How DORA lands on each kind of financial entity: banks, payment and e-money institutions, investment firms, insurers, fund managers, pension funds, market infrastructures and microenterprises, with the sectoral directives Directive (EU) 2022/2556 amended.
What DORA means for credit institutions: ECB supervision for significant banks, TLPT for G-SII and O-SII banks with external testers only, stricter weekend reporting rules, individual incident reporting and the CRD and BRRD changes that came with DORA.
How DORA applies to payment and electronic money institutions: one incident regime replacing PSD2 reporting, payment-related incidents, the simplified framework for exempted institutions, TLPT thresholds and the PSD2 amendments.
Where investment firms sit under DORA: full scope for most firms, the simplified ICT risk framework for small and non-interconnected firms, MiFID II exemptions, relief from TLPT and the third-party strategy, and the MiFID II amendments.
How DORA applies to insurance and reinsurance undertakings and intermediaries: who is excluded, supervision by the Solvency II authority, TLPT for large insurers, the Solvency II amendments and the 2028 review of intermediaries.
What DORA requires of alternative investment fund managers and UCITS management companies: scope and the small AIFM exclusion, proportionality, the register of information, and the AIFMD and UCITS amendments.
How DORA applies to institutions for occupational retirement provision: the exclusion for schemes with up to 15 members, the simplified framework for small IORPs, what still applies, and the IORP II amendment.
The stricter DORA rules for central counterparties, central securities depositories and trading venues: 2-hour recovery objectives, secondary sites, pre-deployment vulnerability assessments, external parties in testing and default TLPT.
What DORA relaxes for the smallest firms: the microenterprise test, relief from the independent control function, internal audit and the testing programme, delegated audit rights over providers, and the separate simplified regime under Article 16.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.