Who is required to comply with DORA? Scope and target groups

A new standard for the financial ecosystem

Since the mandatory application date of January 17, 2025 the EU Digital Operational Resilience Act (Regulation (EU) 2022/2554 – DORA) has closed a critical regulatory gap. While existing frameworks such as MaRisk, BAIT, or VAIT primarily operated at a national level, DORA establishes a uniform, legally binding standard for the entire European Union.

Many market participants mistakenly assume that DORA only affects large, traditional banks. In reality, the DORA scope covers more than 20 different types of financial entities as well as their entire digital supply chain.

For board members, compliance officers, and IT leaders, the primary question is: Does our company fall directly or indirectly under the DORA mandate?

The scope under Article 2 DORA: Who is affected?

Article 2(1) of DORA precisely defines the areas of application. The regulation fundamentally distinguishes between financial entities and third-party ICT service providers.

1. Traditional financial institutions & credit institutions

• Credit institutions as defined by Regulation (EU) No 575/2013 (CRR).
• Payment institutions and E-money institutions (pursuant to PSD2/PSD3).
• Investment firms and trading venues.

2. Modern financial service providers & FinTechs

• Crypto-asset service providers (CASPs), which fall under the MiCA Regulation (Regulation (EU) 2023/1114).
• Crowdfunding service providers, which are authorized in accordance with Regulation (EU) 2020/1503.
• Credit servicers and credit purchasers.

3. Insurance and investment sector

• Insurance and reinsurance undertakings.
• Alternative Investment Fund Managers (AIFMs) and UCITS management companies.
• Institutions for Occupational Retirement Provision (IORPs).

4. ICT third-party service providers (Information and Communication Technology)

A new feature of the DORA regulation is the direct inclusion of IT service providers. If a company provides cloud infrastructure, software solutions, data analytics, or data center capacity to financial institutions, it is subject to indirect or – as a critical ICT third-party service provider – even direct oversight by the European Supervisory Authorities (EBA, ESMA, EIOPA).

Overview of affected entities and DORA requirements

The following table shows how the DORA target group is categorized and which requirements apply to the respective segments:

What is a critical financial entity and a critical ICT service provider?

Regarding the intensity of supervision, DORA distinguishes between standard entities and systemically important or critical entities:

Critical financial entities

Financial institutions are considered critical or systemically important if their failure or a severe IT disruption could jeopardize the stability of the entire financial system (e.g., DAX-listed banks, central counterparties, or large central securities depositories). These institutions are subject to the strictest DORA requirements, including mandatory, multi-year Threat-Led Penetration Tests (TLPT) based on the TIBER-EU framework.

Critical ICT Third-Party Providers (CTPPs)

In accordance with Article 31 of DORA, the European Supervisory Authorities (ESAs) designate those ICT service providers that are critical to the functioning of the financial sector. The criteria for this are:

• The systemic impact on financial stability in the event of a major service provider failure.
• The substitutability of the service provider (Are there viable alternatives on the market?).
• The number of financial entities served.

Critical ICT service providers are subject to a direct oversight framework and must report regularly to the ESAs.

Are there any exemptions from DORA requirements?

Although the DORA scope is very broad, Article 2(2) of DORA provides for specific exemptions:

1. Exempted insurance intermediaries: Insurance brokers or intermediaries that qualify as micro, small, or medium-sized enterprises (SMEs) are explicitly excluded from the scope.
2. Captive reinsurance undertakings: Companies that exclusively insure the risks of their own parent group.
3. Minor exemptions in the securities sector: Certain natural or legal persons providing investment advice, provided they do not hold client funds.

The principle of proportionality for micro-enterprises

Micro-enterprises in the financial sector (fewer than 10 employees and an annual turnover or annual balance sheet total of less than 2 million euros) are not fully exempt, but benefit from a simplified ICT risk management framework (Article 16 DORA). They are required to maintain fewer bureaucratic processes, but must still demonstrate fundamental security and contingency concepts.

Are you looking for more information on the associated costs? Read our article on DORA compliance costs and budget structures.

Practical examples from the financial sector

Example A: The cloud-native FinTech scaler

A Berlin-based FinTech offers a payment app and uses AWS for hosting, as well as an external provider for Know-Your-Customer (KYC) processes.

• Scope: The FinTech, as an e-money institution, is directly obligatedto implement DORA.
• Consequence: It must establish a comprehensive ICT risk management system, report incidents to the BaFin report and adapt contracts with AWS and the KYC provider to be DORA-compliant.

Example B: The B2B SaaS provider for risk management

A software start-up develops specialized analysis software for banks.

• Impact: The start-up is not a financial institution, but as an ICT third-party service provider, it falls indirectly under DORA.
• Consequence: Bank clients require DORA compliance documentation, security audits, and contractual guarantees in accordance with Article 30 of DORA as part of their due diligence. Without DORA readiness, the SaaS company risks losing its banking clients.

Checklist: Does your company fall under DORA?

Use this quick check for guidance:

• Are you a credit institution, investment firm, or payment institution authorized under EU law?
• Do you manage crypto-assets or offer crypto-services (CASP)?
• Do you provide IT, software, cloud, or data processing services to companies in the financial sector?
• Do you have more than 10 employees or generate more than 2 million euros in annual revenue in the financial sector?

If you answered at least one of these questions with Yes , your company is highly likely subject to DORA obligations or indirect supply chain requirements.

Conclusion: Create certainty and ensure compliance

The DORA obligation affects the entire value chain of modern financial services. Whether you operate as a traditional institution, an emerging FinTech, or a specialized IT service provider, determining your level of exposure is the first and most important step toward compliance.

DORA requires proactive action. By analyzing your exposure early, you protect your company from regulatory sanctions and secure your market position.