Skip to the page
Eurus
Try it live
Menu

DORA

Does DORA apply to you?

DORA, Regulation (EU) 2022/2554, has applied since 17 January 2025. Eurus's scoping questions read Article 2's entity types and exclusions and Article 16's simplified framework, and each verdict names its provision.

Try it live Book an audit

Compliance, kept on every record

Who is in scope

Article 2(1) lists the financial entities it covers.

Answer the scoping questions

  1. Banking and payments

    Credit institutions, payment institutions, account information service providers and electronic money institutions.

  2. Investment and markets

    Investment firms, central securities depositories, central counterparties, trading venues, trade repositories, data reporting service providers, crowdfunding service providers and securitisation repositories.

  3. Funds

    Managers of alternative investment funds and UCITS management companies.

  4. Insurance and pensions

    Insurance and reinsurance undertakings, insurance and reinsurance intermediaries and ancillary insurance intermediaries, and institutions for occupational retirement provision.

  5. Crypto and the rest

    Crypto-asset service providers and issuers of asset-referenced tokens, credit rating agencies and administrators of critical benchmarks.

Who is out, or lighter

  1. Article 2(3)

    Excluded: small alternative investment fund managers under Article 3(2) of Directive 2011/61/EU, the small insurers of Article 4 of Directive 2009/138/EC, occupational pension schemes with 15 members or fewer in total, persons exempted under Articles 2 and 3 of MiFID II, insurance intermediaries that are micro, small or medium-sized enterprises, and post office giro institutions.

  2. Article 2(4)

    A Member State may exclude some entities named in Article 2(5) of Directive 2013/36/EU. Whether an entity in Ireland is excluded is a question for its competent authority.

  3. Article 16

    Small and non-interconnected investment firms, exempted payment and electronic money institutions, and small occupational pension schemes keep a simplified ICT risk management framework in place of Articles 5 to 15.

Try this in a copy of your own, for two hours, with nothing to sign up for.

Open your own copy

Suppliers to financial entities

An ICT supplier is outside Article 2(1) unless the European Supervisory Authorities designate it as critical (Article 31). DORA still reaches it through its customers.

  1. Contract terms

    Article 30(2) lists what every contract for ICT services with a financial entity holds, and Article 30(3) adds more where the service supports a critical or important function: service levels, notice periods, cooperation with the authority, exit strategies, participation in testing.

  2. The register of information

    Each financial entity records every ICT contract in its register of information under Article 28(3). Its suppliers are asked for the details.

  3. Incidents

    A financial entity classifies a major ICT-related incident and reports it to its authority: the first notification within 4 hours of classification and no later than 24 hours from becoming aware. Its suppliers are asked to tell it fast.

How Eurus handles it

The verdict names the Article 2 entity type or exclusion it rests on, and reaches a supplier through its customers' contracts. The incident clocks run from the classification and from awareness, beside the GDPR's 72 hours and NIS2's.

The incident workflows

Start here

See it on a business of your own.

Open your own copy in a few seconds and use it for two hours, with nothing to sign up for. When you want it on your own systems, we start with an audit.

Try it live Book an auditNext: Financial services, and the other sectors