DORA: Scope and Entities

Status: Work in progress

DORA Article 1(2) is sector-specific EU law for financial entities also identified as essential/important under NIS2, within the equivalent obligations covered by NIS2 Article 4. It does not exempt all financial-sector suppliers from NIS2. An ICT supplier is subject to direct ESA oversight only if designated critical under Article 31; contractual requirements can affect other suppliers.

Who falls under DORA?

Financial entities (Art. 2)

DORA applies to a wide range of financial entities:

The table is a selection, not the full Article 2 list. Check Article 2(3) exclusions, including their precise thresholds and conditions, and Article 2(4) where the Member State exercises that option.

Category	Examples	Regulator
Credit institutions	Banks, savings banks	Authority designated under CRD; ECB for significant institutions within its SSM powers (Art. 46(a))
Payment institutions	Including payment institutions exempt under PSD2	National financial authority
Electronic money institutions	Separate category under Art. 2(1)(d), including exempt institutions	Competent authority under Art. 46(b)
Investment firms	Securities dealers	National financial authority
Insurance undertakings	Life and non-life insurance	National financial authority
Reinsurance undertakings	Reinsurance companies	National financial authority
Institutions for occupational retirement provision (IORPs)	IORPs with no more than 15 members across their pension schemes are excluded (Art. 2(3)(c))	Authority designated under Art. 47 of Directive (EU) 2016/2341 (DORA Art. 46(m))
Crypto-assets	CASPs (from MiCA)	National financial authority

For Czech jurisdiction, the Czech National Bank (CNB) is the competent authority for DORA and MiCA under Section 9 of Act No. 31/2025 Coll.. Apply this designation together with the allocation of powers in DORA Article 46, including the ECB’s SSM powers and the home/host authority rules for cross-border entities and IORPs. Oversight of designated critical ICT providers follows the separate framework below.

ICT Third-Party Providers

ICT third-party service providers are covered by Article 2(1)(u), but are not financial entities under Article 2(2). Direct oversight applies after designation as critical under Article 31, through one designated Lead Overseer (EBA, EIOPA or ESMA). Providers of the following services may be designated; the service type alone does not establish criticality:

Cloud service providers
Data analytics providers
Software vendors
Data centres

Article 31(8) excludes specified providers from designation, including ICT intra-group providers and providers supplying ICT services only in one Member State to financial entities operating only in that State. Apply all conditions and exclusions in Article 31.

Scope Assessment

Step 1: Identify entity type

[] Are we a financial entity under Art. 2?
[] Do we provide ICT services to financial entities?
[] Which Article 2(1) category and authorisation or exemption apply to us?

Step 2: Determine the regime

Article 16 is limited to the entity categories expressly listed there: small and non-interconnected investment firms, specified exempt payment/credit/e-money institutions and small occupational pension institutions. Small size, low ICT complexity or low systemic importance alone does not qualify an entity. Article 4 proportionality is a separate principle; Article 16 does not create a general exemption from reporting major ICT-related incidents under Article 19.

Step 3: Map ICT third parties

For each ICT provider:

Identify services
Assess whether the contracted service supports a critical or important function (Art. 28(3)–(4)); ESA designation of a critical provider is separate (Art. 31)
Record in the register
Verify contractual requirements

Simplified framework — Article 16

Record the exact entity type, authorisation/exemption and Article 16 provision. The regime replaces Articles 5–15 with its own ICT framework obligations; do not infer reduced reporting or arbitrary testing intervals merely from being small.

Next steps

Sources

DORA Regulation - Art. 2 (Scope)

Content reviewed: 6 September 2026. Primary sources: DORA, Incident reporting RTS — Art. 5, NIS2 — Art. 4.