DORA Compliance Checklist for EU Fintechs

Who DORA applies to

DORA covers banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers and many other EU financial entities. It also reaches the ICT third-party providers that serve them. Obligations are proportionate to your size, risk and complexity, so a small fintech does not face the same burden as a large bank. Confirm your exact position with legal counsel.

Pillar 1: ICT risk management

1. Approve an ICT risk management framework at management-body level, and record who is accountable.
2. Maintain an inventory of ICT assets, information assets and the business functions they support.
3. Document policies for access control, change management, logging, backup and recovery.
4. Define and test business continuity and response and recovery plans.

Pillar 2: incident management and reporting

1. Define how ICT-related incidents are detected, classified and escalated.
2. Set criteria to identify major incidents and the reporting steps to your competent authority.
3. Keep records of incidents and root-cause analysis.
4. Prepare communication templates for customers and authorities.

Check the current technical standards for classification criteria and reporting timelines rather than relying on a summary.

Pillar 3: digital operational resilience testing

1. Run a risk-based testing programme at least annually, such as vulnerability assessments, scenario tests and penetration testing.
2. Track findings to closure.
3. If you are in scope for advanced threat-led penetration testing, plan it early, because it requires specific preparation.

See our penetration testing service for how this is scoped.

Pillar 4: third-party ICT risk

1. Keep a register of information covering all contractual arrangements with ICT providers.
2. Assess providers before onboarding and monitor them afterwards, including concentration risk.
3. Include the contractual provisions DORA expects: service descriptions, locations, security, incident support, audit and access rights, and termination rights.
4. Prepare exit and transition plans for critical providers.

If you are an ICT supplier to EU financial firms

You may not be directly regulated, but your customers must flow DORA requirements into your contracts. Expect questions about security evidence, incident notification, subcontractors, continuity and audit rights. A working ISMS answers many of them, so see our ISO 27001 page.

Where to start

Begin with a gap assessment against the four pillars and a register of your ICT providers. We can run the assessment, build the documentation and prepare your evidence. See our DORA page, or book a free advisory session. This article is general information, not legal advice. Fintechs can also read ISO 27001 for fintech companies, and teams handling personal data across the UK and EU should see UK GDPR vs EU GDPR.