Does DORA apply to me? For financial entities and their ICT third-party providers

To the financial entities in Art. 2(1): among others, credit institutions, payment and electronic money institutions, investment firms, crypto-asset service providers, insurance and reinsurance undertakings, fund managers and trading venues. It also covers ICT third-party service providers (Art. 2(1)(u)), under a different regime. Art. 2(3) excludes some entities.

To achieve a high common level of digital operational resilience in the EU financial sector. It sets uniform requirements on ICT risk management, the reporting of major incidents, resilience testing, ICT third-party risk and information sharing (Art. 1(1)).

Each financial entity is supervised by its competent authority under its sectoral rules (Art. 46); in Spain, depending on the type of entity, the Bank of Spain, the CNMV or the Directorate-General for Insurance and Pension Funds. Critical ICT third-party service providers are overseen by the European Supervisory Authorities, one of them acting as Lead Overseer (Art. 31).

It does not impose on you the obligations of a financial entity, but your client is obliged to sign the contractual provisions of Art. 30 with you and to manage the risk you represent (Art. 28). Only if you are designated as a critical ICT third-party service provider are you directly overseen (Art. 31).

One whose disruption would materially impair the financial entity's financial performance, the soundness or continuity of its services and activities, or its continuing compliance with the conditions and obligations of its authorisation or its other obligations under financial services law (Art. 3(22)). Your client decides. If your service supports one, the contract must include more provisions (Art. 30(3)).

All contracts must cover, among other things, a description of the service, where data is processed, its protection and recovery, service levels, assistance with incidents, cooperation with the authorities and termination (Art. 30(2)). If the service supports critical or important functions, contingency plans, testing, audit rights and an exit strategy are added (Art. 30(3)).

An ICT service provider that the European Supervisory Authorities designate as critical because of its importance for the financial sector, and which is then directly overseen by them (Art. 31). Art. 2(1)(u) brings all ICT third-party service providers within the scope of DORA, but that direct oversight applies only to those designated as critical.

If a financial entity is also within the scope of NIS2, DORA governs ICT risk management, incident reporting and supervision, and prevails over those provisions of NIS2 (DORA Art. 1(2); NIS2 Art. 4).

• 20 October 2026 · version 2026.10.12-r6. First complete version: 21 types of entity with their exclusions and the simplified regime, size under DORA's definitions, ICT service provider with the provisions of Art. 30, and critical ICT third-party service provider as a conclusion in its own right.