DORA and digital resilience.

DORA is Regulation (EU) 2022/2554 (the Digital Operational Resilience Act). It sets uniform requirements for ICT risk management and digital resilience of financial entities and has applied directly since 17 January 2025. DORA is accompanied by Directive (EU) 2022/2556, which amends various sectoral directives; in the Netherlands those amendments are transposed into the Wft (Dutch Financial Supervision Act). As lex specialis, DORA takes precedence over the more general ICT and outsourcing provisions in the sectoral frameworks.

DORA covers a broad range of financial entities: banks, payment institutions, e-money institutions, investment firms, crypto-asset service providers (CASPs), (re)insurers, fund managers and more. It also reaches ICT third-party service providers that supply these entities, with a dedicated EU Oversight framework for providers designated as critical (CTPPs).

(1) ICT risk management (Art. 5–16) — governance and a documented risk-management framework, with a simplified regime for smaller entities. (2) ICT-incident management, classification and reporting (Art. 17–23). (3) Digital operational resilience testing (Art. 24–27), including Threat-Led Penetration Testing for significant entities. (4) ICT third-party risk management (Art. 28–44), with minimum contractual terms, the register of information and the Oversight framework. (5) Information sharing on cyber threats (Art. 45).

Financial entities must classify and report major ICT-related incidents to the competent authority (DNB or the AFM in the Netherlands); significant cyber threats may be reported voluntarily. Classification criteria are set out in CDR (EU) 2024/1772, content and reporting deadlines in CDR (EU) 2025/301, and the forms/templates in CIR (EU) 2025/302.

TLPT is an advanced, threat-led resilience test that DORA requires for entities designated as significant (Art. 26–27). It simulates realistic attack scenarios against live production systems and aligns with the European TIBER framework. The detail is set out in the TLPT RTS, CDR (EU) 2025/1190.

DORA sets minimum contractual terms for agreements with ICT providers and requires a register of information covering all ICT contractual arrangements. ICT third-party providers designated as critical (CTPPs) are subject to an EU-wide Oversight framework. Detail is provided in, among others, CDR (EU) 2024/1773 (policy), CIR (EU) 2024/2956 (register templates) and CDR (EU) 2025/532 (subcontracting of critical or important functions).

NIS2 (Directive (EU) 2022/2555) and the CER Directive (EU) 2022/2557 are broader cyber and resilience frameworks; for financial entities DORA is the specific lex specialis and prevails. DORA’s ICT third-party regime likewise takes precedence over general outsourcing guidance for ICT services. For non-ICT services the EBA published new guidelines on the management of third-party risk on 18 September 2026 (EBA/GL/2026/09), which will replace the 2019 outsourcing guidelines once they apply; they also cover payment institutions, e-money institutions and investment firms and provide a two-year transitional period for existing critical or important arrangements.

In DORA update 7 (6 August 2026) the AFM reports that the share of approved registers of information rose from 40 percent in 2025 to 94 percent in 2026, that incident notifications are lower than expected and that policy documentation is sometimes incomplete; group procedures must cover all obligations of the Dutch entity. On 29 September 2026 the AFM asked asset managers to strengthen ICT recovery: classification of critical functions, recovery objectives, arrangements with ICT providers and testing of extreme scenarios.

In the Netherlands DORA is enforced by DNB and the AFM within their respective remits. As a regulation it applies directly; the amendments from Directive 2022/2556 have been incorporated into the Wft. DNB and the AFM have set up data requests and reporting obligations, including around the register of information.

On 18 November 2025 the European Supervisory Authorities designated the first 19 critical ICT third-party providers, including AWS, Microsoft, Google Cloud, Oracle, SAP and Deutsche Telekom. Each CTPP is assigned a Lead Overseer (EBA, ESMA or EIOPA) that can request information, conduct investigations and inspections, and issue binding recommendations on ICT security, subcontracting and data location, among other things. For financial entities their own responsibility is unchanged: third-party risk management remains with the institution itself.

Every financial entity must maintain a register of all contractual arrangements with ICT third-party providers, covering criticality of functions, subcontractors and exit options, among other things. The register is submitted annually to the ESAs via DNB or the AFM using the fixed templates from the implementing regulation; data quality (LEIs, function identification, consistency) is the main stumbling block.