Is our organisation a financial entity under DORA, and which duties follow?

Start

We need to know whether DORA binds us and what follows

DORA is one regulation with five pillars, and every financial entity meets all five at a depth that depends on what it is. So the order matters. First decide what you are, then which duties that makes yours, and only then how ready you are. Being in finance does not settle the first question, and being small does not settle it either.

• Then: Gather the legal facts and name an owner

Step

Gather the legal facts and name an owner

Collect your authorisation or licence, any exemption letter, the latest approved accounts, your headcount and any letter from your competent authority. The DORA programme lead owns the assessment, with legal. Record each answer with its source and your reasoning, because counsel confirms the result and the management body approves it.

• Then: Is our authorised activity one of the 20 kinds in Article 2(1)?

Decision

Is our authorised activity one of the 20 kinds in Article 2(1)?

Article 2(1), points (a) to (t), lists credit institutions, payment institutions, electronic money institutions, investment firms, insurers, pension institutions, trading venues and others. Read the list against your licence, not against how you describe your business. Judgement: if you cannot tell, do not conclude that you are outside DORA. Treat it as applying until counsel or your competent authority says otherwise.

• Yes: Does an Article 2(3) exclusion apply to us?
• No: Do we supply ICT services to a financial entity?
• Not known: treat as in scope for now: Get the question confirmed by counsel or your authority

Outcome

Get the question confirmed by counsel or your authority

Judgement: until the question is settled, work as if DORA binds you, because a wrong assumption that it does not is the more costly error. Take the licence, or the Member State's decision, to counsel or your competent authority, then restart this question. Where your authority gives a different view from this reading, its view stands.

Decision

Do we supply ICT services to a financial entity?

A supplier is not a financial entity. DORA lists ICT third-party service providers in Article 2(1), point (u), apart from points (a) to (t), and puts the duties of the contract on the financial entity. Answer from your customer list. Judgement: if you cannot tell whether a customer is a financial entity, take the Yes branch.

• Yes, or not known: Have the ESAs designated us as a critical ICT provider?
• No: DORA does not reach us directly: confirm and review

Decision

Have the ESAs designated us as a critical ICT provider?

The European Supervisory Authorities designate critical providers under Article 31(1) and appoint a Lead Overseer for each. The criteria are in Delegated Regulation (EU) 2024/1502. Check the ESAs' list of designated providers instead of judging the criteria yourself. Until you have looked, take the Yes branch.

• Yes, or not known: Meet the flow-down list and prepare for possible oversight
• No, I have checked the list: Check our contracts against the supplier flow-down list

Outcome

DORA does not reach us directly: confirm and review

You are not a financial entity and no financial entity is your customer, so the Regulation's duties do not reach you directly or through a contract (regime: not covered, as in TC-21). Record the reasoning with counsel's confirmation. Other law, such as NIS2, may still apply. Review the answer when you win a financial-entity customer.

Outcome

Check our contracts against the supplier flow-down list

You do not run the readiness assessment (DR-22). DORA reaches you through the terms your customers must ask for, FD-01 to FD-09, and the information they must collect. Check each contract against that list, and keep ready the details your customers need for their register, such as a valid LEI or EUID.

Outcome

Meet the flow-down list and prepare for possible oversight

The flow-down terms FD-01 to FD-09 apply to you. FD-10 applies if the ESAs designate you: oversight by a Lead Overseer, a yearly list, and, for a provider established in a third country, a subsidiary in the Union within 12 months of designation. Ask counsel what oversight asks of you. If the list shows you are not designated, FD-10 does not apply and the other terms still do.

Decision

Does an Article 2(3) exclusion apply to us?

Article 2(3) excludes certain entities: managers of alternative investment funds under Article 3(2) of Directive 2011/61/EU, insurers under Article 4 of Directive 2009/138/EC, pension institutions with no more than 15 members in total, persons exempted under Articles 2 and 3 of Directive 2014/65/EU, insurance intermediaries that are microenterprises or SMEs, and post office giro institutions. Each covers only the kinds the text names, except the Directive 2014/65/EU exemption, which can apply to any kind. Never choose one to lighten the work (DR-03).

• Yes: Out of scope: record the exclusion and who confirmed it
• No, or not known: Are we one of the Article 16(1) entities?

Outcome

Out of scope: record the exclusion and who confirmed it

DORA does not bind an excluded entity (regime: out of scope, as in TC-12 and TC-15). Write down the exclusion, the fact it rests on and counsel's confirmation, and have the management body approve it. Review it at least every 12 months, the pack's default, and when a licence, a figure or the Member State's decision changes.

Decision

Are we one of the Article 16(1) entities?

Five groups follow a simplified framework instead of Articles 5 to 15: small and non-interconnected investment firms, exempted payment institutions, exempted electronic money institutions, certain institutions exempted under Directive 2013/36/EU, and small pension institutions with fewer than 100 members. Each has conditions, so pick a group only if you meet them. Judgement: if unsure, take No and follow the full framework (DR-03 bars choosing a group to lighten the work).

• Yes, an institution exempted under Directive 2013/36/EU: Has our Member State excluded such institutions (Article 2(4))?
• Yes, another kind: Simplified framework: Article 16, plus the other pillars
• No, or not known: Are we a microenterprise?

Decision

Has our Member State excluded such institutions (Article 2(4))?

Article 2(4) lets a Member State exclude certain institutions exempted under Directive 2013/36/EU that are located there. If it did, DORA does not bind them. If it did not, they follow the simplified framework. Read the Member State's decision and ask your authority, whose view stands where it differs.

• Yes: Out of scope: record the exclusion and who confirmed it
• No: Simplified framework: Article 16, plus the other pillars
• Not known: Get the question confirmed by counsel or your authority

Outcome

Simplified framework: Article 16, plus the other pillars

Articles 5 to 15 do not apply. You document and keep the simplified framework of Article 16 and Title III of Delegated Regulation (EU) 2024/1774, and the rules on incidents, third-party arrangements and information sharing still apply. TLPT is not required. The test cases give 24 to 26 of 52 requirements (TC-07, TC-08, TC-09, TC-14, TC-16), and microenterprise status moves the count, which the simplified-framework question explains. Counsel confirms, the management body approves, and you review at least every 12 months (the pack's default).

Decision

Are we a microenterprise?

A microenterprise has fewer than 10 staff and an annual turnover or balance sheet total of at most EUR 2 million. A central securities depository, central counterparty, trading venue or trade repository is never one. A missing figure counts against being one, so complete the record first and take No until you have.

• Yes: Full framework, with the microenterprise relief
• No, or a figure is missing: Has a TLPT authority told us in writing that it identifies us?

Decision

Has a TLPT authority told us in writing that it identifies us?

Threat-led penetration testing is required only of entities a TLPT authority identifies, at least every 3 years unless it changes the frequency. Delegated Regulation 2025/1190 names kinds the authorities assess, such as systemically important credit institutions and central securities depositories, but a named kind is not an identification. Check your register of letters from the authority. Plan nothing until a letter arrives (DR-16).

• Yes: Full framework, plus threat-led penetration testing
• No, or not known: Full framework: all five pillars at the depth your kind sets

Outcome

Full framework: all five pillars at the depth your kind sets

You owe ICT risk management under Articles 5 to 15, incident management and reporting, resilience testing, third-party risk and, as an option, information sharing. The count depends on your kind: TC-03 gives 41 of 52 requirements for a large bank not identified for TLPT, and TC-05 gives 40 for an investment firm that is not a microenterprise. Counsel confirms and the management body approves the assessment.

Outcome

Full framework, with the microenterprise relief

The full framework applies, lighter where the text says. A control function, three lines and ICT audit (RQ-08), legacy-system assessments (RQ-13), a crisis management function (RQ-18), the strategy and monitoring role for third parties (RQ-44, RQ-45) and the testing programme (RQ-32, RQ-33) fall away. A risk-based testing plan applies (RQ-35), and TLPT does not. TC-04 gives 34 of 52.

Outcome

Full framework, plus threat-led penetration testing

The whole full framework applies, and so do RQ-37, RQ-38 and RQ-39: TLPT at least every 3 years unless the authority changes the frequency, closure and attestation, and qualified testers under Article 27. TC-02 gives 44 of 52 for a large bank that is identified. Plan TLPT from the identification letter and the validated scope (DR-16).