Who does DORA apply to? Scope and exemptions
Which financial entities does DORA cover?
Art. 2(1) of Regulation (EU) 2022/2554 lists 20 categories of financial entities (points (a) to (t)) and adds ICT third-party service providers as the 21st category. Grouped, the addressees look like this:
| Area | Entities in scope (selection) |
|---|---|
| Banks and payments | Credit institutions, payment institutions, account information service providers, electronic money institutions |
| Securities and markets | Investment firms, trading venues, central counterparties (CCPs), central securities depositories (CSDs), trade repositories, data reporting service providers |
| Funds and asset management | Managers of alternative investment funds (AIFMs), management companies (UCITS) |
| Insurance and pensions | Insurance and reinsurance undertakings, insurance intermediaries, institutions for occupational retirement provision |
| Crypto and new markets | Crypto-asset service providers (CASPs) and issuers of asset-referenced tokens, crowdfunding service providers |
| Infrastructure and ratings | Credit rating agencies, administrators of critical benchmarks, securitisation repositories |
| IT service providers | ICT third-party service providers (Art. 2(1)(u)), e.g. cloud, data centre and software providers to the financial sector |
The circle is wide. Even those who previously had little to do with supervision, such as insurance intermediaries above the SME threshold or crypto-asset service providers, have the same resilience obligations as a large bank. The requirements are scaled according to the principle of proportionality (Art. 4).
What applies to ICT third-party service providers?
What is new is that DORA includes ICT third-party service providers directly, from the cloud hyperscaler to the specialised software vendor. Providers classified as critical are subject to a dedicated oversight framework of the European Supervisory Authorities (Art. 31 et seq.). Independently of that, minimum contractual provisions apply to every outsourcing (Art. 30). Financial entities must also keep a register of information on all contractual arrangements with ICT third-party service providers (Art. 28(3)).
Who is exempt?
- managers of alternative investment funds below the thresholds of Art. 3(2) of the AIFM Directive
- insurance and reinsurance undertakings within the meaning of Art. 4 of Solvency II (very small insurers)
- institutions for occupational retirement provision with fewer than 15 members
- insurance intermediaries that are micro, small or medium-sized enterprises
- persons exempted under MiFID II and post office giro institutions (Art. 2(3))
Member states may additionally exempt narrowly defined institutions under Art. 2(5) of the Capital Requirements Directive (Art. 2(4)).
When does the simplified framework (Art. 16) apply?
DORA scales by proportionality. For small and non-interconnected investment firms, exempted payment and electronic money institutions and small pension institutions, Arts. 5 to 15 do not apply. For them the simplified ICT risk management framework of Art. 16 applies. That is no free pass. Art. 16 also requires a documented risk management framework. Critical functions must be protected by business continuity plans with backup and recovery measures, and these plans are explicitly to be tested regularly (Art. 16(1)(f) and (g)). A documented tabletop exercise meets this testing obligation in the simplest form.
How does DORA relate to NIS2?
If an entity falls under both NIS2 and DORA, DORA takes precedence as lex specialis for the areas it covers. The national NIS2 laws confirm this. The delimitation in detail is explained in the article NIS2 vs. DORA.
Frequently asked questions
Who does DORA apply to?
Art. 2 of Regulation (EU) 2022/2554 lists 20 categories of financial entities, from credit institutions to insurers, investment firms and crypto-asset service providers. In addition DORA includes ICT third-party service providers. The regulation therefore covers the entire EU financial sector together with its IT supply chain.
Are there exemptions from the scope of DORA?
Yes. Art. 2(3) exempts, among others, certain small managers of alternative investment funds, small pension institutions with fewer than 15 members and insurance intermediaries that are micro, small or medium-sized enterprises. Member states may exempt further narrowly defined institutions (Art. 2(4)).
What does the simplified ICT risk management framework mean?
Small and non-interconnected investment firms, exempted payment and electronic money institutions and small pension institutions only have to meet the simplified framework of Art. 16 instead of Arts. 5 to 15. This framework also explicitly requires business continuity plans with recovery measures. And it requires that these plans are tested regularly.
Note: This article is for general information and is not legal advice. The applicable laws and regulations, and the current state of national transposition, take precedence.