DORA Explained: Key Digital Operational Resilience Considerations for Financial Entities

For most of the past two years, the Digital Operational Resilience Act or DORA was a project. Firms mapped their information and communication technology providers, rewrote contracts, drafted incident procedures and filed their first register of information. And now, that phase is over. 

Supervisors across the EU have moved from checking readiness to checking compliance, with the first formal fines expected in the second half of 2026. For brokers and investment firms, the question is no longer whether DORA applies, but rather whether the arrangements actually work. 

What Is DORA and Who Does It Apply To?

The Digital Operational Resilience Act (DORA) is an EU regulation that has applied since January 17, 2025, establishing digital operational resilience requirements for financial entities within its scope. By definition, it covers banks, insurers, payment institutions, crypto-asset providers and investment firms, including Cyprus Investment Firms regulated by the Cyprus Securities and Exchange Commission (CySEC). For much of this time, the aim was simple enough to state but harder to deliver. 

A firm must be able to withstand, respond to and recover from ICT disruptions without putting clients or markets at risk.

However, unlike a directive, DORA has more teeth applied directly. There is no national transposition to wait for and no local variation in the core obligations. FM Academy’s courses include DORA as part of the regulatory framework for investment firms. 

These are CPD accredited, taught by practitioners who have implemented the regulation inside regulated brokers, and focused on what a compliance officer actually has to produce. The governance framework, the incident classification process, the third-party register and the evidence a supervisor will ask for. For certified persons under CySEC, the CPD hours count. For the firm, the point is having someone who can run the framework rather than just file it.

In smaller regulated firms, DORA has landed largely on the compliance officer’s desk, alongside AML, MiFID conduct rules and everything else. Word soup aside, this is a technical regulation with a heavy documentation load, and it expects the board to understand it, not just approve it. 

Supervisors now expect executive leadership to show active involvement in resilience governance, incident oversight and risk decisions, which makes operational resilience a board-level issue rather than an IT one. 

The Five Pillars of DORA

DORA is usually described in five parts. First is ICT risk management, where a firm needs a documented framework covering identification, protection, detection, response and recovery, owned by the board and reviewed at least annually.

Next is ICT-related incident management and reporting. All major ICT-related incidents must be classified against set criteria and reported to the regulator within strict timelines, starting with an initial notification within hours of classification.

The third pillar is digital operational resilience testing. Every firm must test its ICT systems regularly and this is where resilience testing comes in. Larger or more systemically important entities face threat-led penetration testing on a three-year cycle. Resilience testing has moved to the center of supervisory attention in the first audit cycle. 

Following is ICT third-party risk management. Firms must assess, contract with and monitor their ICT providers, including cloud and trading platform vendors, and keep a register of information on every arrangement. The second annual register of information cycle concluded in March 2026, and Deloitte research found 46 percent of financial entities named the register as the single most challenging DORA requirement. 

Finally, the fifth pillar is information sharing, an increasingly important area of digital operational resilience. Firms may exchange cyber threat intelligence with each other under arrangements that protect confidentiality.

DORA Compliance in 2026: What Has Changed?

Well for starters, the supervisory tone has hardened. Early audits found gaps in resilience, testing and third-party risk, and supervision has shifted from reviewing design to testing whether resilience works in practice. 

The European Supervisory Authorities have designated the first 19 critical ICT third-party providers for direct oversight, which means the largest cloud and infrastructure vendors are now supervised directly, and firms are expected to know where they sit in that chain.

In January 2026, BaFin issued guidance confirming that AI systems must be embedded in existing ICT governance, testing and third-party frameworks rather than treated separately. 

Common findings are all too familiar. The register of information is incomplete or inconsistent with contracts. Incident classification is done after the fact rather than as events unfold. Testing is scheduled but not evidenced. Subcontractors behind the main provider are unknown. The board has signed the framework but cannot explain it.

None of these are technical failures. They are governance and documentation failures, which is why the compliance function is central to fixing them.

If you are responsible for DORA in your firm, or preparing for a compliance role where it will be part of the job, FM Academy’s programs cover the regulation, the practical workflow and the supervisory expectations as they stand now.

See all the current course list on the FM Academy website.