Twenty categories, and the providers behind them
DORA covers around twenty categories of financial entity — banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers, crowdfunding platforms, trading venues, rating agencies and more — and the ICT third-party service providers serving them. It has applied since 17 January 2025.
Why it is like this
Financial regulation had treated technology as an outsourcing footnote. DORA makes operational resilience a prudential requirement in its own right, and extends the perimeter to the suppliers, because the risk had already moved there.
Not to be confused with
A banking regulation. The list reaches far beyond credit institutions, and it catches entities that have never had a prudential supervisor before — a crowdfunding platform is in scope on the same footing as a bank.
In practice
A handful of entities are carved out, among them certain small insurance intermediaries and institutions for occupational retirement provision below a size threshold — but the default for a regulated financial entity is in scope.
Source: Regulation (EU) 2022/2554 (DORA) — Art. 2 and Art. 64. Read on .
Odd one out Check yourself
Three of these are financial entities in scope of DORA. Which one is covered only as a third-party provider, if at all?
Show the answer
A cloud computing service provider
A cloud provider is not a financial entity. It is caught through the third-party chapter, and — if designated critical — through direct oversight.