Complass
DORA: digital operational resilience for financial entities and their ICT providers
A cloud outage at the weekend and a deadline already running: what DORA requires of financial entities and of the IT service providers that serve them.
Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA) has applied since 17 January 2025 to banks, payment and e-money institutions, investment firms, insurers, crypto-asset service providers and other financial entities. In Germany, the Financial Market Digitalisation Act extends the circle to further institutions from 2027. Through their customers' contracts, DORA also affects IT, cloud, software and managed service providers.
The whitepaper explains the five pillars of the Regulation: ICT risk management with the responsibility of the management body, classification and reporting of major incidents with the deadlines of Delegated Regulation (EU) 2025/301, resilience testing up to TLPT, ICT third-party risk with the register of information and contract contents under Art. 30, and information sharing. A dedicated chapter shows IT service providers what their financial customers require and why.
With a ten-step roadmap, a case study of a managed service provider, a checklist and notes on how Complass supports the implementation.
18 pages · Version 1.1 · as of 10.10.2026 · Author Marc Linden, Complass GmbH i. G.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.