Starting in January 2025, businesses in the financial sector in the European Union have a new piece of legislation to comply with: the Digital Operational Resilience Act (DORA). Building on earlier directives, DORA establishes a comprehensive framework of policies and rules aimed at strengthening cybersecurity and ensuring resilience against ever-evolving cyberthreats.
Below, we outline the most important DORA highlights and delve into specific examples of cybercrimes that financial organizations face in the digital age — threats that this new legislation aims to prevent.
What Is DORA?
DORA is short for the Digital Operational Resilience Act, a piece of EU legislation aimed at boosting cybersecurity and IT integrity. The act applies specifically to businesses and organizations in finance.
The goal of this regulation is to ensure all companies in this field have an actionable checklist of items to address to provide uninterrupted services and a high degree of security for the sensitive information they process.
The European Union signed DORA into effect in January 2023, giving the affected organizations two years to comply. As of January 17, 2025, all affected businesses must have ensured DORA compliance.
What Businesses Does DORA Affect?
DORA is mandatory for all EU businesses in the financial industry. This includes but is not limited to:
- Banks
- Insurance companies
- Investment firms
- Credit institutions
- Payment processing systems
- Financial brokerages and exchanges, etc.
Essentially, any EU-based financial entity must comply with DORA. Third parties providing critical services to European financial businesses also have to meet the DORA requirements in their dealings with the EU entity.
DORA Cheat Sheet
Why Does DORA Matter?
Previously, financial institutions had to draw on multiple separate directives, recommendations, and guidelines. Now, DORA presents a unified legal framework for IT security and resilience, combining points that used to be scattered across various directives.
Thus, the Digital Operational Resilience Act standardizes the steps financial businesses must take to safeguard the sensitive information users entrust to them. DORA aims to make companies more resilient to cyberthreats and prevent data leaks in the long term.
Financial institutions have been at the forefront of digitalization, catering to the growing demand for online services. As such, they work with many third-party software providers to facilitate their operations. These include ICT (Information and Communication Technology) tools such as CRM and CMS solutions, anti-malware and fraud detection software, trust service providers, and more.
DORA presents detailed, unified policies to help financial entities establish proper ICT risk management practices internally and in relation to third-party ICT service providers.
Key Areas in DORA Compliance
There are five core chapters of DORA that businesses need to consider to achieve compliance.
ICT Risk Management
The legislation offers in-depth guidance on how to evaluate ICT risk and prepare for potential cybersecurity threats. This includes protocols on the identification, detection, and prevention of attacks and building resilience within the organization to minimize risk.
DORA contains many articles outlining specific instructions and rules related to risk governance, prevention, detection, response, communication, and continuously building resilience as cyberthreats keep evolving.
ICT-Related Incidents
A substantial section of DORA concerns how financial organizations handle and report any ICT-related incidents that occur. There are more detailed breakdowns of various categories of incidents based on their severity and instructions on how to report them.
Reporting is of critical importance when it comes to attacks or known vulnerabilities. While an organization may be tempted to keep quiet to protect its reputation, it could be exposing its clients and interlinked partners to undisclosed risk. Transparency when reporting incidents is crucial for ensuring third-party software coming into touch with the affected business’s systems conducts its own inspection to see if it, too, was affected as a result.
Digital Operational Resilience Testing
According to DORA, financial organizations must conduct regular, thorough testing to ensure their operations are secure enough. Here the legislation outlines what tools and procedures need to be implemented to ensure testing is detailed to a highly satisfactory degree. The act also codifies specific requirements the testers must meet for the process to be compliant.
ICT Third-Party Risk Management
The Digital Operational Resilience Acts also discusses at length the risks related to working with third-party vendors and service providers.
Regulators have the added responsibility to define which third-party service providers are critical to the functioning of a business. Then, DORA compliance becomes mandatory for the providers of those services, even if they themselves are not in finance.
Information Sharing
Lastly, the legislation also outlines how different organizations should communicate amongst themselves about threats and ICT incidents. This framework of rules fosters more openness and a better exchange of information, which can allow organizations to learn from one another to achieve a higher level of preparedness and resilience.
Main Security Concerns in Finance
In 2025, it is no longer optional for banks and other financial organizations to provide their services online; it’s mandatory. Online services were the trend even before the pandemic, but the lockdowns further necessitated the creation of an online banking and payment infrastructure, and the world embraced it readily.
But the rapid digitization of the finance sector has also been matched by equally advanced new threats: cybersecurity attacks. As users’ bank accounts and wallets became digital, their most sensitive data and money is now stored online, tempting hackers to come up with ways of getting them.
It’s no longer just cybercriminals that financial organizations have to worry about. Hostile nations and governments might launch cyberattacks to compromise a rival country’s financial system to exploit or use as leverage. Terrorist organizations and even disgruntled insiders may leak data or disrupt services.
To better illustrate the primary dangers to online finance, here are the most common threats the sector faces.
Phishing Scams
In the financial context, phishing scams often present as fake emails or text messages impersonating a business or organization. They pretend to be legitimate by incorporating the company’s brand identity. The goal is to get the organization’s clients or employees to follow a dangerous URL, which then allows the cybercriminals to exploit the user’s or the organization’s data.
According to the Anti-Phishing Work Group, there were nearly a million phishing attacks in the third quarter of 2024 alone. What’s more, financial institutions were the third most targeted industry, with 13% of the attacks focused there. Payment services like PayPal were the fifth most affected sector.
Ransomware Attacks
Sometimes cybercriminals may hack a financial organization’s software infrastructure to impede services. Then, they ask for a hefty sum (think millions of euros) to ‘release’ their grip on the company’s data and allow its operations to resume normally. These are called ransomware attacks.
This cyberthreat is especially painful for businesses in finance. Due to the strict regulations in the sector, some organizations might opt to pay the ransom and keep the incident a secret from the public. This way, they can avoid paying higher fees to their regulator as punishment for letting the attack happen in the first place.
Companies that don’t report ICT attacks to their regulators, customers, partners, etc., are not in compliance with the regulations, because such behavior violates transparency rules. At the same time, an organization’s desire to save the brand’s reputation can be a strong motivator to avoid reporting such incidents. That is the risk cybercriminals strive to capitalize on with ransomware.
Sophos reports that in 2024, 59% of organizations globally experienced ransomware attacks. The average cost of the ransoms was 2 million USD. In the financial services industry, 65% of organizations were affected by ransomware attacks in 2024.
Injection Attacks
Whether it’s local files, SQL databases, or other types of information, this cyberthreat category refers to attacks where hackers inject the organization’s system with malicious code to take control of it. Unlike ransomware attacks, here the criminals do not ask for a ransom and directly exploit the data they gain access to.
Examples of injection attacks in finance include, for instance, the criminal plugging in malicious code in the login form and gaining unauthorized access to a user’s account and funds.
Distributed Denial-of-Service (DDoS) Attacks
Banks and other finance companies may find themselves unable to provide services to their customers if they experience a DDoS attack.
Microsoft states in its 2024 Digital Defense Report that businesses face a new threat – loop attacks. In Microsoft’s definition, this is a situation where cybercriminals target a “a critical weakness in application-layer protocols that rely on the User Datagram Protocol (UDP).” It forces the code to create a loop of errors that disables services in a way that is much more sophisticated and difficult to neutralize compared to traditional network attacks.
Supply Chain Attacks
Of special relevance when it comes to DORA are supply chain attacks. Here, the cybercriminals target third-party suppliers of services rather than the organization itself.
In other words, businesses may be vulnerable to attack if there are vulnerabilities in the third parties they work with. That is why, particularly in the cases where a third-party ICT provider is considered of critical importance, DORA compliance will also extend to them.
Qualified Trust Service Providers and DORA
Qualified Trust Service Providers (QTSPs), such as Evrotrust, equip financial organizations with software tools to enable secure remote identification and legally binding electronic signatures. Products such as our qualified electronic signature, eID, or eDelivery specifically are instrumental in allowing banks and other financial entities to sign contracts and interact with their customers online.
As a result, QTSPs may be classified as critical third-party ICT service providers under DORA, depending on the extent to which the financial institutions rely on their services. In other words, whether DORA applies to QTSPs or not depends on the specific service the financial organization relies on the QTSP for.
For instance, Bank A cannot provide access to online banking services to a customer it cannot identify with a high level of assurance. That’s why QTSPs may be of critical importance to some financial businesses, but it is not mandatory in all cases.
Consequently, where DORA classified a QTSP as critical to the functioning of a business, DORA rules will extend to it as well. Put simply, you can rest assured that Evrotrust is under the same legal supervision and similar digital operational resilience rules as your organization where critical functions are concerned. This helps ensure that we meet the same requirements and perform the same due diligence when it comes to cybersecurity.
Furthermore, under DORA we are also required to report any ICT incidents on our end if they occur. Thus, our partners can rely on greater transparency and assurances about enhanced security on our end, in line with all DORA articles that apply to third-party ICT service providers.
To learn how we can deliver highly secure, reliable, and regulation-compliant services to your organization, get in touch with our team.
Final Thoughts
The Digital Operational Resilience Act is now fully in effect for businesses in the finance industry and ICT third parties of critical importance to them. The act harmonizes older directives about cybersecurity and aims to create a more robust framework for the security of the sector and the unified European financial infrastructure as a whole. Thus, ensuring DORA compliance is a crucial step in keeping cyberthreats at bay and improving the safety and resilience of your business.
Frequently Asked Questions
What is DORA in the EU?
The term refers to Regulation EU 2022/2554, known as the Digital Operational Resilience Act. It offers a detailed legal framework for cybersecurity in the EU financial sector.
When does DORA come into effect?
Businesses had until January 17, 2025, to comply with the Digital Operational Resilience Act. The legislation is already into effect and businesses are liable for compliance.
Does DORA apply to non-EU companies?
Although this is European legislation, DORA also applies to non-EU companies offering critical ICT services to EU financial entities.
What are the consequences of non-compliance with DORA?
If your organization is not DORA compliant, regulators can impose hefty fines. The sum varies; depending on which is higher, the fine is either 2% of your company’s annual total turnover or 10 million euros.
Which regulator oversees DORA compliance?
This act is under the supervision of the European Supervisory Authorities (ESA). This regulator is the joint effort of the European Banking Authority (EBA), the European Insurance and Occupational Pensions Authority (EIOPA), and the European Securities and Markets Authority (ESMA).
