DORA becomes applicable: digital resilience for banks and insurers

2025-01-17 · Publisher : Union européenne · Domain : Cloud & DevOps

The DORA regulation applies from 17 January 2025 to EU financial entities: ICT risk management, resilience testing, incident reporting and strict oversight of ICT providers, cloud included.

### Background Regulation (EU) 2022/2554, known as **DORA** (Digital Operational Resilience Act), which entered into force on 16 January 2023, becomes applicable on **17 January 2025**. It binds twenty types of financial entities (banks, insurers, investment firms, payment providers, crypto-asset providers) and, indirectly, their digital service providers. ### Key facts - Five pillars: ICT risk management, third-party risk, operational resilience testing, major incident reporting, oversight of critical providers. - The third-party pillar requires monitoring of external providers and contractual safeguards, including for cloud services. - A European oversight framework targets ICT providers of systemic importance, to address concentration risk on a small number of suppliers. - The text has 64 articles in 9 chapters, supplemented by technical standards and guidance from the European authorities. - Smaller entities benefit from relaxations under the proportionality principle. ### Why it matters For banks, insurers and their suppliers, DORA turns cloud clauses into regulatory obligations: audit, subcontracting, incidents, contract exit. IT services firms supporting financial clients must document architecture, dependencies and exit plans. The text also revived the debate on cloud market concentration, which the designation of critical providers in November 2025 made concrete. ### Takeaway From 17 January 2025, digital resilience and control of cloud providers are a legal obligation for the European financial sector.

Tags : Réglementation, Europe, Cloud, Sécurité, Hyperscaler