DORA Regulation Explained: The Digital Operational Resilience Act and UK Firms

The DORA regulation, the EU’s Digital Operational Resilience Act (Regulation (EU) 2022/2554), requires banks, payment and e-money institutions, investment firms, insurers, crypto-asset service providers and other EU financial entities to withstand, respond to and recover from ICT disruption. It entered into force on 16 January 2023 and has applied since 17 January 2025.

DORA does not apply to a firm simply because it serves EU customers from the UK. It reaches UK businesses in three ways: through EU-authorised entities in a UK group, through the contracts EU financial entities must now sign with their ICT suppliers, and through direct EU oversight of ICT providers designated as critical.

What is the DORA regulation?

DORA, sometimes called the DORA Act, is an EU regulation, so it applies directly in every member state without national transposition. It replaced a patchwork of sector guidance with one set of ICT rules for the financial sector, and it is supplemented by regulatory and implementing technical standards on topics such as incident reporting, the register of information and threat-led testing. A companion directive, (EU) 2022/2556, amended existing financial services directives to fit.

Accountability sits at the top. Under Article 5, the management body defines, approves and oversees the ICT risk management framework and is ultimately responsible for it.

When did DORA come into force and when did it apply?

Who does DORA apply to?

Article 2 lists 20 types of financial entity, plus ICT third-party service providers for the oversight rules.

The rules are proportionate to size and risk (Article 4). Small and non-interconnected investment firms, exempted payment and e-money institutions and some other smaller entities may use the simplified ICT risk management framework in Article 16.

DORA regulation in the UK: does it apply to UK companies?

DORA applies to UK companies only through one of the routes below. A firm authorised solely in the UK follows the UK’s own rules instead, so for most firms DORA compliance in the UK is a question of group structure and client contracts rather than UK law.

If you serve EU clients through a branch or another cross-border arrangement, take legal advice on your position, because the answer depends on how that activity is authorised.

What are the five pillars of DORA?

What are the DORA requirements for ICT risk management?

Every in-scope entity needs an ICT risk management framework that identifies its critical or important functions and the ICT assets supporting them, protects those assets, detects anomalies, and responds and recovers within defined objectives. It must include an ICT business continuity policy, backup and restoration procedures, and security awareness training for staff and the management body.

An ISO 27001 information security management system covers much of this ground, and ISO 22301 business continuity management supports the response and recovery articles. Neither is mandatory, and neither proves DORA compliance on its own, but both give you documented, audited evidence to map against the articles.

How does DORA incident reporting work?

Entities classify ICT-related incidents using criteria set in technical standards, such as clients affected, duration, data losses and the criticality of services. Major incidents must be reported to the competent authority on a fixed clock, set by Commission Delegated Regulation (EU) 2025/301:

Where a major incident affects clients’ financial interests, the entity must tell them without undue delay. Entities may also notify significant cyber threats voluntarily.

What does DORA require for penetration testing?

DORA requires a risk-based digital operational resilience testing programme, and penetration testing is one of the test types it names. Under Article 24, appropriate tests of all ICT systems and applications supporting critical or important functions must run at least once a year, by independent internal or external testers, with findings prioritised and fixed. This is what most people mean by a “DORA pentest”.

Article 25 also lists open source analyses, gap analyses, physical security reviews, questionnaires and scanning software solutions, compatibility, performance and end-to-end testing.

Separately, Article 26 requires entities identified by their competent authority to run threat-led penetration testing (TLPT) at least every three years on live production systems. TLPT follows its own technical standards and tester requirements, and our DORA TLPT guide explains how it works and how it compares with the UK’s CBEST and STAR-FS. For setting the frequency of ordinary tests, see how often you should run a penetration test.

How does DORA handle ICT third-party risk?

The financial entity stays fully responsible for outsourced ICT. Article 28 requires a third-party risk strategy, due diligence before contracting, exit strategies for services supporting critical or important functions, and a register of information covering every ICT contract. Article 29 adds an assessment of concentration risk.

Article 30 sets minimum contract terms. All ICT contracts need a clear service description, the locations where services are provided and data is processed, data protection, access to and return of data, service level descriptions, help with ICT incidents at no extra cost or a cost agreed in advance, cooperation with competent authorities, termination rights, and the supplier’s participation in the entity’s ICT security awareness and resilience training. Contracts supporting critical or important functions also need precise service levels, business contingency plans, participation in the entity’s TLPT, unrestricted rights of access, inspection and audit, and exit plans with a transition period.

For UK suppliers, this arrives as contract riders and security questionnaires. Payment and e-money firms are often on both sides, as our fintech security guide explains.

What are the penalties for breaching DORA?

Member states set administrative penalties and remedial measures for financial entities (Article 50), so amounts vary by country. For CTPPs, the Lead Overseer can impose periodic penalty payments of up to 1% of average daily worldwide turnover in the preceding business year, charged daily for up to six months.

Which UK rules apply instead of DORA?

The UK has not adopted DORA. UK firms in scope of the operational resilience rules, such as banks, building societies and insurers, follow PRA SS1/21 and FCA PS21/3 as applicable, which required them to identify important business services, set impact tolerances and be able to stay within them by 31 March 2025. The Financial Services and Markets Act 2023 also created a Critical Third Parties regime, under which HM Treasury can designate critical suppliers for oversight by the Bank of England, PRA and FCA. Our operational resilience guide covers these rules, and our banking security guide covers issuers and acquirers.

What should a DORA compliance checklist include?

Use these ten steps as a starting checklist, then add the detail from the technical standards that apply to your entity type.

1. Confirm which group entities are in scope under Article 2, and whether the simplified framework applies.
2. Have the management body approve the ICT risk management framework and complete ICT risk training.
3. Identify critical or important functions and map the ICT assets and suppliers behind them.
4. Put ICT business continuity, backup and recovery plans in place, and test them; our free business continuity plan template is a starting point.
5. Set incident classification and reporting procedures, and rehearse the 4-hour clock.
6. Build and maintain the register of information for all ICT third-party arrangements.
7. Update supplier contracts to meet Article 30, with exit strategies for critical functions.
8. Run an annual, risk-based testing programme with independent testers, and track remediation.
9. Check whether your competent authority has identified you for TLPT.
10. Review the framework at least yearly and after major incidents.

DORA compliance for banks and payment firms

EU credit institutions, payment institutions and e-money institutions are all financial entities under Article 2, so DORA compliance for banks and payment firms covers every pillar above. The testing pillar is where most of the practical work lands, because the systems behind payments, cards and online banking almost always support critical or important functions.

Preparing for TLPT, if your competent authority identifies you, mostly comes down to knowing your critical or important functions and the live systems behind them, and having closed the findings from your general testing programme first. The TLPT itself follows the scheme’s own process.

Payment firms often have overlapping testing duties: PCI DSS Requirement 11.4 also calls for internal and external penetration tests at least every 12 months and after significant change, so the two programmes can usually be planned together where the scopes align. Our guides to cyber security for banks and financial services cover the wider standards these firms face, including the annual SWIFT CSP attestation for Swift users.

How can Sovereign Secure help?

Sovereign Secure Ltd has been a UK company since 2012 (Companies House 08334453), headquartered in Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka. We are ISO 27001 certified, a PCI SSC-approved QSA, QPA and CPSA company, a member of the PCI SSC Global Executive Assessor Roundtable for 2026 to 2028, and an IASME-licensed Cyber Essentials certification body.

For DORA, we support the testing pillar with web, API, network, cloud and mobile penetration testing, red team assessments, source code review and vulnerability scanning, and we provide ISO 27001 and ISO 22301 consultancy. We do not give legal advice on whether DORA applies to you.

To scope tests of the systems behind your critical or important functions, request a penetration testing quote or call +44 161 523 5276.