---
url: https://eurocomply.app/regulations/dora/persona/sme-financial-entity
canonical: https://eurocomply.app/regulations/dora/persona/sme-financial-entity
title: DORA for Small Financial Entities — EuroComply
regulation: DORA
regulationNumber: (EU) 2022/2554
celex: 32022R2554
persona: Small Financial Entities
personaSlug: sme-financial-entity
inForceDate: 2023-01-16
applicationDate: 2025-01-17
sourceUrl: https://eur-lex.europa.eu/eli/reg/2022/2554/oj
lastReviewed: 2026-05-12
author: EuroComply Team
license: CC-BY-4.0
---

# DORA for Small Financial Entities

DORA applies a proportionality principle (Article 4): the depth and granularity of an entity's ICT risk-management framework should reflect its size, overall risk profile, and the nature, scale, and complexity of its services. Article 16 sets a simplified ICT risk-management framework for specific small or non-interconnected entities.

## Does DORA apply to small financial entities?

Yes — DORA does not exempt small financial entities. Article 4 introduces a proportionality principle and Article 16 a simplified ICT risk-management framework for small and non-interconnected entities. Microenterprises remain in scope.

**Key considerations:**

- Small and non-interconnected investment firms, payment institutions exempted under PSD2, and certain EMIs may use the simplified framework under Article 16
- Microenterprises (< 10 employees, ≤ €2m turnover or balance-sheet total) are not exempt — proportionality applies but not exemption
- The Register of Information (Article 28) applies regardless of size; only the granularity adapts
- Major-ICT-incident reporting timeline (Article 19): initial within 4 hours of classification, intermediate within 72 hours, final within 1 month

## Underlying DORA facts

**Full name:** Regulation (EU) 2022/2554 of the European Parliament and of the Council on digital operational resilience for the financial sector.

**Maximum fine:** CTPPs: up to 1% of average daily global turnover, applied daily for up to six months. Financial entities: per national law..

**Key dates:**

- 2023-01-16 — Entry into force (Article 64)
- 2025-01-17 — Direct application across the EU (Article 64(2))

## Recommended next step

[Check if DORA applies to your firm](https://eurocomply.app/decide/dora/in-scope)

## Related EuroComply resources

- Full DORA compliance guide: [/regulations/dora](https://eurocomply.app/regulations/dora)
- Markdown companion: [/regulations/dora.md](https://eurocomply.app/regulations/dora.md)

## Source

Authoritative text: [(EU) 2022/2554 — EUR-Lex](https://eur-lex.europa.eu/eli/reg/2022/2554/oj) (OJ L 333, 27.12.2022, p. 1–79).

---

Informational only. Not legal advice — consult qualified legal counsel.

Last reviewed: 2026-05-12 by the EuroComply Team. License: CC-BY-4.0.