Fintech

DORA for fintechs: building a proportionate resilience programme

Most fintechs are assembled from a handful of ICT providers: cloud, payments, KYC, core banking. That dependency is precisely what DORA regulates. Regulation (EU) 2022/2554 has applied since 17 January 2025, with no transition period. This page sets out the obligations that weigh most on a young financial entity, and the order in which to tackle them.

By Younes Lahrach, data protection specialist and external DPO, director of Sila International Advisory. First published on , last reviewed against the texts on .

Why DORA bites harder on fintechs

A fintech's business model is to orchestrate third-party services. The flip side is concentration risk on a few providers, often outside the EU. DORA does not prohibit this. It requires the dependency to be known, documented and controlled by contract.

The Regulation attaches to the licence, not to company size. A twenty-person payment institution is subject to the same articles as a banking group; the difference comes through proportionality under Article 4 and, for some entities, the simplified framework of Article 16.

Core obligations

Governance, Article 5

The management body defines, approves and is accountable for the ICT risk management framework. It cannot be delegated to the engineering team.

ICT risk management, Articles 6 to 15

Identification of assets and functions, protection, detection, response and recovery, backups and communication.

Major incidents, Articles 17 to 19

Classification and reporting to the competent authority. Delegated Regulation (EU) 2025/301 requires the initial notification within 4 hours of classifying the incident as major and no later than 24 hours after becoming aware of it.

Testing, Articles 24 to 27

A testing programme, with at least yearly tests of systems supporting critical or important functions. Threat-led penetration testing every three years applies only to entities identified by the authority.

ICT third parties, Articles 28 to 30

A register of information covering every ICT arrangement (Article 28(3)) and mandatory contractual provisions (Article 30), with an extended set for critical or important functions.

Simplified framework and proportionality

Article 16 sets a simplified ICT risk framework for a closed list of entities, including payment and e-money institutions exempted under their sectoral directives and small, non-interconnected investment firms. A fully authorised fintech with no exemption does not qualify.

Proportionality under Article 4 applies to everyone and scales the intensity of measures to size, risk profile and complexity. It removes no obligation. Your exact position under Article 16 should be checked against your licence or exemption decision.

What is at stake

DORA leaves administrative penalties and remedial measures to Member States (Article 50). For a fintech, the main exposure is supervisory: orders from the authority, friction when extending a licence, and scrutiny from partner banks running their own third-party reviews.

There is a commercial angle too. Regulated clients that use you as an ICT provider must record your contract in their register and include the Article 30 clauses. A non-compliant template slows every deal.

Sila's approach

Register first, because it shows which contracts and functions are critical. Contracts next, handling DORA Article 30 and GDPR Article 28 in a single pass. Incident procedure last, aligned with personal data breach notification under GDPR Article 33, which has a different deadline and recipient.

Sila acts as legal and regulatory adviser. Technical testing and security tooling stay with your teams or specialist providers; we frame what is required and how it is documented.

Watch list: a single incident reporting point

On 19 November 2025 the Commission proposed, in a digital omnibus separate from the AI one, a single entry point for incident reports under NIS2, the GDPR and DORA. At the review date of this page the text has not been adopted and DORA's obligations are unchanged. The Council adopted its position on 21 October 2026, replacing the EU-level entry point with national entry points; the European Parliament had not yet adopted its own at that date.

The method, in four steps

  1. 01Gap assessment

    Establishing whether, and on what basis, the instrument applies to the activity as it is actually carried out, then comparing what the instrument requires against what already exists inside the organisation. The assessment ends with a ranked list of gaps, not an overall score. An organisation that falls outside the scope learns so at this stage, and the engagement stops there.

  2. 02Mapping

    Recording what the measures will apply to: processing activities and data flows, systems, service providers, contracts in force, roles and responsibilities. The map is the working document for everything that follows, and it is the document produced to a supervisory authority in the event of an inspection.

  3. 03Technical and organisational measures

    Implementing the measures the mapping has shown to be necessary: internal procedures, policies, contractual clauses to be renegotiated with providers, governance decisions, and training for the people concerned. Measures that sit inside the information system are specified by Sila and implemented by your own teams or your IT provider.

  4. 04Evidence file

    Assembling the file that can be produced to a supervisory authority: records, impact assessments, dated and versioned policies, decision trails, proof of training. Compliance is not demonstrated by the absence of an incident but by the production of this file, which means it has to be kept current once the engagement ends.

A tailored quotation within 48 hours

The scope of an engagement cannot be guessed at: it depends on whether and how the instrument applies to you, on the number of processing activities, systems and contracts involved, and on what already exists inside your organisation. No amount is therefore published on this site.

The process starts with a scoping discussion, at no charge and without commitment, to define what the engagement will cover. A tailored quotation follows within 48 hours, setting out the scope, the deliverables and the amount.

What this means for you

  • Your management body is accountable for the ICT risk framework.
  • Every ICT contract belongs in the register and needs the Article 30 clauses.
  • Major incidents are reported in hours, not days.
  • Your regulated clients will ask you for the same contractual guarantees.

Assess your DORA exposure

A first call qualifies your entity under Articles 2 and 16 and identifies which contracts to reopen first.

Book a call

Frequently asked questions

Is an early-stage fintech caught by DORA?

Yes, as soon as it is authorised in one of the categories in Article 2(1) of Regulation (EU) 2022/2554. Size does not take you out of scope; it affects proportionality (Article 4) and, for certain exempted entities, access to the simplified framework of Article 16.

Does my cloud provider have to comply with DORA?

An ICT provider is directly supervised only if designated critical at EU level (Article 31). It is your responsibility to secure the Article 30 clauses in your contract and record the arrangement in your Article 28(3) register.

How quickly must a major incident be reported?

Under Article 5 of Delegated Regulation (EU) 2025/301, the initial notification is due within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it.

Does DORA replace GDPR breach notification?

No. An ICT incident affecting personal data may require both a DORA report to the financial authority and a breach notification to the data protection authority under GDPR Article 33. The two procedures must be aligned.

Is threat-led penetration testing mandatory?

Only for entities identified by the competent authority under the criteria of Article 26. The testing programme of Article 24 applies to all entities, with at least yearly tests for systems supporting critical or important functions.

What this regime triggers elsewhere

Eight questions to place your company against the GDPR, the AI Act, NIS2 and DORA.

Exposure check: which EU rules apply to you

The reference page on Regulation (EU) 2022/2554, article by article.

DORA: the ICT register and contractual clauses

GDPR Article 28 clauses are negotiated in the same contracts as DORA Article 30.

GDPR obligations

NIS2 Article 4 gives way to DORA for financial entities, without exempting other activities.

NIS2 and financial entities

About the author

Younes Lahrach is the founder and director of Sila International Advisory. A GDPR legal consultant and external data protection officer since July 2025, he holds a Master's degree (M2) in European Union law, specialising in data protection, from the University of Lille, and an MBA in International Finance from Middlesex University. He is a legal consultant, not a lawyer (avocat).

His background →

Reference texts

The information on this page is general in nature and does not constitute legal advice on a specific situation. Sila is not a law firm and does not provide representation before the courts.