Which fintechs fall under DORA?
DORA, Regulation (EU) 2022/2554, applies to around twenty types of financial entities listed in Article 2. For fintechs, the most common are payment institutions, electronic money institutions, investment firms, crypto-asset service providers authorised under MiCA, crowdfunding service providers and credit institutions. Smaller entities can use a simplified ICT risk-management framework under Article 16, but they are still in scope.
Technology companies that serve financial entities — cloud, software, data and managed service providers — are affected indirectly: their customers must include DORA requirements in contracts and keep a register of information on every ICT third-party arrangement.
What must a financial entity have in place under DORA?
- An ICT risk-management framework approved and overseen by the management body (Articles 5–16).
- A process to classify ICT-related incidents and report major incidents: initial notification within 4 hours of classification (and within 24 hours of awareness), an intermediate report within 72 hours and a final report within one month.
- A digital operational resilience testing programme; threat-led penetration testing at least every three years for entities selected by their authority.
- ICT third-party risk management, including contract clauses, exit strategies and the register of information (Articles 28–30).
- Optional participation in threat-intelligence sharing arrangements (Article 45).
How do DORA and ISO 27001 fit together?
DORA does not require ISO 27001 certification, but the two overlap heavily. ISO 27001 clauses 6 and 8 already require a risk assessment and treatment process, and Annex A covers incident management (5.24–5.28), supplier relationships (5.19–5.23), ICT readiness for business continuity (5.30), backups (8.13) and logging and monitoring (8.15–8.16). Building your DORA framework on an ISO 27001 ISMS means one control library, one evidence base and one audit trail.
| DORA pillar | Closest ISO 27001:2022 controls |
|---|---|
| ICT risk management | Clauses 6.1 and 8.2–8.3; 5.1 Policies; 5.9 Inventory of assets |
| Incident reporting | 5.24–5.28 Incident management |
| Resilience testing | 8.8 Technical vulnerabilities; 8.29 Security testing; 5.30 ICT readiness |
| ICT third-party risk | 5.19–5.23 Supplier relationships and cloud services |
| Information sharing | 5.7 Threat intelligence; 5.6 Contact with special interest groups |
How does ComplyPilot help fintechs with DORA?
ComplyPilot (EU compliance platform) ships a DORA framework organised by the five pillars, with a DORA advisor dashboard showing readiness per pillar. Each requirement links to controls, policies, risks and evidence — the same records you use for ISO 27001. The supplier module stores ICT providers with criticality and review frequency, which supports your register of information, and tasks track remediation owners and due dates.
For fintechs that also provide services to other financial entities, the same evidence answers their DORA due-diligence questions.
Frequently asked questions
Do small payment institutions have to comply with DORA?
Yes. Payment institutions are listed in DORA Article 2. Some small entities may use the simplified ICT risk-management framework in Article 16, but core obligations such as incident reporting still apply.
Does DORA require ISO 27001?
No. DORA does not mandate any certification, but an ISO 27001 ISMS covers much of DORA's ICT risk-management and incident-management expectations.
What is the DORA register of information?
A structured record of all contractual arrangements with ICT third-party service providers, which financial entities must maintain and provide to their competent authority on request.