DORA

Who are the companies affected by DORA? 

Companies affected by DORA include all financial sector entities within the EU, including:

• Credit institutions 
• Investment firms 
• Payment institutions 
• Account information service providers 
• Electronic money institutions 
• Insurance and reinsurance companies 
• Crypto-asset service providers 
• Trading venues 
• Institutions for occupational retirement provision 
• ICT third-party service providers 

What is the reporting implementation deadline? 

The DORA reporting implementation deadline is 17 January 2025. From this date, financial entities must comply with DORA’s reporting requirements. 

Key Reporting Deadlines: 

• 17 January 2025 – Financial entities must start reporting major ICT-related incidents and significant cyber threats to their home authority (Chapter III of Regulation (EU) 2022/2554). 
• 31 March 2025 – Registers of Information (RoI) DORA on ICT third-party service providers must be updated. 
• 4 April 2025 – First submission deadline for Registers of Information (RoI) DORA (varies by national authority) 
• 30 April 2025 – Competent national authorities must submit collected Registers of Information (RoI DORA) to the European Supervisory Authorities (ESAs). 

Financial entities should ensure they are fully prepared to meet these obligations, as no further transitional periods apply. 

What requirements are covered by DORA? 

DORA covers various requirements aimed at enhancing digital operational resilience within the EU financial sector, including oversight, monitoring, and risk management obligations for financial entities and CTPPs. These requirements encompass: 

• ICT Risk Management (Chapter II, Articles 5-16): Establishes requirements for ICT governance, risk assessment, and incident prevention. 
• ICT-Related Incident Management, Classification, and Reporting (Chapter III, Articles 17-23): Standardizes how financial institutions detect, classify, and report incidents. 
• Digital Operational Resilience Testing (Chapter IV, Articles 24-27): Mandates regular testing, including Threat-Led Penetration Testing (TLPT). 
• Management of ICT Third-Party Risk (Chapter V, Section I, Articles 28-30): Defines requirements for risk management related to ICT service providers. 
• Oversight of Critical ICT Third-Party Service Providers (CTPPs) (Chapter V, Section II, Articles 31-44): Establishes an EU-wide supervisory framework. 
• Information Sharing Arrangements (Chapter VI, Article 44): Encourages knowledge-sharing on cyber threats among financial entities. 
• Register of Information (RoI) DORA: Ensuring structured documentation and tracking of ICT incidents, resilience measures, and compliance steps for financial entities. 

Reporting templates 

Reporting templates are integral components of DORA compliance, facilitating the submission of necessary information to regulatory authorities. These templates streamline reporting processes and ensure consistency in data submission across entities subject to DORA. 

1. Reporting of Major ICT-Related Incidents and Cyber Threats – Entities must fulfill ICT incident reporting DORA obligations by submitting structured reports to regulatory authorities.  
2. Submission of Registers of Information (RoI) DORA on ICT Third-Party Providers – Financial institutions must maintain an updated Register of Information (RoI) DORA to ensure compliance with DORA reporting requirements.