Framework

DORA

Digital Operational Resilience Act

What it is: The EU regulation on ICT risk and digital operational resilience in financial services, applying since 17 January 2025.
Applies to: EU financial entities (banks, insurers, investment firms, payment institutions and more) and critical ICT third-party providers
Current version: Regulation (EU) 2022/2554, plus its technical standards (RTS/ITS) and ESA guidelines
Set by: National competent authorities, with the EBA, EIOPA and ESMA overseeing critical ICT providers