What it asks for. DORA applies to a defined list of financial entities, including credit institutions, payment and electronic money institutions, account information service providers, investment firms, crypto-asset service providers, central securities depositories, central counterparties, trading venues, trade repositories, fund managers, insurance and reinsurance undertakings, insurance intermediaries, occupational pension institutions, credit rating agencies, benchmark administrators, crowdfunding service providers and securitisation repositories. It also covers ICT third-party service providers through the oversight framework.
In practice. Certain entities are excluded, such as some small fund managers, small insurance undertakings and small occupational pension schemes, and micro, small or medium-sized insurance intermediaries, subject to conditions in the article. The regulation has applied since 17 January 2025. Organisations should document which legal entities are in scope, which competent authority supervises each, and whether proportionality or the simplified framework under Article 16 applies.
Common gaps. Groups sometimes overlook in-scope subsidiaries or assume DORA only affects banks, and ICT providers serving financial entities often underestimate the contractual obligations that flow down to them.