> ## Content Index
> Fetch the complete content index at: https://www.theglobalbanker.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# EU's Digital Operational Resilience Act Enters Application for European Financial Entities
- URL: https://www.theglobalbanker.com/eu-digital-operational-resilience-act-dora-enters-application-european-financial-entities/
- Published: 2025-01-17T12:22:00.000Z
- Updated: 2026-11-08T11:57:29.000Z
- Description: DORA became applicable across the EU on 17 January 2025, binding banks, insurers, investment firms and crypto-asset providers to new ICT risk and resilience standards.
- Author: TGB Editorial Team
- Tags: Regulations, Europe, #archive

The European Union's Digital Operational Resilience Act, known as DORA, entered application on 17 January 2025, marking the end of a two-year transitional period and the beginning of binding compliance obligations for financial entities across all EU member states. The regulation applies to banks, insurance undertakings, investment firms, and crypto-asset service providers, among others, imposing uniform requirements on how they manage information and communications technology risk.

Where previously ICT risk was addressed piecemeal through sectoral guidelines and national supervisory expectations, the new regulation creates a single, harmonised framework that supervisors across the EU are expected to apply consistently, with requirements scaled to each entity's size and risk profile under the regulation's proportionality principle.

#### SCOPE AND OBLIGATIONS

Under DORA, in-scope entities must meet detailed requirements across five principal areas: ICT risk management, incident classification and reporting, digital operational resilience testing, management of third-party ICT providers, and information-sharing arrangements. The incident reporting provisions introduce mandatory timelines for notifying competent authorities of major ICT incidents.

Financial institutions that rely on cloud computing platforms, software vendors, or data analytics providers classified as critical under DORA will see those providers placed under direct EU-level oversight by the European Supervisory Authorities, and must include specific mandatory contractual provisions in their agreements with ICT providers. 

Crypto-asset service providers were brought within scope explicitly. Firms holding authorisation under the EU's Markets in Crypto-Assets regulation, which became fully applicable on 30 December 2024, will therefore face DORA obligations alongside MiCA requirements. 

#### ECB SUPERVISORY INTEGRATION UNDER WAY

The European Central Bank's Single Supervisory Mechanism has begun integrating DORA requirements into its supervisory programme for the significant institutions it directly oversees. This means that ECB supervisory teams will assess institutions' DORA compliance as part of the regular Supervisory Review and Evaluation Process, and can take supervisory action where gaps are identified. National competent authorities bear similar responsibilities for less significant institutions.

The European Supervisory Authorities — the EBA, EIOPA, and ESMA — published extensive technical standards and guidelines during 2024 to clarify implementation expectations, and supervisors began applying the new framework from 17 January 2025\.