Who Does DORA Apply To, and Does It Reach Outside the EU?

DORA, formally Regulation (EU) 2022/2554, has applied since 17 January 2025 and sets digital operational resilience requirements for the financial sector. It applies to specified EU-regulated financial entities and sets requirements concerning the ICT service providers they depend on, including cloud, software and cybersecurity companies. Organisations outside the EU are not automatically regulated directly, but may face DORA-related contractual obligations when serving EU financial institutions, and certain designated critical ICT providers face direct oversight. The difference between direct applicability, contractual obligation and designated oversight is what this article sets out: DORA‘s reach depends on whom you serve, how you are regulated and how you are legally structured – not simply on where you are registered.

What Is DORA Regulation?

DORA was introduced to establish consistent digital operational resilience standards across the EU financial sector. Financial institutions increasingly depend on interconnected systems and external technology providers, which means a failure in one service can disrupt operations across multiple organisations.

The regulation goes beyond traditional cybersecurity by addressing an organisation’s ability to maintain essential services during technological disruption. It requires covered financial entities to identify and manage ICT risks, prepare for incidents, maintain business continuity and restore affected operations. The goal is not simply to prevent cyberattacks or system failures, but to ensure financial services can continue or recover when disruption occurs.

Who Does DORA Apply To?

DORA applies to the financial entities listed in Article 2 of Regulation (EU) 2022/2554. These include banks and other credit institutions, payment and electronic money institutions, investment firms, insurers and reinsurers, fund managers, and certain crypto-asset service providers. Other covered organisations include trading venues, central securities depositories, credit rating agencies and crowdfunding service providers.

The determining factors are an organisation’s regulatory status and activities, not simply whether it operates in finance or technology. A fintech company that does not fall within DORA’s specified categories is not automatically subject to its financial-entity obligations.

DORA also reaches ICT third-party service providers, including cloud infrastructure, software and cybersecurity companies – but it reaches most of them indirectly. Supplying technology to an EU financial institution does not place a provider under the same requirements as its customer. Most providers encounter DORA through the contractual obligations their customers must impose, while the small group formally designated as critical falls under a separate oversight framework.

Certain entities are explicitly excluded, and the principle of proportionality adjusts the applicable requirements according to a financial entity’s size, risk profile and operational complexity.

Does DORA Apply Outside the EU?

Yes, but not every non-EU company is directly regulated by DORA. Its cross-border reach depends on the organisation’s legal structure, regulatory status and relationship with EU financial institutions. A company may be directly subject to DORA, affected through contractual requirements, or placed under a separate oversight framework.

The following scenarios illustrate how DORA applies across jurisdictions:

Scenario	DORA implications
EU financial entity with a non-EU branch	The branch has no separate legal personality, so it forms part of the in-scope legal entity.
Separate non-EU subsidiary	A subsidiary is a distinct legal person. It is not covered merely because its parent is, and falls in scope only if it meets Article 2 in its own right.
Non-EU credit institution or insurer with an EU branch	The branch may be directly subject to DORA. Third-country branch authorisation under CRD and Solvency II requires ICT governance in accordance with DORA.
Third-country insurance intermediary accessing an EU market directly	Generally outside DORA, and governed instead by the Member State’s national insurance distribution law, unless that law explicitly requires DORA compliance.
Non-EU technology vendor serving an EU financial entity	No direct regulation, but the customer must impose the contractual terms set out in Article 30.
Financial entity in Norway, Iceland or Liechtenstein	DORA is incorporated into the EEA Agreement by Joint Committee Decision No 40/2025 and has been in force in the EEA since 1 July 2025.

 

Sources: European Commission answer in the EIOPA Q&A database (DORA102-3097) on third-country branches; Article 30 on contractual arrangements; EFTA EEA-Lex record for 32022R2554 on EEA incorporation.

These scenarios reflect three distinct forms of regulatory impact.

•   Direct applicability. DORA applies to financial entities and qualifying operations within its legal scope, including relevant branches.
•   Contractual obligation. Non-EU technology providers may have to meet DORA-related requirements imposed by their EU financial-sector customers. The regulated financial entity remains responsible for its own compliance.
•   Designated oversight. ICT providers formally classified as critical may face direct supervision by European authorities, wherever they are headquartered.

A UK cybersecurity company supporting a German bank, for example, may have to agree to specific service availability, incident assistance and audit provisions. That does not make the company directly regulated as a financial institution. Providing services across a border can create substantial compliance responsibilities without placing every supplier under the same regulatory framework.

Does DORA Apply to UK Companies?

DORA does not automatically apply to UK companies simply because they are based in Britain or serve EU customers. Applicability depends on regulatory status, activities and legal structure.

A UK financial group with an EU-regulated subsidiary must account for that subsidiary’s DORA obligations. EU branches of UK banks and insurers may fall directly within scope, because third-country branch authorisation requires ICT governance in accordance with DORA. UK-based technology providers serving EU financial institutions more often face DORA-related contractual requirements instead, without being directly regulated as financial entities.

The UK operates its own operational resilience framework, overseen by the FCA, PRA and Bank of England, including a separate oversight regime for designated critical third parties. Meeting UK requirements does not establish compliance with DORA.

What DORA Means for a Non-EU ICT Supplier

A UK, US or Israeli cloud, software or cybersecurity company can be affected by DORA without becoming an EU-regulated financial entity. For most suppliers the practical impact arrives through the contract.

Contractual requirements (Article 30). Every ICT contract must address the services provided, the countries where services are delivered and data is processed, data availability and integrity, service levels, provider assistance during ICT incidents, cooperation with authorities, termination rights and notice periods. Where the services support critical or important functions, the contract must go further: quantitative service-level targets, business continuity testing, participation in threat-led penetration testing, unrestricted audit and inspection rights for the entity and its competent authority, and a documented exit strategy with a transition period. The financial entity remains responsible for its own regulatory compliance; the supplier is bound by what it has signed.

Critical ICT third-party providers (Article 31). A small group of providers may be formally designated as critical by the European Supervisory Authorities and brought under direct EU oversight, with one of the ESAs appointed as Lead Overseer. Under Article 31(12), a designated provider established in a third country must set up a subsidiary in the Union within one year of designation for EU financial entities to keep using its services.

There is also a paperwork obligation that reaches the supplier indirectly. Under Article 28(3), every financial entity must maintain a register of information covering all its contractual arrangements for ICT services, distinguishing those that support critical or important functions from those that do not, and must provide it to its competent authority on request. A non-EU supplier does not file anything itself, but it will be listed in its customers’ registers – and will be asked for the details that populate the entry.

In practice this means a British cybersecurity supplier serving a German bank may be asked to evidence its incident response capability, its service continuity arrangements and its cooperation with customer audits – none of which makes it a designated critical provider. Where the contract commits the supplier to availability targets, DDoS testing for financial services is how those commitments are checked against realistic attack conditions rather than assumed.

The Five Areas DORA Covers

DORA establishes five interconnected areas of digital operational resilience. Together they address how financial entities manage technology risk, respond to disruption and maintain essential services.

Area	What it requires
ICT risk management	Establish governance, security controls, business continuity and recovery arrangements to manage technology risk.
ICT incident management and reporting	Detect, classify and manage ICT incidents, and report major incidents to the relevant authorities.
Digital operational resilience testing	Conduct proportionate ICT resilience testing. See whether DORA requires DDoS testing, and how often.
ICT third-party risk management	Assess and manage risks arising from technology suppliers, including contractual obligations, service dependencies and concentration risk.
Information sharing	Allow voluntary exchange of cyber-threat intelligence between financial entities under defined conditions.

 

These areas form a common framework, but the specific obligations vary with the entity’s regulatory status, size, risk profile and operational complexity. Compliance is an ongoing risk-management process rather than a one-time assessment.

Three Questions That Tell You Where You Stand

Working out whether DORA affects your organisation starts with three questions.

1.   Is your organisation an in-scope regulated financial entity? Check whether your activities fall within DORA’s defined categories and whether any exclusion applies.
2.   Does your legal entity or any of its branches operate under EU or EEA financial rules? Distinguish branches from legally separate subsidiaries when assessing cross-border applicability.
3.   Do you provide ICT services to an in-scope financial entity? Review your customer relationships, your contractual commitments and whether your organisation has been formally designated a critical ICT provider.

The answers separate a direct regulatory obligation from a contractual requirement – two different problems with two different owners. Where the contract commits you to availability, DDoS testing is how you establish what your infrastructure and defences actually do under realistic attack conditions.

This article explains how DORA is structured. It is not legal advice, and whether it applies to a specific entity should be confirmed with legal and compliance counsel.

If an EU financial entity depends on your service, find out how it behaves under attack before they ask you to prove it. Talk to Red Button about your testing requirements.

Frequently Asked Questions About DORA

When did DORA start applying?

DORA has applied since 17 January 2025. The Regulation entered into force on 16 January 2023, the twentieth day after its publication in the Official Journal on 27 December 2022, with a two-year implementation period before application. Entities within scope have been required to comply since the 2025 application date, so DORA is an active requirement rather than an upcoming one.

Who enforces DORA?

National competent authorities supervise DORA compliance among financial entities according to their regulatory category. The European Supervisory Authorities – EBA, ESMA and EIOPA – designate critical ICT third-party providers and appoint a Lead Overseer for each. That EU-level oversight of providers is separate from the supervision of financial institutions.

Does DORA apply to cloud providers?

Cloud providers serving EU-regulated financial entities face DORA-related contractual requirements covering security, service continuity, incident assistance and audit cooperation. Providing cloud services does not by itself place a company under direct EU supervision. That oversight applies only to ICT providers formally designated as critical under DORA’s assessment framework.