← Articles and guides on fraud, cybersecurity, privacy and AML

DORA since January 2025: what changed and supervisory priorities

DORA in review: 3,383 major ICT incidents in 2025, 19 critical tech providers under direct EU oversight and the ECB's resilience focus through 2028.

2026-10-09

The Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) has applied since 17 January 2025. Nearly two years on, supervisors have published their first incident statistics, designated the first critical tech providers and placed ICT resilience at the top of their agendas. For banks, insurers, asset managers, payment institutions and fintechs operating in the EU, DORA has moved from a compliance project to day-to-day supervision.

What DORA requires

The regulation harmonised ICT risk rules across the financial sector. Since January 2025 firms have needed:

A board-approved ICT risk-management framework.
Classification and reporting of major ICT-related incidents.
Digital resilience testing, including threat-led penetration testing (TLPT) for designated firms.
Third-party risk management and a register of information on ICT contracts.

According to Walkers, national authorities had to submit registers to the European Supervisory Authorities (ESAs) by 30 April 2025.

Reporting clock

Austria's FMA summarises the timelines: an initial notification within 4 hours of classifying an incident as major and no later than 24 hours after becoming aware; an intermediate report within 72 hours; a final report within one month of the latest intermediate report. An incident is major when it hits critical services and either involves malicious unauthorised access that may cause data loss or meets two or more materiality thresholds, such as clients affected, duration, geographic spread or economic impact. Recurring incidents with the same root cause, at least twice in six months, can be aggregated. DORA is lex specialis to NIS2 and replaced PSD2 incident reporting for in-scope payment providers.

Year one: 3,383 major incidents

On 3 June 2026 the ESAs released their first report: 3,383 major ICT incidents in 2025, about 0.18 per entity. Roughly a third had cross-border impact and only about 10% were cybersecurity incidents; system failures and external events dominated. Ropes & Gray adds that credit institutions accounted for over 60% of incidents and payments for 16%, that only 30 incidents hit a million or more transactions, and that almost a third stemmed from third-party failures. On 7 July 2026, the ESRB raised its systemic cyber risk assessment from "elevated" to "severe", citing frontier AI threats.

Critical providers under direct oversight

On 18 November 2025 the ESAs published the first list of critical ICT third-party providers (CTPPs). Morgan Lewis counts 19, spanning hyperscale cloud, data centres, network infrastructure and financial-services technology. The ESAs can issue recommendations, publicise non-compliance and, as a last resort, require financial entities to suspend or terminate contracts. CTPPs pay annual oversight fees and must name an EU coordination entity.

Supervisory priorities to 2028

The ECB's 2026–2028 priorities, summarised by A&L Goodbody, include follow-up on ICT remediation, on-site inspections on cybersecurity and DORA third-party risk, TLPT, an ICT change-management review a deep dive into cloud dependency, and workshops on generative AI use alongside cooperation under the AI Act.

Checklist

Reconcile your register of information against the 19 CTPPs.
Plan exit strategies for concentrated providers, listed or not.
Drill the 4h/24h/72h clock.
Strengthen change management, since system failures drive most incidents.
Prepare for TLPT and third-party inspections.