DORA Compliance: What Financial Institutions Need to Know

DORA Compliance: What Financial Institutions Need to Know

The Digital Operational Resilience Act (DORA) has applied since 17 January 2025 and is changing the way financial institutions in the Netherlands manage IT risk. This European regulation sets strict requirements for digital resilience and affects not only banks and insurers but also their IT suppliers. In this guide, we explain what DORA involves and how to meet its requirements.

Key takeaways (TL;DR)

• DORA has applied directly since 17 January 2025 - there is no transition period left
• 5 pillars: ICT risk management, incident reporting, digital resilience testing, third-party risk, information sharing
• IT suppliers are affected too: DORA sets requirements for contracts with critical IT service providers
• Annual testing is mandatory: penetration tests, business continuity tests and scenario analyses
• Supervised by DNB and AFM: fines for non-compliance can reach 2% of annual turnover

What is DORA?

DORA stands for Digital Operational Resilience Act. It is a European regulation that sets uniform rules for digital operational resilience in the financial sector. Unlike a directive, a regulation applies directly in all EU member states, including the Netherlands.

The core of DORA: financial institutions must be able to demonstrate that they can withstand IT disruptions and cyberattacks. Not just on paper, but in practice.

Who falls under DORA?

DORA has a broad scope and covers more than 20 categories of financial entities:

Directly supervised:

• Banks and credit institutions
• Investment firms
• Insurers and reinsurers
• Pension funds
• Payment institutions
• Electronic money institutions
• Crypto-asset service providers
• Crowdfunding platforms

Indirectly affected:

• ICT service providers to the parties above
• Cloud providers
• Managed service providers
• Software vendors
• Data centre operators

If you provide IT services to a financial institution, DORA will reach you through contractual requirements.

The five pillars of DORA

DORA rests on five pillars that together form a framework for digital resilience.

1. ICT risk management

Organisations must have a robust framework for identifying, assessing and mitigating ICT risks.

Obligations:

• A documented ICT risk management policy
• Identification of critical functions and assets
• Protective measures proportionate to the risk
• Detection capabilities for anomalies and incidents
• Response and recovery procedures
• Regular review and updates

This is not a one-off exercise. DORA requires continuous monitoring and adaptation to changing threats.

2. ICT-related incidents

Financial institutions must classify, manage and report incidents according to standardised criteria.

Reporting obligation:

• Report major ICT incidents to the supervisor (AFM or DNB)
• Initial notification within 4 hours of classification
• Intermediate updates within 72 hours
• Final report within one month

The thresholds for "major" are defined in technical standards. Think of the number of clients affected, the duration of the disruption, the financial impact and cross-border effects.

3. Digital operational resilience testing

Testing is not optional. DORA requires regular testing of ICT systems and processes.

Testing programme:

• Annual vulnerability assessments and scans
• Annual penetration tests
• Scenario-based tests for incident response
• For critical functions: threat-led penetration testing (TLPT) at least every three years

TLPT is an advanced form of red teaming in which external specialists carry out realistic attack scenarios. It is mandatory for the largest institutions.

4. ICT third-party risk

The supply chain gets particular attention. Outsourcing does not reduce your responsibility.

Obligations:

• A register of all ICT service providers
• Risk analysis for outsourcing arrangements
• Contractual agreements on security, audits and exit
• Concentration risk analysis
• Exit strategies for critical services

Suppliers must cooperate with audits and be able to demonstrate that they meet the security requirements.

5. Information sharing

DORA encourages financial institutions to share threat intelligence with each other. This is voluntary, but encouraged.

Options:

• Taking part in sector-wide sharing platforms
• Sharing indicators of compromise (IOCs)
• Warnings about new threats
• Best practices for mitigation

Supervision in the Netherlands

In the Netherlands, the Dutch Authority for the Financial Markets (AFM) and the Dutch central bank, De Nederlandsche Bank (DNB), supervise DORA compliance. Which one supervises you depends on the type of institution.

DNB: banks, insurers, pension funds, payment institutions

AFM: investment firms, managers of investment funds, crowdfunding platforms

Critical ICT service providers come under a new European oversight framework through the European Supervisory Authorities (ESAs).

Practical implementation

DORA compliance calls for a structured approach.

Step 1: Gap analysis

Compare your current situation with the DORA requirements:

• Which processes and documentation are already in place?
• Where are the gaps?
• What is the priority for each gap?

Step 2: Risk assessment

Identify critical functions and the ICT assets that support them:

• Which systems are critical to business operations?
• What are the risks and which measures are in place?
• Is the risk acceptable, or do measures need to be strengthened?

Step 3: Policies and procedures

Document the ICT risk management framework:

• Incident management policy
• Incident classification criteria
• Escalation and reporting procedures
• Business continuity and disaster recovery plans

Step 4: Supplier management

Map out the ICT supply chain:

• Register all suppliers
• Classify the risk of each supplier
• Review and amend contracts
• Record exit strategies

Step 5: Testing

Implement a testing programme:

• Vulnerability management
• Penetration testing
• Tabletop exercises
• TLPT where applicable

Step 6: Continuous monitoring

DORA is not a project but an ongoing process:

• Regular reviews of policies and procedures
• Monitoring of ICT risks
• Reporting to the board
• Adapting to new threats and requirements

The role of IT suppliers

A lot is changing for IT partners that provide services to financial institutions.

New obligations:

• Cooperating with audits and assessments
• Transparency about security measures
• Reporting incidents to clients
• Accepting contractual amendments
• Exit support when a contract ends

Opportunities:

• Financial institutions are looking for DORA-ready suppliers
• Differentiation through compliance expertise
• Long-term relationships through strategic partnership

Overlap with other regulations

DORA does not stand alone. It overlaps with other frameworks.

NIS2: The cybersecurity directive that also covers critical sectors. DORA is the lex specialis for the financial sector.

GDPR: Privacy regulation that continues to apply alongside DORA.

EBA/EIOPA guidelines: Earlier outsourcing guidelines are partly replaced by DORA.

ISO 27001: Not mandatory, but a solid foundation for DORA compliance.

An integrated approach helps you avoid duplicated work and inconsistencies.

Board responsibility

DORA places explicit responsibility on the board. This is not just an IT problem.

Obligations for board members:

• Approving the ICT risk management framework
• Overseeing implementation
• Staying informed about ICT risks and incidents
• Ensuring adequate resources
• Training and awareness

The board must be able to demonstrate that it is actively involved in ICT risk management.

Help with DORA compliance

DORA compliance is complex and requires expertise where IT, security and compliance meet. Many organisations choose external support.

A security partner can help with:

• Gap analysis and roadmap
• Implementing technical measures
• 24/7 monitoring and incident response
• Penetration testing and vulnerability assessments
• Documentation and compliance reporting
• Supplier assessments

A compliance adviser can help with:

• Interpreting the regulation
• Policy development
• Dealing with supervisors
• Training for the board and employees

Sanctions

DORA gives supervisors the power to impose sanctions. Non-compliance can lead to fines that run to a percentage of annual turnover. The reputational damage can also be substantial.

Getting started

DORA is in force and supervisors expect compliance. Waiting is not an option.

Start with an honest assessment of your current situation. Where do you stand against the five pillars? Prioritise the gaps based on risk and impact. Involve the board and secure support and budget.

Digital resilience is not just a compliance obligation. It is a precondition for client trust and the continuity of your organisation. DORA forces this subject to get the attention it deserves.