Who does DORA apply to: how to tell if your entity is in scope and what it must deliver
By Kike Gandia · Co-Founder & CEO, OSCP
DORA has applied since January 2025 and its scope is far broader than many entities assume. It does not cover banks alone: it reaches insurers, fund managers, crypto-asset service providers, payment institutions and, through the supply chain, the ICT providers serving them. This guide answers the question any security lead asks first — whether it applies and what has to be delivered — before getting into the technical detail of the regulation.
The 20 categories of entity that fall in scope
Article 2 of Regulation (EU) 2022/2554 lists the financial entities in scope. Grouped by family:
Banking and payments. Credit institutions, payment institutions, electronic money institutions and account information service providers.
Investment and markets. Investment firms, alternative investment fund managers, UCITS management companies, central securities depositories, central counterparties, trading venues and trade repositories.
Insurance and pensions. Insurance and reinsurance undertakings, insurance intermediaries and institutions for occupational retirement provision.
Crypto-assets. Crypto-asset service providers authorized under MiCA and issuers of asset-referenced tokens.
Others. Credit rating agencies, benchmark administrators, crowdfunding service providers and securitization repositories.
ICT providers. ICT third-party service providers are not financial entities, but DORA reaches them contractually, and those designated as critical also come under direct European oversight.
The most common miscalculation: assuming size exempts you
DORA applies the principle of proportionality, not an exemption by size. Being small does not take an entity out of scope: it changes what is required, not whether anything is required.
Microenterprises and certain smaller entities may use a simplified ICT risk management framework, with fewer formal requirements. They still have to identify their critical functions, manage ICT risk, report major incidents and maintain a testing program.
There are specific, narrow exclusions — certain very small institutions for occupational retirement provision, some insurance intermediaries that are microenterprises — but they are exhaustively listed exceptions, not a general size rule. Checking them against the text is faster than assuming they apply.
What your entity has to deliver, block by block
DORA is structured around five blocks of obligations. Every entity in scope answers to all five, with differing intensity.
| Block | What it requires | Who |
|---|---|---|
| ICT risk management | Documented framework, critical functions identified, governance with management body involvement | All |
| Incident reporting | Classification and reporting of major incidents to the competent authority within set deadlines | All |
| Resilience testing | Periodic testing program covering systems that support critical functions | All |
| Advanced testing (TLPT) | Threat-led red teaming, at least every three years | Designated entities only |
| Third-party risk | Register of ICT providers, minimum contractual clauses, exit strategy | All |
The distinction between the two testing rows is where most entities get it wrong. Everyone needs the general testing program; TLPT is only required of entities the competent authority designates by size, risk profile and relevance.
How to check in an afternoon whether it applies to you
Four questions, in order, settle the case for most entities.
1. Is your activity on the Article 2 list? If your entity holds an EU financial authorization — banking, payments, insurance, investment or MiCA — the answer is almost always yes.
2. Does a specific exclusion apply? Check the regulation's narrow exceptions instead of assuming that being small is enough.
3. Can you use the simplified framework? If you are a microenterprise or a smaller entity under the regulation's criteria, your obligations get lighter, but they do not disappear.
4. Has your competent authority designated you for advanced testing? In Spain the competent authority is the Banco de España, the CNMV or the DGSFP depending on entity type, and the reference framework for those tests is TIBER-ES, the Spanish implementation of TIBER-EU. The authority notifies this designation formally. If you have not received it, you are not subject to TLPT, but you are subject to the general testing program.
If you are an ICT provider rather than a financial entity, the question changes: DORA does not apply to you directly, but your financial clients will pass their requirements down to you by contract, and that arrives well before any supervisor does.
DORA and NIS2: where they overlap and which one prevails
Financial entities often ask whether both regimes apply at once. The practical rule is that DORA is lex specialis for the financial sector: on ICT risk management and incident reporting it prevails over NIS2 for the entities it covers.
That does not remove NIS2 from the map. A group can have financial subsidiaries under DORA and subsidiaries in other sectors under NIS2, with different reporting frameworks coexisting. And the ICT providers serving those entities may fall under NIS2 through their own activity, on top of the contractual obligations reaching them via DORA.
If your organization sits in that overlap, map the common controls once and document separately only what each regime specifically demands. Duplicating whole frameworks multiplies cost without adding compliance.
FAQ
Does DORA only apply to banks?
No. The scope covers around twenty categories of financial entity, among them insurers, fund managers, investment firms, payment and electronic money institutions, crypto-asset service providers and market infrastructures. Banks are one part of the scope, not the whole of it.
My company is small. Does it fall outside DORA?
Size does not exempt you as a general rule: it triggers the principle of proportionality. Microenterprises and certain small entities may use a simplified ICT risk management framework, but they are still required to manage risk, report major incidents and test their systems. Specific exclusions exist, but they are narrowly defined.
We supply software to a bank. Does DORA apply to us?
Not directly, unless you are designated a critical ICT third-party provider, in which case you come under direct European oversight. What always happens is that your financial clients will pass down the minimum clauses DORA requires of them: audit rights, service levels, incident notification and an exit strategy.
Are we required to carry out a TLPT?
Only if your competent authority designates you for advanced testing, based on size, risk profile and relevance. In Spain that authority is the Banco de España, the CNMV or the DGSFP depending on entity type, and the applicable framework is TIBER-ES. The other entities in scope must maintain a resilience testing program, but not necessarily a TLPT.
What happens if both DORA and NIS2 apply to us?
For the financial entities it covers, DORA acts as lex specialis and prevails over NIS2 on ICT risk management and incident reporting. In groups with subsidiaries across several sectors both frameworks can coexist, and it makes sense to map the common controls once rather than duplicate programs.
Since when has DORA been enforceable?
The regulation has applied since January 17, 2025. There is no additional transition period: the obligations are enforceable and competent authorities can already request evidence of the ICT risk management framework and the testing program.