DORA Compliance: The Complete Guide for Financial Entities in the EU
DORA is now fully applicable across the EU financial sector. StartComply helps financial entities operationalise ICT risk management, incident reporting, third-party oversight and resilience testing with evidence regulators can actually review.
Trusted by 100+ organisations across Europe
DORA 
ICT Risk 
Incident Reporting 
TPRM What you need to know about DORA compliance
- DORA became fully applicable on 17 January 2025 and applies to financial entities across the EU, with no grace period.
- The regulation is structured around five pillars: ICT risk management, incident reporting, digital resilience testing, third-party risk management and information sharing.
- Management body accountability is mandatory under Article 5. Boards must actively oversee the ICT risk management framework.
- Major ICT incidents trigger a 24-hour early warning and a 72-hour intermediate report to the competent authority.
- ICT third-party registers must be complete and continuously maintained, covering every contractual arrangement for ICT services.
- Article 30 requires specific contract provisions with ICT providers, including audit rights, data location, termination rights and exit plans.
- TLPT is mandatory at least every three years for significant financial entities under Article 26.
Source: Digital Operational Resilience Act, Regulation EU 2022/2554. Last updated May 2026.
DORA is live.
Financial entities now need evidence, not intention.
A documented, evidenced operational resilience programme
- Articles 5-16: ICT risk management framework with management body accountability
- Articles 17-23: incident classification and strict regulatory reporting workflow
- Articles 24-27: digital operational resilience testing, including TLPT for significant entities
- Articles 28-44: complete ICT third-party register, contract controls and exit strategies
- Article 45: recognised cyber threat information and intelligence sharing arrangements
Penalty exposure: financial entities can face fines of up to €10 million or 2% of global annual turnover. Critical ICT third-party providers can face periodic penalties linked to worldwide turnover.
Partial inventories, static policies and manual evidence collection
- ICT assets scattered across spreadsheets, ticketing tools and procurement files
- No continuously maintained register of ICT third-party arrangements
- Legacy contracts missing audit rights, data location clauses and exit plans
- Incident response policies without a tested 24-hour reporting workflow
- Resilience tests performed inconsistently and not tied back to risk treatment
- Board approvals recorded as sign-off, not active oversight
The audit reality: regulators do not ask whether your DORA programme exists. They ask for files, dates, owners, classifications, decisions and follow-ups.
Everything Your DORA Programme Needs. Built Into One Platform.
ICT Risk Management Framework
StartComply helps you structure the ICT risk management framework required under DORA Articles 5 to 16, with clear ownership, control mapping and review cycles.
- ICT asset register and interdependency documentation
- Control ownership, approval status and review cadence
- Management body oversight evidence
- Risk treatment tracking across ICT systems and services
Incident Classification and Reporting
DORA incident timelines are tight. StartComply gives teams a structured workflow for identifying, classifying and escalating ICT-related incidents before reporting windows are missed.
- Major incident classification criteria mapped to DORA requirements
- 24-hour early warning and 72-hour intermediate report tracking
- Regulatory notification templates and approval routing
- Final report evidence stored with the incident record
Digital Operational Resilience Testing
StartComply connects testing activity back to your ICT risk framework, so vulnerability assessments, scenario tests, gap analyses and TLPT actions do not live in isolation.
- Annual testing programme tracking
- Findings, owners and corrective actions in one place
- TLPT readiness tracking for significant entities
- Evidence trail for test results and management review
ICT Third-Party Risk Management
DORA Chapter V requires financial entities to know every ICT third-party arrangement, classify criticality and maintain contract-level evidence. StartComply keeps the register current.
- Complete ICT third-party register aligned to Article 28
- Criticality classification and concentration risk tracking
- Article 30 contract gap checks
- Exit strategy and sub-outsourcing visibility
Threat Intelligence and Information Sharing
StartComply helps document how cyber threat intelligence is received, reviewed and used, including participation in trusted communities where applicable.
- Threat intelligence inputs linked to risk decisions
- Evidence of review, ownership and follow-up
- Information sharing readiness documentation
- Regulatory maturity signals captured for audit review
StartComply vs. The Alternatives
DORA compliance requires continuous, evidenced operational resilience. The tooling gap shows up when regulators ask for proof.
StartComply was built for European financial entities that need to make DORA operational quickly, without rebuilding compliance evidence from scratch before every supervisory request.
What Is DORA Compliance?
DORA compliance means meeting the obligations set out in the Digital Operational Resilience Act, Regulation EU 2022/2554. It requires financial entities to prove that they can prevent, withstand, respond to and recover from ICT-related disruption.
The regulation harmonises ICT risk management across the EU financial sector. It applies alongside sector-specific rules and creates a common operational resilience baseline for banks, insurers, investment firms, crypto-asset service providers, payment institutions and other regulated entities.
The goal is systemic resilience. If a cyberattack, cloud outage or ICT provider failure spreads across the financial system, regulators expect every entity in the chain to know its exposures, test its defences and recover quickly.
DORA is already applicable. The regulation became fully applicable on 17 January 2025. Compliance teams should now focus on evidence, continuous monitoring and operational workflows, not roadmap planning.
How StartComply Structures Your DORA Compliance Programme
Confirm who and what is covered Article 2
Identify the regulated entities, licences, business services, ICT systems, suppliers and geographies that sit inside your DORA compliance perimeter.
Build the ICT risk framework Articles 5-16
Document the ICT risk management framework, assign owners, classify ICT assets and connect controls to business services and resilience objectives.
Operationalise incident escalation Articles 17-23
Create a tested incident classification workflow with 24-hour early warning, 72-hour intermediate report and final report ownership clearly defined.
Run resilience testing with evidence Articles 24-27
Schedule annual testing, track findings, document corrective actions and prepare TLPT governance where significant-entity obligations apply.
Control ICT third-party risk Articles 28-44
Maintain a complete ICT third-party register, review Article 30 contract clauses, track sub-outsourcing and document exit strategies.
Client Testimonials
“We evaluated enterprise platforms costing 10x more. StartComply does what we need at a price that makes sense.”Elena Kowalski
“Finally, a compliance tool that understands European regulations. StartComply got us audit-ready in weeks, not months.”Maria Papadopoulou
“The AI policy engine alone saved us hundreds of hours. And the third-party risk management is exactly what DORA requires.”Thomas Müller
Frequently Asked Questions About DORA Compliance
What is DORA compliance and who does it apply to?
DORA compliance refers to meeting the obligations set out in EU Regulation 2022/2554, the Digital Operational Resilience Act. It applies to financial entities regulated in the EU, including banks, investment firms, insurance undertakings, crypto-asset service providers, payment institutions and other financial-sector categories. ICT third-party service providers serving these entities are also subject to specific obligations.
What are the main DORA requirements I need to comply with?
The five main pillars are ICT risk management, ICT incident reporting, digital operational resilience testing, ICT third-party risk management and information sharing. Each pillar creates operational obligations, from maintaining ICT asset registers and running resilience tests to submitting early warnings for major ICT incidents.
What are the fines for failing to comply with DORA?
Financial entities that fail to meet DORA requirements can face fines of up to €10 million or 2% of total annual worldwide turnover, whichever is higher. Critical ICT third-party service providers designated by the European Supervisory Authorities can face periodic penalty payments linked to worldwide turnover.
How is DORA different from NIS2?
NIS2 is a broad cybersecurity directive covering essential and important entities across many sectors. DORA is a sector-specific regulation for financial entities and goes deeper on ICT third-party risk, testing obligations and incident reporting timelines. For financial entities, DORA operates as the more specific framework where both regimes overlap.
How long does it take to become DORA compliant?
It depends on your starting point. Organisations with mature ICT risk management and third-party oversight can close many gaps in three to six months. Organisations starting from spreadsheets and informal processes should expect a longer programme, especially for the ICT third-party register and contract review workstream.
What does the DORA incident reporting timeline look like?
Once a financial entity classifies an ICT incident as major, a 24-hour early warning must be submitted to the competent authority. An intermediate report with more detail is due within 72 hours, followed by a final report within one month of the intermediate report.
Stop Managing DORA Compliance with Spreadsheets.
Who Does DORA Apply To?
DORA applies to financial entities as defined in Article 2. The scope is deliberately broad and includes banks, payment institutions, electronic money institutions, investment firms, crypto-asset service providers, insurance undertakings, trading venues, credit rating agencies, statutory auditors and other regulated financial-sector organisations.
The framework also brings ICT third-party service providers into scope, especially where they deliver critical technology services to multiple financial entities.
Microenterprises are partially exempt under Article 4, but the exemption is narrower than many small firms assume. If you hold a regulated licence and serve EU clients, DORA scope should be assessed carefully.
DORA Compliance Timeline: Where Things Stand Now
DORA entered into force as Regulation EU 2022/2554, setting the legal foundation for digital operational resilience in the EU financial sector.
The European Supervisory Authorities developed the regulatory technical standards that define how key DORA obligations must be implemented.
DORA became fully applicable. In-scope financial entities must now demonstrate compliance with ICT risk, incident, testing and third-party requirements.
Supervisory expectations are moving from implementation planning to evidence review, especially around incident reporting, ICT third-party registers and management body oversight.
There is no grace period. Organisations still relying on static policies and spreadsheets are carrying active regulatory risk.
Already in scope? Treat DORA as an operating model, not a documentation project. Regulators will expect evidence that controls, reviews, tests and incident workflows are active.
The 10 Components of a Complete DORA Compliance Programme
A working DORA programme is more than a policy library. It contains operational components with clear owners, defined cadence and evidence that proves the controls are active.
Scope assessment
Identify the legal entities, licences, services, systems and third-party arrangements covered by DORA.
Management body governance
Define approval, oversight, reporting and review responsibilities at board or management-body level.
ICT asset register
Maintain a classified inventory of hardware, software, data, services and interdependencies.
ICT risk framework
Document controls, risk appetite, treatment plans and monitoring cadence across ICT environments.
Incident reporting workflow
Prepare classification criteria, escalation paths, 24-hour early warning and 72-hour reporting procedures.
Resilience testing programme
Plan annual tests, record results, assign remediation and prepare TLPT where required.
ICT third-party register
Capture every ICT provider arrangement, criticality classification, concentration exposure and service dependency.
Contract review process
Check Article 30 clauses, including audit rights, data location, termination rights and exit strategies.
Business continuity and recovery
Define, test and document response, backup, recovery and communication procedures.
Evidence management
Keep files, approvals, decisions, reviews and corrective actions ready for supervisory review.
