What DORA means for financial institutions
DORA (Digital Operational Resilience Act, EU 2022/2554) has applied since January 2025 to all regulated financial institutions in the EU — banks, insurers, payment service providers, investment firms, crypto service providers and more. The core requirement: operational resilience must be demonstrable, not just documented.
DORA Art. 28: ICT third-party risk
Art. 28 DORA is the most demanding part in practice: all ICT third-party providers must be registered, assessed and continuously monitored. The register must be current at all times. Contracts must include security requirements and be reviewed regularly. Critical ICT providers are subject to heightened requirements and can be examined directly by the supervisory authority.
How 360TPRM satisfies DORA Art. 28
Darkscope 360TPRM is the only platform that fully covers DORA Art. 28: an automatic ICT third-party register with continuous monitoring, daily cyber intelligence assessment of all registered providers (dark web, CVEs, attack surface), automated risk categorization (critical / important / standard), contract management integration, supervisor-ready reporting and escalation paths for critical findings.
DORA fines and supervision
DORA violations can be penalized with up to 1% of average worldwide daily turnover — charged daily, until remediated. For credit institutions with billions in revenue, that can mean eight-figure fines per day. The EBA, EIOPA and ESMA oversee implementation and can order direct examinations of ICT third-party providers.