Who Needs to Comply with DORA? Scope, Requirements, and Applicability

DORA does not apply to every company in or around financial services. The Digital Operational Resilience Act (DORA) applies mainly to EU-authorized or registered financial entities, while information and communications technology (ICT) providers are usually affected through financial-sector customers, contracts, and critical-provider oversight. The key question is whether your entity, authorization, and services fall within DORA’s scope.

Key Takeaways

• DORA covers many EU-authorized or registered financial entities, but some smaller entities are excluded.
• Applicability depends first on entity type and EU authorization, not company size alone. ICT dependencies shape how requirements apply, not whether they apply.
• ICT third-party providers are usually affected through contracts, due diligence, registers of information, and subcontracting rules.
• Critical ICT third-party providers can face direct EU-level oversight.
• DORA has applied since January 17, 2025, so scope is a current compliance question, not a future one.

DORA Applicability: Which Financial Entities Does It Cover?

Article 2 of Regulation (EU) 2022/2554 covers a broad set of EU financial entities. The starting point is whether your organization is authorized or registered under one of the relevant EU financial-services regimes.

Being in one of these categories does not end the analysis. Some smaller entities are excluded, and some covered entities follow simplified requirements.

DORA applicability does not depend on company size alone or on whether an organization calls itself a fintech. A smaller regulated payment firm, crypto-asset service provider, or data reporting service provider may still fall within scope if it performs covered financial activities.

Who Is Out of DORA’s Scope or Treated Differently?

Excluded under DORA: DORA Article 2(3) excludes small alternative investment fund managers under AIFMD, small insurance and reinsurance undertakings under Solvency II, pension institutions with no more than 15 members, and insurance, reinsurance, and ancillary insurance intermediaries that are micro, small, or medium-sized enterprises.

Simplified framework under DORA: DORA Article 16 gives certain smaller entities a simplified ICT risk management framework instead of the full framework. This includes small and non-interconnected investment firms, exempted payment institutions, exempted e-money institutions, certain exempted credit institutions, and small pension institutions with up to 100 members. Microenterprises are also exempt from certain specific requirements.

DORA also applies proportionately under Article 4. Requirements scale with an entity’s size, risk profile, and service complexity, but proportionality changes how obligations apply, not whether DORA applies.

Threat-led penetration testing is not required for every covered entity. It applies only to financial entities identified by competent authorities, with testing requirements further detailed in Commission technical standards.

Financial entities that also fall under NIS2 follow DORA for overlapping ICT risk, incident reporting, and oversight rules, as explained in our DORA vs NIS2 guide.

Does DORA Apply to Non-EU and US Companies?

Not directly, unless the company has an EU-authorized or registered financial entity.

A non-EU parent company does not remove an EU-authorized subsidiary from DORA scope. If the EU entity is authorized or registered as a covered financial entity, DORA applies to it directly, whatever the nationality of its parent.

A US or other non-EU company with no EU-authorized financial entity is usually not directly covered as a financial entity. But it can still be affected if it provides ICT services to EU financial entities. In that case, DORA may shape customer due diligence, audit rights, required contract terms, subcontracting controls, exit planning, and resilience expectations.

Do ICT Third-Party Providers Need to Comply Directly?

Usually not directly. Most ICT third-party providers are not regulated like financial entities, and DORA does not remove a financial entity’s accountability when ICT services are outsourced.

An ICT third-party service provider is a company that supplies digital or data services, such as cloud, software, or infrastructure, to a financial entity.

These providers are usually affected through their financial-sector customers. Covered financial entities must assess ICT third-party risk, maintain a register of information on ICT arrangements using the Commission templates, include required contract terms, and apply stricter requirements, including subcontracting assessments, to services supporting critical or important functions.

Some ICT providers face direct EU-level oversight if the European Supervisory Authorities (ESAs) designate them as critical ICT third-party providers. As of October 2026, the ESAs’ first list, published on November 18, 2025, names 19 providers and is updated annually. Providers not on the list can also apply for designation.

In Akitra’s review of the list, only four of the 19 providers (AWS, Google Cloud, Microsoft, and Oracle) are hyperscale cloud platforms. The rest are IT services and software firms, telecom and data center operators, and financial data and technology providers.

A designated critical provider established outside the EU must have an EU subsidiary within 12 months of designation, because financial entities may only keep using it on that condition. For providers designated in the first list, the 12-month window points to around November 2026.

DORA for SaaS, Cloud, and Fintech: Where Do They Land?

Most cloud, SaaS, and managed service providers are not directly regulated by DORA, but their financial-sector customers often pass requirements down to them. Regulated fintechs are covered in their own right when they fall into a DORA-covered financial entity category.

How to Determine Whether DORA Applies to You

Use Akitra’s five-step DORA scoping check. Steps 1 to 3 decide whether DORA applies. Steps 4 and 5 show how far it reaches.

1. Identify your entity type. Check whether your organization falls into one of DORA’s covered financial-entity categories.
2. Confirm EU authorization or registration. DORA applicability starts with regulated financial activity in the EU.
3. Check exclusions and simplified treatment. Some smaller entities are excluded, while others follow simplified ICT risk rules.
4. Map critical or important functions. These are functions whose disruption would materially impair a financial entity’s performance, service continuity, or regulatory compliance.
5. Review ICT third-party relationships. Identify providers, subcontractors, and contracts that may need DORA alignment.

Common DORA Scoping Mistakes

• Assuming a non-EU headquarters exempts an EU-authorized subsidiary.
• Assuming “small” always means out of scope.
• Assuming vendors can ignore DORA because they are not directly regulated.
• Believing outsourcing transfers DORA accountability to the vendor.
• Assuming DORA and ISO 27001 are interchangeable. Some controls map across, but ISO 27001 does not replace DORA.

DORA Compliance Requirements: What to Do Once You Know It Applies

1. Document scope and ownership. Record the covered entity category, any exclusion or simplified treatment checked, critical or important functions, ICT dependencies, and responsible teams. Maintain a register of information using the Commission templates where required.
2. Move into compliance planning. Build a workplan for ICT risk management, incident reporting, resilience testing, third-party risk, contracts, evidence, and remediation. Use Akitra’s DORA compliance checklist to move from scope to execution.

How Akitra Can Help

Akitra Andromeda® helps teams map DORA requirements to controls, automate evidence collection, track ICT risks and remediation, and manage third-party risk through vendor workflows. This helps scope decisions turn into ongoing, documented compliance work across teams.

Conclusion

DORA applicability starts with entity type, EU authorization, and regulatory status. ICT dependencies, vendors, and critical or important functions then determine how far the requirements reach. For borderline or cross-border cases, confirm classification with your competent authority or legal counsel.

CTA: See how Akitra can simplify DORA readiness and ICT risk management. Request a demo.

Security, AI Risk Management, and Compliance with Akitra!

In the competitive landscape of SaaS businesses, trust is paramount amidst data breaches and privacy concerns. Akitra addresses this need with its leading Agentic AI-powered Compliance Automation platform. Our platform empowers customers to prevent sensitive data disclosure and mitigate risks, meeting the expectations of customers and partners in the rapidly evolving landscape of data security and compliance. Through automated evidence collection and continuous monitoring, paired with customizable policies, Akitra ensures organizations are compliance-ready for various frameworks such as SOC 1, SOC 2, HIPAA, GDPR, PCI DSS, ISO 27001, ISO 27701, ISO 27017, ISO 27018, ISO 9001, ISO 13485, ISO 42001, NIST 800-53, NIST 800-171, NIST AI RMF, FedRAMP, CCPA, CMMC, SOX ITGC, and more such as CIS AWS Foundations Benchmark, Australian ISM and Essential Eight etc. In addition, companies can use Akitra’s Risk Management product for overall risk management using quantitative methodologies such as Factorial Analysis of Information Risks (FAIR) and qualitative methods, including NIST-based for your company, Vulnerability Assessment and Pen Testing services, Third Party Vendor Risk Management, Trust Center, and AI-based Automated Questionnaire Response product to streamline and expedite security questionnaire response processes, delivering huge cost savings. Our compliance and security experts provide customized guidance to navigate the end-to-end compliance process confidently. Last but not least, we have also developed a resource hub called Akitra Academy, which offers easy-to-learn short video courses on security, compliance, and related topics of immense significance for today’s fast-growing companies.

Our solution offers substantial time and cost savings, including discounted audit fees, enabling fast and cost-effective compliance certification. Customers achieve continuous compliance as they grow, becoming certified under multiple frameworks through a single automation platform.

Build customer trust. Choose Akitra TODAY!‍To book your FREE DEMO, contact us right here.  

Frequently Asked Questions