DORA Regulation: ICT Security Requirements for Financial Services

DORA (Digital Operational Resilience Act, Regulation EU 2022/2554) is EU law that requires financial entities to maintain robust ICT risk management, incident reporting, and resilience testing programmes. It applies to 21 categories of financial entity across the EU — including banks, payment institutions, e-money institutions, investment firms, insurance companies, crypto-asset service providers, and crowdfunding platforms. It also applies to any ICT provider designated 'critical' by the European Supervisory Authorities. If your firm holds an EU financial licence or provides ICT services to EU financial entities, DORA applies to you. Microenterprises (under 10 staff and €2M turnover) benefit from simplified requirements, but are not fully exempt.

DORA penalties are tiered by severity. Systemic failures carry fines up to 2% of total annual worldwide turnover. Specific provision breaches are fined at up to 1% of average daily worldwide turnover for each day of non-compliance. Fixed fines for less severe violations reach €5,000,000. Crucially, senior managers face personal liability up to €1,000,000 per individual — so DORA compliance is a board-level matter, not just an IT issue. National regulators (BaFin, CBI, AMF, CNMV, and others) may set higher sanctions above the EU floor, and public naming of violators by the ESAs adds reputational risk on top of financial penalties.

DORA directly mandates three things that attack surface management automates: continuous ICT asset inventory (Article 8), automated vulnerability scanning at least weekly for critical systems (Article 10), and ongoing third-party ICT risk monitoring (Articles 28–44). An ASM tool like SeguriScan discovers all your internet-facing assets, maps them to CVE vulnerability data, scores them by severity, and produces the time-stamped scanning evidence that regulators will request during supervisory reviews. Asset inventory and third-party risk registers are the two most common DORA technical challenges — ASM tooling addresses both directly.

DORA entered full application on 17 January 2025 with no grace period. All 21 categories of in-scope financial entity became subject to full enforcement from that date. The first Register of Information submissions (documenting ICT vendor contracts) were due 4 April 2025. In November 2025, the ESAs published the first list of 19 Designated Critical Third-Party Providers. National regulators began formal DORA-specific supervisory audits and on-site inspections in 2026. If you have not yet built out your ICT asset inventory and vulnerability scanning programme, you are already operating in breach.

Yes, with limited exceptions. DORA applies to any financial entity authorised to operate in the EU, regardless of size. Microenterprises (fewer than 10 employees and annual turnover under €2M) qualify for a simplified ICT risk management framework, but still face core obligations including incident reporting and basic risk controls. If your fintech processes payments, issues e-money, provides crypto-asset services, or operates a crowdfunding platform under an EU licence, DORA applies in full. DORA also applies if you are headquartered outside the EU but hold an EU licence — a common structure for fintech companies operating in Ireland, Lithuania, or the Netherlands.

DORA's ICT risk management framework (Articles 5–16) requires financial entities to maintain a continuous, documented approach to identifying, assessing, and controlling ICT risks. The key obligations are: a board-approved ICT risk strategy reviewed annually (Art. 5); a complete, continuously updated inventory of all ICT assets (Art. 8); continuous monitoring and threat identification across ICT systems (Art. 9); automated vulnerability scanning at least weekly for critical-function assets (Art. 10); and business continuity plans with tested detection and response procedures (Art. 11). The framework is not a one-time audit exercise — DORA requires ongoing, evidenced monitoring that automated ASM tooling is purpose-built to deliver.