DORA: obligations, deadlines and what changes for cyber insurance in the financial sector

Fact sheet updated to 1 November 2026 on Regulation (EU) 2022/2554 (DORA) and Italian Legislative Decree 23/2025: who is in scope, ICT risk management, major incident reporting, critical ICT providers, fines and what it means for the cyber insurance of banks, insurers and intermediaries.

Regulatory fact sheet · updated 1 November 2026 · by cybercoverinsurance

Regulation (EU) 2022/2554, known as DORA (Digital Operational Resilience Act), has applied since 17 January 2025 to almost the entire European financial sector (EUR-Lex). Unlike NIS2 it is a regulation: it applies directly in every Member State, with no transposition. In Italy, Legislative Decree no. 23 of 10 March 2025 names the supervisory authorities and sets the fines (Diritto Bancario).

For those who take on cyber risk, DORA matters twice. It covers financial sector insureds, who must show measurable digital resilience. And it covers insurers themselves, which are supervised entities and must apply DORA to their own systems.

In the text, "Article" means a binding rule; "recital" means one of the introductory paragraphs that explain how to read it.

Who is in scope

Article 2 lists more than twenty categories of financial entities: banks, payment and e-money institutions, investment firms, crypto-asset service providers, fund managers, insurance and reinsurance undertakings, insurance intermediaries and pension funds. Small and medium-sized insurance intermediaries are excluded. DORA also reaches, through its own oversight regime, ICT providers designated as critical.

In Italy supervision is shared by Banca d'Italia, Consob, IVASS and COVIP, each for the entities it supervises; they also receive major incident reports (Article 3 of Legislative Decree 23/2025).

The main obligations

ICT risk management

Articles 5 to 16 require an ICT risk management framework approved by the management body, which bears final responsibility (Article 5). It covers asset identification, protection, detection, response and recovery, backup and business continuity plans.

Major incident reporting

An ICT incident classified as major must be reported to the competent authority in three steps (Article 19 and related technical standards) (FMA):

initial notification within 4 hours of classification as major and in any case within 24 hours of becoming aware of it;
intermediate report within 72 hours of the initial notification;
final report within one month of the latest intermediate report.

Classification criteria are in Delegated Regulation (EU) 2024/1772. A successful malicious access that may cause data loss is enough, together with an impact on critical services, to make an incident major.

Resilience testing

Every entity must test its systems periodically (Article 24). The most significant entities, identified by the authorities, must carry out threat-led penetration testing at least every three years, simulating a real attack on live systems (Article 26).

ICT providers

Every entity keeps a register of all its contracts with ICT providers and sends it to the authorities (Article 28). Contracts must include minimum clauses: service levels, audit rights, exit strategies and incident notification (Article 30).

On 18 November 2025 the three European supervisory authorities (EBA, EIOPA and ESMA) designated 19 critical ICT providers, which are now under direct European oversight (EIOPA). They include Amazon Web Services, Google Cloud and Microsoft; the others are data centre operators, telecom operators and specialist financial technology firms (TLT).

Fines

DORA leaves fines to Member States. In Italy, for banks and intermediaries supervised by Banca d'Italia, Legislative Decree 23/2025 sets fines from 30,000 euros up to 10% of turnover for the most serious breaches, and from 5,000 euros to 5 million euros for senior managers, with possible disqualification from management and control roles for six months to three years (Diritto Bancario).

DORA and NIS2

For financial entities DORA prevails over NIS2: it is the specific law for the sector. Banks and financial market infrastructures remain formally within NIS2, but apply DORA for risk management and incident reporting. A company outside the financial sector that supplies ICT services to banks or insurers may be subject to both: NIS2 in its own right, DORA through its contracts with financial clients.

What changes for cyber insurance

Reporting. Four hours from classification is tighter than NIS2's 24 hours. A financial insured needs an incident response service that starts immediately, with experts able to classify the incident under DORA criteria. A delay in classification becomes a regulatory issue, not only an operational one.

Fines. Amounts can reach 10% of turnover. As with NIS2, cover for administrative fines "where insurable by law" should not be taken for granted, and fines on senior managers shift part of the risk to the D&O policy.

Aggregation. The list of 19 critical providers is in effect a public map of the concentration points of the European financial sector. For a portfolio of financial insureds, the failure or compromise of one of these providers is the first damage scenario to model.

Underwriting information. DORA produces documents the insured already holds: register of ICT providers, resilience test results, continuity and provider exit plans. They are more structured than any underwriting questionnaire.

The insurer as a supervised entity. Insurers must also apply DORA to their own claims systems and providers. A critical provider shared by insurer and insureds creates a correlation to consider.

Impact for insurersHigh

DORA makes the digital resilience of banks, insurers and intermediaries measurable, and the list of critical ICT providers makes the aggregation points of the whole financial sector visible.