DORA Scope Checker
Answer 4 questions to find out whether your organisation falls under the Digital Operational Resilience Act, which obligations apply, and what the maximum fine exposure is.
Question 1 of 4 · Article 2(1)
Is your organisation one of the following?
Credit institution, payment institution, electronic money institution, investment firm, insurance/reinsurance undertaking, crypto-asset service provider (CASP), central securities depository, central counterparty, trading venue, or trade repository.
Which organisations are in scope for DORA?
DORA (Regulation (EU) 2022/2554) applies to financial entities — banks, payment institutions, investment firms, insurance companies, crypto-asset service providers and others — as well as designated Critical ICT Third-Party Providers. Micro-enterprises (fewer than 10 employees and below €2M turnover) benefit from simplified obligations. Use this checker to confirm your entity type and the specific DORA pillars that apply.
- Credit institutions — banks, savings banks, credit unions
- Payment institutions and electronic money institutions
- Investment firms and management companies
- Insurance and reinsurance undertakings
- Crypto-asset service providers (CASPs) under MiCA
- Central securities depositories, central counterparties, trading venues
- Critical ICT third-party providers (CTPPs) — cloud, software, data vendors to financial entities
- Micro-enterprises (< 10 employees, < €2M) — simplified obligations only
DORA at a glance
- Regulation
- Regulation (EU) 2022/2554
- Applies from
- 17 January 2025
- Competent authority
- ESAs (EBA, ESMA, EIOPA) + national authorities
- Penalties (entity)
- Set per Member State (Art. 50) — no EU-wide cap
- CTPP penalty
- Up to 1% of avg daily worldwide turnover/day (Art. 35(6))
- TLPT frequency
- At least every 3 years for significant entities
- Incident reporting
- Initial: 4 hours; intermediate: 72 hours; final: 1 month (Art. 19)
Informational only — not legal advice. Consult qualified counsel for DORA applicability to your specific entity type and jurisdiction. Editorial policy. Last reviewed: .
Build your DORA Art. 28 third-party register
Assess ICT vendors, track contract renewal dates, and export your DORA register as CSV.
Open Vendor Workspace →