DORA: What Every Fintech Needs to Know About Digital Resilience

What Is the DORA Regulation?

The DORA regulation (Digital Operational Resilience Act) has been in effect since January 17, 2025. Unlike a directive, DORA is a European regulation directly applicable in all member states — no national transposition needed.

Its objective: ensure that the European financial sector can withstand, respond to, and recover from any type of ICT-related disruption or threat.

Who Does It Apply To?

DORA applies to over 22,000 financial entities in the EU, as well as ICT service providers serving them:

• Credit institutions (banks)
• Investment firms
• Payment and e-money institutions
• Fintechs and neobanks
• Asset management companies
• Insurance and reinsurance companies
• Crowdfunding platforms
• Crypto-asset service providers
• Critical third-party ICT service providers (cloud, SaaS, infrastructure)

Key point for SaaS startups: if your clients are financial institutions, you're indirectly subject to DORA. Your clients will need to assess your resilience and will send you specific security questionnaires.

The 5 Pillars of DORA

Pillar 1: ICT Risk Management

Financial entities must establish a comprehensive ICT risk management framework including asset identification, continuous risk assessment, protection measures, detection mechanisms, and crisis communication strategy. The management body is personally responsible for approving the digital resilience strategy.

Pillar 2: ICT Incident Management and Reporting

DORA imposes structured incident management with classification criteria, authority notification for major incidents, an interim report within 72 hours, and a final report within 1 month.

Pillar 3: Digital Operational Resilience Testing

Entities must regularly perform vulnerability tests, open-source code analysis, network security assessments, scenario testing, and threat-led penetration testing (TLPT) for the most critical entities — at least every 3 years.

Pillar 4: Third-Party ICT Risk Management

This pillar impacts SaaS startups and fintechs the most: maintaining a complete register of ICT providers, pre-outsourcing risk assessment, mandatory contractual clauses, exit strategies, and continuous monitoring.

Pillar 5: Information Sharing

DORA encourages voluntary sharing of cyber threat intelligence between financial entities within a trust framework while respecting GDPR.

How to Prepare as a Fintech

1. Map your ICT services: identify all systems, providers, and data flows
2. Assess your risks: use a structured framework (ISO 27005 or EBIOS RM)
3. Strengthen your contracts: include DORA clauses in supplier and client contracts
4. Plan your testing: establish a resilience testing program proportionate to your size
5. Automate documentation: use Compli.st to centralize compliance evidence and respond to financial client security questionnaires

Prepare your DORA compliance with Compli.st →