Does DORA Apply to My Firm? Entity Types, Exclusions and Lighter Rules

This guide follows Regulation (EU) 2022/2554, the Digital Operational Resilience Act (DORA). Because DORA is a regulation, it applies directly in every member state, without national transposition, with one national option on certain credit institutions explained below. If you are in scope, our DORA compliance checklist lists what it requires.

Step 1: Is your firm one of the 20 financial entity types?

Article 2(1) lists who DORA applies to. Points (a) to (t) are the financial entities (Article 2(2)); point (u) adds ICT third-party service providers, covered in step 3.

Group	Entities in Article 2(1)
Banking and payments	(a) credit institutions; (b) payment institutions, including those exempted under PSD2; (c) account information service providers; (d) electronic money institutions, including exempted ones
Investment and markets	(e) investment firms; (g) central securities depositories; (h) central counterparties; (i) trading venues; (j) trade repositories; (m) data reporting service providers; (t) securitisation repositories
Funds	(k) managers of alternative investment funds; (l) management companies (UCITS)
Insurance and pensions	(n) insurance and reinsurance undertakings; (o) insurance, reinsurance and ancillary insurance intermediaries; (p) institutions for occupational retirement provision
Crypto-assets	(f) crypto-asset service providers authorised under MiCA and issuers of asset-referenced tokens
Other	(q) credit rating agencies; (r) administrators of critical benchmarks; (s) crowdfunding service providers

The test is your authorisation or registration, not what you call yourself. A fintech that holds an e-money licence is in scope as an electronic money institution; a software company that only sells tools to banks is not a financial entity, though it may be an ICT third-party service provider.

Step 2: Check the exclusions in Article 2(3)

DORA does not apply to:

Excluded	Article
Managers of alternative investment funds under the AIFMD's small-manager regime (Article 3(2) of Directive 2011/61/EU)	2(3)(a)
Insurance and reinsurance undertakings excluded from Solvency II by its size thresholds (Article 4 of Directive 2009/138/EC)	2(3)(b)
Institutions for occupational retirement provision whose pension schemes together have no more than 15 members	2(3)(c)
Persons exempted under Articles 2 and 3 of MiFID II (Directive 2014/65/EU)	2(3)(d)
Insurance, reinsurance and ancillary insurance intermediaries that are microenterprises or small or medium-sized enterprises	2(3)(e)
Post office giro institutions referred to in Article 2(5)(3) of the Capital Requirements Directive	2(3)(f)

Under Article 2(4), member states may also exclude the institutions listed in Article 2(5)(4) to (23) of the Capital Requirements Directive (Directive 2013/36/EU) located in their territory, such as certain national development banks. The Commission publishes which member states use this option.

Intermediaries, note: the exclusion for insurance intermediaries depends on being an SME, so a large broker is in scope. Check your size against the SME definition before relying on it.

Step 3: ICT third-party service providers

An ICT third-party service provider is simply an undertaking providing ICT services (Article 3(19)), meaning digital and data services provided through ICT systems on an ongoing basis, including hardware as a service (Article 3(21)). For most providers, DORA works through their financial customers rather than directly:

Contracts: financial entities must put the clauses of Article 30 into their ICT contracts, with extra terms for services supporting critical or important functions. See our Article 30 clause checklist.
Register and due diligence: your customers record you in their register of information and assess you before and during the contract (Article 28).
Direct oversight only if designated critical: the European Supervisory Authorities (ESAs) designate critical ICT third-party service providers (Article 31) and oversee them directly. The first list was published on 18 November 2025 and is updated yearly (Article 31(9)).

Designation does not apply to financial entities providing ICT services to other financial entities, to ICT intra-group service providers, or to providers serving only financial entities active in a single member state from that member state (Article 31(8)). A critical provider established outside the EU must set up an EU subsidiary within 12 months of designation for financial entities to keep using it (Article 31(12)).

Step 4: How much of DORA applies to you

Being in scope does not mean every article applies in full.

Proportionality for everyone

Article 4 requires financial entities to implement the ICT risk management rules in Chapter II in line with their size, overall risk profile and the nature, scale and complexity of their services. Incident reporting, testing and third-party risk rules apply proportionately where those chapters say so.

The simplified ICT risk management framework (Article 16)

Articles 5 to 15, the full ICT risk management framework, do not apply to:

small and non-interconnected investment firms;
payment institutions exempted under PSD2;
institutions exempted under the Capital Requirements Directive where the member state has not excluded them under Article 2(4);
electronic money institutions exempted under the E-Money Directive;
small institutions for occupational retirement provision.

They apply a simplified framework instead: a sound, documented ICT risk management framework, continuous monitoring of ICT systems, detection and swift handling of incidents, identification of key ICT third-party dependencies, business continuity with backup and restoration, and regular testing (Article 16(1)). Commission Delegated Regulation (EU) 2024/1774 sets out the detail.

Microenterprises

A microenterprise under DORA is a financial entity, other than a trading venue, central counterparty, trade repository or central securities depository, that employs fewer than 10 persons and has an annual turnover and/or annual balance sheet total of no more than €2 million (Article 3(60)). Microenterprises stay in scope, but several provisions are lighter for them. For example, they need no separate control function for ICT risk and no regular internal audit of the framework (Article 6(4) and (6)), no independent testers or yearly tests of critical systems (Article 24(4) and (6)), and no strategy on ICT third-party risk (Article 28(2)); the recurring-incident rule of Delegated Regulation (EU) 2024/1772 does not apply to them either. They must still classify and report major ICT-related incidents and keep a register of information (Article 28(3)).

Threat-led penetration testing

Advanced testing (TLPT) applies only to financial entities identified by their competent authority under Article 26(8); microenterprises and the entities on the simplified framework are excluded (Article 26(1)). See who must do TLPT.

Worked examples

Firm	In scope?	What applies
Payment institution authorised under PSD2, 40 staff	Yes, Art. 2(1)(b)	Full DORA, applied proportionately
Small payment institution exempted under PSD2	Yes, Art. 2(1)(b)	Simplified ICT risk management framework (Art. 16); reporting and third-party rules apply
Insurance broker with 30 staff and €4 million turnover	No, Art. 2(3)(e): an SME intermediary	DORA does not apply; NIS2 and GDPR may
Crypto-asset service provider authorised under MiCA	Yes, Art. 2(1)(f)	Full DORA; see DORA for CASPs
SaaS company providing a core banking platform to EU banks	Not a financial entity; an ICT third-party service provider	Contract clauses and due diligence through its customers; direct oversight only if designated critical

These are illustrations of how the rules work. Check your own authorisation and size against the articles cited.

DORA and NIS2

Many DORA financial entities also fall within NIS2 sectors such as banking and financial market infrastructures. For the entities it covers, DORA is a sector-specific act: under Article 4 of NIS2, its ICT risk management and incident reporting rules apply instead of the equivalent NIS2 provisions. See does NIS2 apply to my company? for the other side.

In scope? Start with the gap list. The DORA Compliance Checklist pack includes a gap-assessment workbook, an ICT risk management framework template, a third-party ICT provider register and an incident classification matrix.