{"id":44069,"date":"2026-08-07T15:37:58","date_gmt":"2026-08-07T13:37:58","guid":{"rendered":"https:\/\/smartfense.com\/?p=44069"},"modified":"2026-08-07T15:38:04","modified_gmt":"2026-08-07T13:38:04","slug":"who-does-dora-apply-to","status":"publish","type":"post","link":"https:\/\/smartfense.com\/en\/blog\/who-does-dora-apply-to\/","title":{"rendered":"Who does DORA apply to, and why no one will notify you"},"content":{"rendered":"

Regulation (EU) 2022\/2554, better known as DORA, was published on 27 December 2022 and has applied since 17 January 2025. What did not arrive with it was a list of addressees.<\/p>\n

The Spanish securities regulator CNMV states this plainly in its frequently asked questions on the DORA Regulation<\/a>. Asked whether any official register exists that would let a firm look up the entities within scope, the answer is no: it is each financial entity\u2019s own responsibility to determine whether DORA applies to it and to be proactive about compliance, rather than waiting for the authority to confirm that it is covered.<\/p>\n

That turns a task usually treated as a preliminary formality into the first real obligation. This piece does not walk through the five pillars of the regulation or cover digital operational resilience testing. It deals with who DORA applies to, who falls outside, and why the obligation ends up reaching technology providers that are not financial entities at all.<\/p>\n

Who does DORA apply to?<\/h2>\n

DORA is the European regulation that sets common digital operational resilience requirements for the financial sector. Article 2 lists the categories of financial entities within its scope, and the list is long.<\/p>\n

It takes in credit institutions, payment institutions and electronic money institutions, investment firms, crypto-asset service providers, central securities depositories, central counterparties, trading venues, management companies and alternative investment fund managers, insurance and reinsurance undertakings, insurance intermediaries, occupational pension funds, data reporting service providers and crowdfunding service providers.<\/p>\n

The geographic test is just as broad. The regulation covers financial entities offering services in the European Union, and branches remain covered as an integral part of the entity. Their systems fold into the parent\u2019s risk management framework, and their staff have to know the applicable security policies and take part in the corresponding training plans.<\/p>\n

Supervision, by contrast, is not centralised. It follows the existing split by entity type, so the authority that can ask you about DORA is the one that already supervises you. In Spain that means the Banco de Espa\u00f1a for credit institutions and payment and e-money institutions, the CNMV for investment firms, crypto-asset service providers, market infrastructures, management companies and data reporting or crowdfunding service providers, and the DGSFP for insurance and occupational pension funds. Third-party providers designated as critical sit under an additional European layer, the oversight framework of Articles 31 to 44.<\/p>\n

Who falls outside the scope?<\/h2>\n

There are express exclusions, and they are worth reading closely because they are narrow.<\/p>\n

Article 2(3)(a) leaves out the alternative investment fund managers referred to in Article 3(2) of Directive 2011\/61\/EU, provided the portfolios they manage do not exceed EUR 100 million in total, or EUR 500 million where those portfolios consist exclusively of unleveraged funds with no redemption rights exercisable for at least five years from initial investment. Those entities can still adopt the framework voluntarily, which is a reasonable call if they expect growth that would push them past the thresholds.<\/p>\n

Beyond cases like that, size is not an exit. Some entities, such as small and non-interconnected investment firms and microenterprises, fall under the simplified ICT risk management framework of Article 16, and Article 4 introduces the proportionality principle. Neither of those is an exemption. Proportionality scales the intensity of the measures to the risk profile and the complexity of the operations, not the list of articles that have to be met. For a sense of scale, the regulation treats a financial entity as a microenterprise when it employs fewer than ten people and its annual turnover or annual balance sheet total does not exceed EUR 2 million.<\/p>\n

Why your ICT provider is inside the perimeter too<\/h2>\n

This is the stretch of the perimeter that gets miscalculated most often. DORA defines ICT services deliberately broadly, as digital and data services provided through ICT systems to one or more users on an ongoing basis. Under that definition almost any platform a financial entity uses in daily operations enters the conversation, and the obligation reaches providers at three different intensities.<\/p>\n