EU Digital Operational Resilience Act (DORA)

DORA will apply to credit institutions, payment institutions, account information service providers, electronic money institutions, investment firms, crypto-asset service providers, central securities depositories, central counterparties, trading venues, trade repositories, managers of alternative investment funds, management companies, data reporting service providers, insurance and reinsurance undertakings, insurance intermediaries, reinsurance intermediaries, and ancillary insurance intermediaries, institutions for occupational retirement provision, credit rating agencies, administrators of critical benchmarks, crowdfunding service providers, securitization repositories, and ICT third-party service providers;

DORA will not apply to managers of alternative investment funds, insurance undertakings, institutions for occupational retirement schemes with less than 15 members, insurance intermediaries, and post office giro institutions;

Member states within the EU will name a competent authority to supervise the enforcement of DORA within their territories;

Member states will confer on competent authorities the power to apply the administrative penalties and remedial measures as per their national laws;

Where member states have chosen to lay down criminal penalties for breaches of this regulation, they shall ensure that appropriate measures are in place so that competent authorities have all the necessary powers to liaise with judicial, prosecuting, or criminal justice authorities within their jurisdiction to receive specific information related to criminal investigations or proceedings commenced for breaches of this regulation.