–2028 will need full DORA documentation from the start.

With GDPR, by contrast, the duplication persists and must be designed for. A DORA incident notification goes to the financial supervisor; a personal data breach notification under GDPR Article 33 goes to the data protection authority within 72 hours. A single incident can trigger both, through different channels, on different clocks and with different content. A single response procedure has to split those two streams automatically.

The AI Act overlaps by subject rather than by procedure: since 2 August 2026 the same financial entity is the deployer of the AI systems built into its monitoring and scoring and carries a separate set of duties for them, while the vendor of such a model remains an ICT third-party provider in the DORA register.

Finally, the EBA guidelines. EBA/GL/2019/04 on ICT and security risk management was not repealed outright but narrowed from 11 February 2025: what survives covers only relationship management with payment service users, and only for entities inside DORA's perimeter. Everything else has been absorbed by the regulation. The outsourcing guidelines continue to apply to non-ICT arrangements, but ICT outsourcing is now read through Articles 28 to 30 of DORA.

The UK is building a mirror perimeter. The FCA and PRA rules on critical third parties (PS24/16) have applied since 1 January 2025; on 10 July 2026 HM Treasury designated the first four — AWS, Google Cloud, Microsoft and Oracle — and oversight by the Bank of England, PRA and FCA began on 13 July 2026. A group licensed in both the EU and the UK lives under two regimes at once, and contracts with shared vendors have to satisfy both.

DORA and its mirrors outside the EU

DORA is the most detailed of the operational-resilience regimes, but it is not the only one a cross-border group lives under. The UK, New York, Singapore, Hong Kong, Canada, Australia and Switzerland each built their own, on different clocks and with different ideas of who is inside. The grid below sets them against the EU on the axes that decide daily operations: who is covered, how fast the supervisor must hear about an incident, whether critical vendors are supervised directly, and what testing is required.

Three differences matter in practice. The first is the clock and its trigger. The one-hour MAS ceiling applies where the entity and incident fall within the relevant notice; it cannot be inferred from any MAS licence. DORA counts four hours from major classification, with its 24-hour detection backstop; APRA distinguishes its 72-hour incident notification from the 24-hour critical-operation breach. New York’s 72 hours and Canada’s “without delay” use their own triggers. These are notification limits, not permission to wait: escalation must assess each entity and obligation promptly. For FINMA, discovery by a provider of an outsourced function can start the clock; the bank-working-day rule and severe-attack exception must be built into the procedure.

The second is the perimeter. DORA reaches almost every EU licence, including EMIs and CASPs. The UK regime covers payment and e-money firms under FCA rules; New York covers only DFS licensees; Australia's CPS 230 directly addresses APRA-regulated entities, with group-wide application where the regulated entity heads a group; Canada's RPAA is built for payment service providers, while Singapore’s FSM-N13 has the narrower designated-system and DPT-service perimeter. UK PS26/2 is final, with commencement in March 2027; it is distinct from the already operating CTP regime. The third is direct oversight of vendors: only the EU and the UK have designated critical providers, and the lists overlap — a hyperscaler contract now has to satisfy two overseers at once. Under the MAS reporting circular, subsequent reports use the updated MAS-Tx template from 1 February 2026: an initial written report as soon as possible, within 24 hours of discovery, and a final report within 14 days. MAS may request the initial report earlier. These stages do not replace the notification deadline in the applicable instrument.

A worked example: at 02:00 on a Saturday, a group’s EU EMI, Singapore PSA licensee providing DPT services and New York money transmitter discover a ransomware attack on their shared processing vendor. Assume material disruption to customer service in Singapore and that the New York entity determines the incident is reportable at 02:00. MAS must hear as soon as possible and no later than 03:00. The EU entity classifies the incident as major at 05:00 and files its initial notification by 09:00, well inside the 24-hour backstop from detection. The New York entity has until 02:00 on Tuesday, but if the group pays a ransom, a separate notice is due within 24 hours of payment. If personal data were exposed, a GDPR notification goes to the data protection authority within 72 hours through a different channel. One incident produces separate notifications and follow-up reports on different clocks, including MAS’s initial written report and final report; the response procedure must distinguish these stages.

The calendar to 2028

The CTPP list is worth watching in its own right: it is revised annually, and a key vendor entering it redraws the entity's concentration map. By 17 January 2028 the Commission reviews the whole regime, and widening the perimeter looks likelier than narrowing it.