{"head":{"title":"What Is DORA for Fintech? EU Operational Resilience Rules","description":"DORA is the EU regulation on digital operational resilience for financial firms, in force from 17 January 2025. What it asks and what it means for vendors.","canonical":"https://oceanlab.in/questions/what-is-dora-for-fintech"},"crumbs":[{"name":"Home","path":"/"},{"name":"Questions","path":"/questions"},{"name":"What is DORA for fintech?","path":"/questions/what-is-dora-for-fintech"}],"question":"What is DORA for fintech?","answer":["DORA, the Digital Operational Resilience Act, is Regulation (EU) 2022/2554, and it has applied since 17 January 2025. It requires EU financial entities, including payment and e-money institutions, investment firms and crypto-asset service providers, to manage ICT risk, report major ICT incidents, test their resilience and control the risk from their technology suppliers."],"sections":[{"heading":"The five areas","body":[],"bullets":[["ICT risk management: a governed framework for identifying, protecting, detecting, responding to and recovering from ICT risks."],["Incident management and reporting: classify ICT incidents and report major ones to the competent authority."],["Resilience testing: a testing programme, and for some larger firms threat-led penetration testing at least every 3 years."],["ICT third-party risk: a register of all contracts for ICT services, required contract terms and exit strategies."],["Information sharing on cyber threats between financial entities."]]},{"heading":"What it means if you build software for a financial firm","body":[["A software or cloud supplier to an EU financial entity becomes an ICT third-party service provider. Article 30 lists what the contract must include, such as a full description of the services, where data is processed and stored, data protection, access and return of data, service levels, incident help, cooperation with authorities, and termination rights."],["Expect your clients to ask for these terms, for audit and access rights, and for help with their testing and exit plans. Separately, the European Supervisory Authorities designate a small number of critical ICT providers for direct EU oversight."]],"bullets":[]},{"heading":"What it means for the product","body":[["Build for evidence and recovery: ",{"href":"/glossary/maker-checker","text":"maker-checker"}," controls on risky actions, audit logs, monitoring and alerting, tested backups with clear recovery targets, incident runbooks, and a clean way to export data if the client leaves."]],"bullets":[]}],"faqs":[{"question":"Does DORA apply to fintechs outside the EU?","answer":"DORA applies to financial entities authorised in the EU. A non-EU fintech can be affected as a supplier to EU firms, or if it sets up an EU-licensed entity."},{"question":"Is DORA the same as NIS2?","answer":"No. NIS2 is a wider EU cybersecurity directive. For financial entities, DORA is the specific law for digital operational resilience."},{"question":"Do small payment firms have lighter duties?","answer":"Some. DORA has a simplified ICT risk management framework for certain smaller entities. Check Article 16 and your national authority's guidance."}],"terms":[{"href":"/glossary/maker-checker","label":"maker-checker"},{"href":"/glossary/soc-2-type-ii","label":"SOC 2 Type II"},{"href":"/glossary/total-cost-of-ownership","label":"total cost of ownership"}],"tools":[],"links":[{"href":"/compliance/dora","label":"DORA guide","detail":"EU digital operational resilience rules for financial firms."},{"href":"/software/banking","label":"Software for banking","detail":"Banking systems, controls and regulation."},{"href":"/glossary/rto","label":"RTO (recovery time objective)","detail":"Glossary"}],"related":[{"href":"/questions/what-is-a-reasonable-sla","label":"What is a reasonable SLA?","detail":"Question"},{"href":"/questions/how-much-does-a-fintech-app-cost","label":"How much does a fintech app cost?","detail":"Question"},{"href":"/questions/kyc-vs-kyb","label":"What is the difference between KYC and KYB?","detail":"Question"},{"href":"/compare/ai-agent-vs-workflow-automation","label":"AI agent vs workflow automation","detail":"Comparison"},{"href":"/compare/rag-vs-fine-tuning","label":"RAG vs fine-tuning","detail":"Comparison"},{"href":"/glossary","label":"Glossary","detail":"Every term, in plain words."}],"sources":[{"title":"Regulation (EU) 2022/2554, DORA (Official Journal)","url":"https://data.europa.eu/eli/reg/2022/2554/oj","checkedAt":"2026-10-25"}],"legal":true,"updatedAt":"2026-10-25"}