DORA, the European Union regulation on digital operational resilience

European Union law on how financial entities manage technology risk: governance, incident reporting, resilience testing, and the contracts and oversight covering the technology suppliers they depend on.

It applies to financial entities, which the regulation defines by listing them: credit institutions, payment and electronic money institutions, investment firms, crypto-asset service providers, fund managers, insurers and insurance intermediaries (some of which Article 2(3) excludes), trading venues, central securities depositories, credit rating agencies and others. It also reaches the technology suppliers those entities depend on, through the rules on what their contracts must contain and, for the largest suppliers, through direct oversight by the European supervisory authorities.

It is a regulation, so it applies directly in every member state with no transposing law in between. It entered into force on 16 January 2023 and has applied since 17 January 2025. There is no transition period still running.

Each member state still names the authorities that supervise its financial entities under the regulation, usually the supervisors they already answer to. Check the national law. In Cyprus, for example, the Cyprus Securities and Exchange Commission issued Circular C700 in April 2025 on what it expects of the firms it supervises.

Size reduces the obligations without removing them. A simplified risk-management framework is available to some smaller entities, and microenterprises are treated more lightly again. Size and supervised status do not take a firm out of scope. Only the Article 2(3) exclusions and any Article 2(4) national exclusion do.

The Digital Omnibus proposal (COM(2025) 837 of 19 November 2025) would also amend the regulation's incident reporting so that reports go through the single entry point proposed in a new Article 23a of the NIS 2 Directive. It is a proposal, not law, status as at 24 October 2026. The European Parliament's Legislative Observatory lists it as awaiting committee decision (procedure 2025/0360(COD)).

For an investment firm this is usually the regime that lands first and hardest, and it lands differently from the network and information security regime: the firm was already supervised, so this arrives as a new set of expectations inside an existing relationship, complete with a supervisor that already knows where to write.