DORA penalties and enforcement: what fines apply

What DORA penalties and enforcement mean for a financial entity

DORA sets no EU-wide maximum or minimum fine for financial entities. Article 50(3) requires member states to lay down administrative penalties and remedial measures for breaches that are effective, proportionate and dissuasive, so the amount a board could face depends on the national law of the member state where the entity is supervised. Before answering a board, regulator or customer, confirm which competent authority supervises the entity under Article 46 and read the penalty provisions of the national law that implements DORA in that country. Ask counsel to confirm whether those provisions also reach members of the management body personally, which Article 50(5) allows.

The roles are fixed. The organization owns its ICT controls, its evidence and its decisions. An implementation partner can prepare systems, document controls and assemble evidence in advance, but it does not decide, impose or lift penalties. Only the national competent authority can do that, through its own powers of access, inspection and investigation under Article 50(2), and only after a reasoned decision that the entity can appeal under Article 50(6). Penalty levels are set by reference to factors in Article 51(2), including intent or negligence, duration, cooperation and previous breaches, so the way an entity has run its programme over time matters as much as any single failure.

No auditor, consultant or vendor can guarantee that an entity will avoid enforcement, and any offer that promises otherwise should be treated with caution. Plan instead for a supervisor who will ask for current evidence on short notice. Ask your team to confirm how the authority publishes non-appealable decisions under Article 54, how long those publications stay online, and what contract terms cover your own liability when an ICT provider causes a breach.

Which supervisory powers Article 50 gives competent authorities

Article 50 sets the floor of what every competent authority can do when it supervises DORA compliance. The cards below group those powers by what they mean for the evidence a financial entity must be able to produce on short notice, and where the national law choices sit.

Access to documents and data

Competent authorities must at least be able to access any relevant document or data. For a financial entity this means the ICT risk framework, policies, registers, incident records, test reports and contract files must be retrievable in a usable form, not reconstructed after a request arrives. Check who can produce each file, where it is stored, and whether copies held by ICT providers can be obtained within a short window.

On-site inspections and investigations

Authorities may carry out on-site inspections and investigations. Inspectors will expect to see systems operating as documented, not only paperwork. Practical readiness means named staff who can walk an inspector through controls, access to data centers or cloud consoles that the entity can actually open, and logs that match what the policies describe.

Summoning representatives for explanations

Authorities can summon representatives to explain facts and decisions. The people most likely to be called are the management body members, the ICT risk function, and the owners of incident and contract decisions. Confirm that each of them can explain the reasoning behind a decision, the evidence it relied on, and who approved it, because an unclear answer can widen an inquiry.

Corrective and remedial measures

Authorities can require corrective and remedial measures, and Article 50(6) requires their decisions to be reasoned and open to appeal. Preparing for this means keeping a remediation register with owners, deadlines and closure evidence, so that an entity can show progress against each finding. Ask whether your internal audit and issue tracking produce records that could be shown to a supervisor as they stand.

Orders to stop a breach or practice

Under Article 50(4), authorities must be able at least to order a breach to cease and to require the temporary or permanent cessation of a practice. For a financial entity, this means it must be able to stop a specific activity or ICT arrangement quickly without losing control of the service. Document how each critical process can be halted, isolated or switched off, and who holds the authority to do it.

Pecuniary measures and public notices

Article 50(4) also lets authorities adopt any type of measure, including pecuniary measures, and issue public notices naming the person and the nature of the breach. Amounts depend on national law, since DORA sets no EU-wide fine level. Check how your member state implements these powers and whether your board and communications teams know how a public notice would be handled.

Telecom traffic records where national law allows

Authorities can obtain existing telecom data traffic records only where national law permits it. This is not a power every member state grants, so its availability varies by country. Confirm with local counsel whether your jurisdiction allows this request, and make sure your log retention and any telecom contracts reflect what could be asked for.

How penalty levels are set under Article 51

Article 51(2) of DORA gives competent authorities the factors they weigh when deciding the type and level of penalty for a breach. They look at whether the breach was intentional or negligent, how material and grave it was, and how long it lasted. They also consider the degree of responsibility of the person concerned, the entity's financial strength, the profits gained or losses avoided, and losses caused to third parties. Cooperation with the authority and any previous breaches also count. The Regulation sets no fixed fine, so the amount in any case depends on national law and on how these factors are applied. Financial entities should therefore read the national implementing measures for each jurisdiction they operate in and confirm with local counsel how their competent authority applies them.

Article 51(1) allows the authority to impose penalties in several ways: directly, in collaboration with other authorities, by delegation to another body, or by applying to judicial authorities. The route in a given case determines who makes the decision and where it can be challenged. Under Article 50(6), every decision must be reasoned and open to appeal, so the entity can expect a written rationale it can test against the factors above. Boards and compliance leads should ask early which body in their home state would handle a breach and how that body records its reasoning.

Of these factors, the organization can influence the ones that depend on its own conduct. It cannot change the past, but it can prepare the evidence that supports cooperation and remediation: timely incident reports, a dated remediation plan with named owners, records of progress against it, and logs of information provided to supervisors on request. Clear documentation of how losses to clients were limited also bears on the assessment of third-party harm. Running these records as part of routine governance, rather than assembling them after a breach, is the most practical step a financial entity can take now.

Which enforcement route applies to your organization

This table compares the routes by which a competent authority can impose penalties under DORA, who acts on each route, when it tends to fit and what the organization should prepare. The routes are set by Article 51(1) and Article 52, but the detail of which route a national authority uses depends on its implementing law, so confirm the choice with the authority or counsel before relying on it.

Route	Who acts	When it fits	What to prepare
Direct imposition by the competent authority	The national competent authority for the entity type under Article 46	The authority has the power under national law to decide and impose the penalty itself	Evidence of governance and controls ready for on-site inspection, a record of decisions and a reasoned response route under Article 50(6)
Collaboration with other authorities	The competent authority working jointly with other authorities, such as a data protection or cyber authority	A breach touches the remit of more than one authority, for example a major ICT incident also covered by other law	A single incident file, named contacts at each authority and a consistent account of facts across all submissions
Delegation	The competent authority delegates its power to another body under national law	National law assigns penalty decisions to a delegated body rather than the supervisor itself	Confirm which body holds the power, its procedure and its appeal path, and who in the organization receives its notices
Application to judicial authorities	The competent authority refers the matter to courts or prosecutors	The case is serious enough to be decided by a judicial body under national procedure	Legal counsel engaged early, preserved records and a clear chain of responsibility for the management body and other individuals
Criminal route under Article 52	Criminal authorities under national law, with the competent authority possibly standing aside	Member states may decline to set administrative penalties for breaches already subject to criminal penalties under national law	Confirm with counsel whether national law makes a given breach criminal, and keep records that would support either route
Penalty levels and their factors	The authority sets the type and level under Article 51(2), with national law setting amounts	Applies on every route once a penalty is imposed, since DORA sets no fixed EU-wide fine	Records on intent or negligence, materiality, duration, cooperation and any previous breaches, which authorities weigh

Who can be held responsible and what becomes public

DORA sets the duty to comply on the financial entity, and Article 50 requires member states to give competent authorities a set of powers to act against breaches. Article 50(3) requires administrative penalties and remedial measures that are effective, proportionate and dissuasive, but DORA sets no EU-wide fine amount, so the level comes from national law. Article 51(2) directs authorities to weigh factors such as intent or negligence, gravity, duration, financial strength, losses to third parties and cooperation. Article 50(4) also allows orders to stop a practice and pecuniary measures.

Corrective orders: authorities can require a breach to cease and order temporary or permanent cessation of a practice.
Pecuniary measures: national law sets the type and scale of financial sanctions for the entity.
Assessment factors: Article 51(2) lists intent or negligence, materiality, duration, cooperation and previous breaches.
Reasoned decisions: Article 50(6) requires reasoned decisions that can be appealed.

Before relying on any of this, confirm with counsel which national authority supervises your entity type and how your member state has implemented these powers.

How sanctions escalate for critical ICT third-party providers

For a designated critical provider, DORA's escalation runs from supervisory measures to periodic penalty payments, public disclosure and, as a last resort, a demand that financial entities stop using the service. Each stage gives your organization a point to check its contracts and exit plans.

Lead Overseer issues recommendations and notifies measures
The Lead Overseer, one of the European Supervisory Authorities, assesses a critical ICT third-party provider and issues recommendations on the risks it finds. Where the provider does not respond adequately, the Lead Overseer notifies it of the measures it intends to take. Financial entities do not receive a penalty at this stage, but they should expect the provider to report on remediation. Check whether your contracts oblige the provider to share oversight outcomes and remediation status with you, and confirm who in your organization receives those updates.
Provider has at least 30 calendar days to comply
Under Article 35(6), periodic penalty payments can only be imposed after at least 30 calendar days from notification of the measures. This window gives the provider time to answer information requests, submit to investigations or inspections, or report on remediation. For your organization, the output is a clear timeline of the provider's open obligations. Ask the provider to confirm, in writing, which oversight requests remain outstanding and what remediation dates it has committed to.
Lead Overseer imposes daily periodic penalty payments
If the provider still does not comply with information requests, investigations, inspections or remediation reporting, the Lead Overseer imposes periodic penalty payments. Under Article 35(7) to (10), these are imposed daily for up to six months, at up to 1 percent of the provider's average daily worldwide turnover in the preceding business year. The payments are enforceable under national civil procedure, go to the EU general budget and are publicly disclosed. Financial entities bear no direct fine, but a provider under sustained penalty may face operational strain. Review your service continuity risk for that provider and confirm the escalation path in your contract.
Lead Overseer discloses non-response publicly
Under Article 42(2), the Lead Overseer must publicly disclose a critical provider's failure to respond to recommendations or an insufficient explanation for not doing so. This disclosure reaches your board, your supervisor and your procurement team, and it changes the risk picture of the provider. The output for your organization is a documented reassessment of that provider in your ICT third-party register and risk assessment. Confirm that your third-party risk process monitors ESA publications and that someone is accountable for acting on them.
Competent authority evaluates continued use
As a last resort under Article 42(6), the competent authority may require financial entities to suspend or terminate use of the provider's service. This is a supervisory decision directed at financial entities, not an automatic consequence of a penalty. Your organization should expect a direct instruction from its competent authority and be ready to act on it. Check that your exit plan for each critical or important function covers suspension, not only planned termination, and that the plan has been tested against realistic timelines.
Execute the tested exit or suspension plan
When a suspension or termination is required, your organization moves the affected function to an alternative provider, an in-house solution or a stopped state, as the authority directs. The output is documented evidence that the transition took place, including the data returned or deleted, the access revoked and the residual risk accepted. Confirm that your contracts include data return and deletion terms, transition assistance and access termination, and that your exit plan names the people and systems responsible for each step.
Document the outcome for supervisors
Once the escalation has concluded, your organization records what happened, what it did, and what remains open, and reports it through the channels your competent authority expects. The output is an updated register entry, a lessons-learned record and any changes to your third-party risk strategy. Confirm with your supervisor what documentation it expects and how long it should be retained, and ensure the record links to the affected contracts and exit plans.

What usually turns a supervisory finding into a penalty

Supervisors rarely start with a fine. Penalties usually follow a pattern where a finding is answered slowly, evidence cannot be produced, or a known gap stays open across reviews. Under Article 51(2), authorities weigh negligence, duration and cooperation, so the practices below are what an entity controls before a finding arises.

Slow or incomplete answers to information requests

Competent authorities can require access to any relevant document or data, summon representatives for explanations and carry out on-site inspections under Article 50(2). A late or partial answer is often read as weak control rather than a simple delay. Keep a named owner for each request type, a log of incoming requests with dates, and a standing list of who can speak for technical, contractual and governance topics. Check that the owner can answer within the deadline stated in the request.

Documents that exist but cannot be produced

A policy approved last year is of little use if nobody can find the signed version, the approval record or the test results behind it. Supervisors assess whether evidence is current, traceable and attributable to the management body. Store policies, risk assessments, test reports and provider reviews in one controlled repository with version history and approval dates. Run a periodic retrieval exercise, asking staff to produce a sample set within a set time, and record how long it took.

Remediation promised but not tracked

When a review or test identifies a weakness, the entity usually commits to a fix. Penalties become more likely when that commitment has no owner, due date or closure evidence. Record every finding in a single remediation register with severity, accountable manager, planned date and the artefact that proves closure, such as a configuration export, a retest result or a signed change record. Report overdue items to the management body on a fixed cadence so the status is visible before a supervisor asks.

Unresolved findings carried between reviews

A finding that appears in one supervisory review and again in the next suggests the root cause was never addressed. Authorities consider duration and previous breaches when they set the type and level of a penalty under Article 51(2). Compare each new finding against the closed and open items from earlier reviews and internal audits. Where a finding recurs, document the root cause analysis, the change to process or tooling that addresses it, and the test that confirmed the change worked.

Critical provider dependence without a tested exit plan

Where a function depends on an ICT provider that is later designated as critical, the Lead Overseer can impose periodic penalty payments and publicly disclose non-response, and competent authorities may ultimately require a financial entity to suspend or terminate that service under Article 42(6). An exit plan that exists only on paper leaves the entity unable to comply quickly. Keep the exit plan current, test it against realistic scenarios, record the results, and confirm that the register of information and contract terms match what the plan assumes.

Questions buyers ask about DORA penalties

Does DORA set a fine amount for non-compliance?

No. DORA sets no EU-wide maximum or minimum fine for financial entities. Under Article 50(3), member states must lay down administrative penalties and remedial measures for breaches that are effective, proportionate and dissuasive, so the amounts depend on national law in each country where the entity is supervised. Your compliance lead should confirm the penalty regime in the member state of each licensed entity, because the same breach can carry different consequences across borders. Penalty levels are then set case by case under Article 51(2), which looks at intent or negligence, materiality, gravity, duration, financial strength, profits gained or losses avoided, and cooperation. Ask counsel to map those factors against your own governance records.

Who decides on DORA penalties and how?

The competent authority for each type of financial entity decides, under Article 46 and the powers in Article 50. Under Article 51(1), an authority can impose penalties directly, act in collaboration with other authorities, delegate the power, or refer the matter to judicial authorities. Article 50(2) gives authorities at least the power to access documents and data, run on-site inspections and investigations, summon representatives for explanations and require corrective measures. Article 50(6) requires decisions to be reasoned and open to appeal, so an entity that disagrees has a formal route to challenge them. Keep records of every information request and response, since these are the evidence an authority will examine first.

Can members of management be personally liable under DORA?

Potentially, yes, but only through national law. Article 50(5) requires that penalties and measures against legal persons can also be applied, under national law, to members of the management body and other individuals responsible for the breach. The Regulation does not itself set personal fines for directors, so the exposure depends on the country and on the individual's role in the failure. Boards should read the national transposition of the sectoral directives amended by Directive (EU) 2022/2556 and obtain legal advice on their own position. A documented management body review of ICT risk and testing results is a practical record of oversight, but it does not replace legal advice and cannot guarantee that no liability arises.

Are DORA penalty decisions published?

Usually yes, with exceptions. Article 54 requires competent authorities to publish non-appealable penalty decisions, stating the type of breach, the persons responsible and the penalty. Authorities may defer publication or publish anonymously where disclosure would be disproportionate, and online publication is limited to five years. The practical effect is that a published decision can affect customer trust, counterparty due diligence and regulator relationships long after the breach is fixed. Ask your legal team how the relevant authority applies these options, and treat public disclosure as a reputational risk to plan for in your incident and communications procedures.

What happens when a critical ICT provider ignores DORA recommendations?

The Lead Overseer escalates in stages. Under Article 42(2), the Lead Overseer must publicly disclose a critical provider's failure to respond to recommendations or an insufficient explanation. Under Article 35(6) to (10), periodic penalty payments can follow non-compliance with information requests, investigations, inspections or remediation reporting, after at least 30 calendar days from notification of the measures. Those payments are imposed daily for up to six months, at up to 1% of the provider's average daily worldwide turnover in the preceding business year. As a last resort under Article 42(6), competent authorities may require financial entities to suspend or terminate use of that provider's service. Financial entities should therefore hold tested exit plans for critical services, as the contract and third-party rules require.

Can outside help reduce DORA enforcement risk?

Outside help can improve your readiness, but it cannot prevent enforcement or guarantee a clean supervisory outcome. Implementation partners such as DeployOpen can plan, implement and document controls, prepare evidence, run security testing and support remediation inside your own infrastructure, under a written, fixed scope. Only independent auditors and authorities assess compliance, and DORA sets no certificate that proves it. Decide the engagement scope with your compliance and legal teams, keep ownership of every control and decision in-house, and ask any provider to show exactly which evidence it will produce and who will review it.

What to have ready so supervisors can verify compliance quickly

Article 50(2) gives competent authorities the power to access documents and data, inspect on site and summon representatives for explanations. The cards below cover the records a supervisor is most likely to ask for first, and each one names an internal check and an owner. An implementation partner can help assemble this evidence, but the organization owns the controls, the records and the answers it gives.

Current ICT policies and approvals

Keep the policy set that governs ICT risk, with each document showing its version, review date and the management body approval that adopted it. Supervisors often start here because the policies set the baseline against which every later record is judged. Check internally that every policy named in your framework has a current version, that the approval date is after the last material change, and that no document refers to a retired system or team. The chief information security officer or head of ICT risk owns this set, and the management body signs it off.

Register of ICT third-party arrangements

Maintain a current register that lists every ICT service provider, the services they deliver, and which of those support critical or important functions. A supervisor will compare the register against contracts, cloud accounts and subcontracting chains, so gaps show quickly. Check internally that each entry matches a signed contract, that owners are named, and that self-hosted open-source components are recorded where they are run by a third party. The third-party risk owner maintains the register, and procurement and legal confirm the entries.

Incident records and reporting evidence

Hold a complete record for each ICT-related incident, covering detection, classification, decisions taken, timestamps, notifications sent and the reports filed with the competent authority. Supervisors test whether reporting deadlines were met and whether classification followed your own criteria. Check internally that every incident log has a classification rationale, that submitted report copies are stored with their acknowledgments, and that post-incident reviews are linked. The incident response lead owns the records, and the compliance function reviews them.

Testing and remediation logs

Keep records of resilience tests, the findings they produced and the remediation carried out, including dates and sign-off. A supervisor who finds an unresolved test finding will ask why it stayed open, so an audit trail matters more than a clean report. Check internally that each finding has an owner, a target date, a closure note and evidence of retest where the fix was material. The security testing lead owns the log, and system owners own closure of their findings.

Contract files for ICT providers

Store the signed contract, schedules, service levels, subcontracting terms, audit rights and exit arrangements for each ICT provider in one retrievable file. Supervisors check whether the contract terms match the risk the service carries, and whether an exit plan can actually be followed. Check internally that every file contains the signed version, that the clauses required for the service type are present, and that the exit plan was reviewed after the last material change. Legal and procurement hold the files, and the business owner confirms the service still matches the contract.

Board minutes showing oversight

Provide minutes that show the management body reviewed ICT risk, approved the policies, considered incidents and tests, and decided on material provider arrangements. Penalty decisions can reach the individuals responsible, because Article 50(5) allows measures against members of the management body under national law, so the minutes are the record of who knew what and when. Check internally that minutes record the reviewed documents, the questions raised and the decisions taken, not only attendance. The company secretary or board secretary keeps the minutes, and the chair confirms their accuracy.

How DeployOpen prepares DORA evidence for supervisory requests

DeployOpen works on DORA penalties and enforcement by preparing the systems, controls and records a competent authority may ask to inspect. We plan, implement and document self-hosted open-source platforms inside the client's own infrastructure, so evidence exists before a supervisor arrives. DeployOpen does not issue reports or attestations; the organization owns its controls and independent assessors make the judgments.

How we scope

Engagements are fixed-scope, with the systems, entities and evidence types agreed in writing before work starts.
The written scope names which authority requests and document categories the work will prepare for.
Ongoing support and continuous testing can be added as a retainer once the initial scope is delivered.

How we build

We configure logging, access records and change history so they can answer a request to produce data on demand.
We document incident and breach records in a form that supports reasoned, appealable decisions by a supervisor.
We test that remediation actions are tracked to closure, since authorities weigh cooperation and previous breaches.

How we hand over

You receive a documented evidence index mapping each control to its records, owners and storage location.
Runbooks explain how staff respond to an on-site inspection request or a summons for explanations.
Handover includes a review session where your compliance and security leads confirm they can produce each record.

How we support

Retainers cover upgrades, evidence refreshes and follow-up when a supervisor sends corrective measures.
We help you confirm with counsel and your competent authority which national penalty rules apply to your entity.
Support scope, response expectations and fees are set out in the written agreement, and quotes follow from that scope.