European Union. Cybersecurity. Regulation (EU)
DORARegulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA)
In force
Partly verified
Medium confidence.The incident reporting timelines come from the RTS/ITS and I did not re-verify them this session.
§1Summary
- Synopsis
Harmonises ICT risk management, incident reporting, resilience testing and ICT third-party risk management for EU financial entities. It also creates a direct oversight regime for critical ICT third-party service providers.
- Key themes
- Unique features
Lead overseers can directly supervise critical ICT providers. Art 30 specifies mandatory contract terms for ICT services.
- SaaS relevance
A SaaS provider serving EU financial entities must accept DORA contract clauses, audit rights, exit plans and incident cooperation, and may be designated as critical.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Financial entities: initial report within 4h of classification / 24h of awareness; intermediate 72h; final 1 month
- DPO
- No
- Cross-border transfers
- Critical providers must have EU subsidiary
- Maximum penalty
- Set by national law for financial entities; periodic penalties up to 1% daily worldwide turnover for critical ICT providers
§3Dates
- Key dates
- Adopted
- In force
- Applies from 2025-01-17; first critical ICT third-party providers designated in 2025
§4Text and authority
- Text
- Authoritative text eur-lex.europa.eu
- Authority
- National financial supervisors; ESAs (EBA, EIOPA, ESMA) as lead overseers of critical ICT third-party providers
§5Where it applies
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.The incident reporting timelines come from the RTS/ITS and I did not re-verify them this session.