DORA Compliance for the Financial Sector

DORA stands for Digital Operational Resilience Act (EU Regulation 2022/2554) and regulates the digital operational resilience of the financial sector. The regulation has been in force since January 17, 2025, and requires financial entities to systematically manage their ICT risks, report ICT incidents, conduct resilience testing, and control third-party risk.

DORA applies to 21 categories of financial entities: credit institutions, insurance companies, reinsurance companies, pension funds, payment institutions, electronic money institutions, investment firms, management companies, crypto-asset service providers, credit rating agencies, central counterparties, and more. Additionally, DORA indirectly affects critical ICT third-party service providers through the supply chain.

DORA has been directly applicable since January 17, 2025. The regulation was published in the EU Official Journal on December 14, 2022, and entered into force on January 16, 2023, with a two-year implementation period until January 17, 2025. For the replacement of BAIT/VAIT/KAIT/ZAIT, a transition period applies until January 1, 2027.

Article 16 DORA provides a simplified ICT risk management framework for microenterprises in the financial sector (fewer than 10 employees, annual turnover below EUR 2 million). This reduces requirements for governance, documentation, and testing while maintaining basic obligations for risk identification and incident management.

The information register under Article 28(3) DORA is a complete directory of all contractual arrangements with ICT third-party service providers. It must contain details about the provider, contract duration, type of service, criticality, and subcontractor chains, and must be reported annually to the competent supervisory authority.

DORA provides a three-stage reporting procedure: initial notification within 4 hours of classifying the incident, intermediate report within 72 hours with updated assessment, and final report within 30 days with root cause analysis and measures taken. Reports are submitted to the competent supervisory authority (e.g., BaFin).

TLPT is threat-led penetration testing under the TIBER-EU framework, mandated by Article 26 DORA. It simulates realistic attack scenarios against the critical functions of a financial entity. TLPT is mandatory every 3 years for systemically important institutions and must be conducted by qualified external providers.

The existing German IT supervisory requirements (BAIT, VAIT, KAIT, ZAIT) are being gradually replaced by DORA. The transition period runs until January 1, 2027. Until then, both frameworks apply in parallel. DORA goes significantly beyond the previous requirements in areas such as third-party risk, information register, and resilience testing.

Costs depend heavily on company size and existing maturity level. For microenterprises with the simplified framework, costs range from EUR 20,000 to 50,000. Medium-sized financial entities should budget EUR 50,000 to 200,000. Large banks and insurance groups typically invest EUR 500,000 to several million. With a GRC tool like Kopexa, effort can be reduced by 40 to 60 percent.

Kopexa offers a preloaded DORA framework with all 5 pillars, a measures catalog with best-practice measures, templates for policies and processes, an integrated ICT third-party register for the DORA information register, cross-mapping to ISO 27001 and BAIT/VAIT, and centralized evidence collection for audit readiness. The gap analysis immediately shows where action is needed.