DORA, the European Union regulation on digital operational resilience

It applies to financial entities, which the regulation defines by listing them: credit institutions, payment and electronic money institutions, investment firms, crypto-asset service providers, fund managers, insurers and insurance intermediaries, trading venues, central securities depositories, credit rating agencies and others. It also reaches the technology suppliers those entities depend on, through the rules on what their contracts must contain and, for the largest suppliers, through direct oversight by the European supervisory authorities.

It is a regulation, so it applies directly in every member state with no transposing law in between. It entered into force on 16 January 2023 and has applied since 17 January 2025. There is no transition period still running.

Each member state still names the authorities that supervise its financial entities under the regulation, usually the supervisors they already answer to. In Cyprus, for example, the Ministry of Finance named them in August 2025, by Regulatory Administrative Act 252/2025. The Cyprus Securities and Exchange Commission supervises Cyprus investment firms, fund managers, crypto-asset service providers, trading venues and central securities depositories; the Central Bank of Cyprus supervises credit institutions and payment institutions; insurance and occupational pension supervision was assigned to their own regulators. The Securities and Exchange Commission set out what it expects of the firms it supervises in Circular C700, issued in April 2025, covering reporting obligations including the register of information on technology suppliers.

Size reduces the obligations without removing them. A simplified risk-management framework is available to some smaller entities, and microenterprises are treated more lightly again, but nothing here takes a supervised firm out of scope.

For an investment firm this is usually the regime that lands first and hardest, and it lands differently from the network and information security regime: the firm was already supervised, so this arrives as a new set of expectations inside an existing relationship, complete with a supervisor that already knows where to write.