Precise Scope Determination for DORA Compliance
The DORA scope of application covers 20 types of financial entities, from credit institutions and insurers to crypto-asset service providers and ICT third-party providers.
The Digital Operational Resilience Act (DORA) defines a specific scope of application that encompasses various categories of financial institutions and their third-party providers. Precise scope determination is crucial for developing an effective compliance strategy and avoiding regulatory risks.
We offer comprehensive support in determining and managing the DORA scope of application. Our systematic approach ensures complete capture of all relevant entities and services as well as efficient implementation of corresponding compliance requirements.
6 service modules
Bookable individually or as an end-to-end programme.
Systematic analysis and classification of all entities within your organization to determine DORA applicability and specific requirements.
Comprehensive assessment of your third-party ecosystem to identify critical ICT services and their DORA implications.
Specialized analysis for international group structures to determine DORA applicability across different jurisdictions.
Building solid governance structures and processes for continuous management and monitoring of the DORA scope of application.
Establishment of systematic monitoring processes to ensure continuous currency and completeness of your DORA scope determination.
Comprehensive assessment of your current compliance position and identification of specific action areas based on your individual DORA scope.
5 phases
We develop a customized strategy with you for precise determination and continuous management of your DORA scope of application.
Your contact
Sarah Richter
Head of Information Security, Cyber Security
10+ years of experience, CISA, CISM, Lead Auditor, DORA, NIS2, BCM, Cyber and Information Security
Precise DORA scope determination is the foundation of every successful compliance strategy. Our systematic approach ensures that all relevant entities and dependencies are captured while developing practical and efficient implementation pathways.
Incomplete or incorrect scope determination can lead to significant compliance gaps. Especially with complex group structures and extensive third-party ecosystems, a systematic, documented approach is essential.
5 QUESTIONS, BRIEFLY ANSWERED
DORA covers nearly all regulated financial entities in the EU: credit institutions, investment firms, insurers, payment and e-money institutions, crypto-asset service providers, and other categories exhaustively listed in Article 2. Critical ICT third-party providers serving these entities also fall under direct EU oversight. Whether a specific entity is in scope should be checked against its actual license category, since the list is quite granular.
Yes, DORA includes a proportionality principle: small and non-complex entities can meet simplified requirements for certain elements of ICT risk management. This mainly affects the scope and frequency of some documentation and testing obligations, not the fundamental duty to implement DORA at all; there's no full exemption from DORA for regulated financial entities.
Only providers designated as critical by the EU supervisory authorities (the ESAs) are directly regulated, with their own direct oversight obligations. All other ICT third-party providers don't fall directly under DORA, but are indirectly affected, since their financial-entity customers must pass through contractual requirements from Articles 28‑30.
DORA generally applies per legally separate, regulated entity, not automatically to the entire group. Unregulated group companies only fall under DORA if they themselves provide a covered financial service or act as an internal ICT provider to regulated entities within the group, in which case the third-party requirements apply internally.
DORA doesn't provide an automatic transition period for entities newly entering scope, for example through a new license or growth past a threshold. In practice, implementation should be prepared in parallel with the licensing or approval process, since supervisors generally expect requirements to be met from the point of designation rather than after a grace period.
Our clients trust our expertise in digital transformation, compliance, and risk management
Schedule a strategic consultation with our experts now
30 Minutes • Non-binding • Immediately available
Direct hotline for decision-makers
Strategic inquiries via email
For complex inquiries or if you want to provide specific information in advance