Share on LinkedInShare on LinkedIn

ARTICLE · 27 JANUARY 2025

Market Intelligence Thought Leadership Award Winner

DORA: Exemptions For Simplified ICT Risk Management And Beyond

Elias Neocleous & Co LLC
Elias Neocleous & Co LLC
Contributor
Elias Neocleous & Co LLC

Elias Neocleous & Co LLC

Elias Neocleous & Co LLC (ENC) is among the largest firms in southeast Europe and the Eastern...

View firm profile
Explore more from Elias Neocleous & Co LLC

The Digital Operational Resilience Act (DORA) is set to come into effect soon, reflecting the European Union (EU) regulators' efforts to strengthen the IT security of financial entities.

CyprusFinance and Banking
Emilios Charalambous
Emilios Charalambous
Author LinkedIn connections

The Digital Operational Resilience Act (DORA) is set to come into effect soon, reflecting the European Union (EU) regulators' efforts to strengthen the IT security of financial entities. This move addresses the finance sector's growing dependence on technology and on tech companies to deliver their services.

In our previous article, we explored how each financial entity is defined within DORA in order to better understand which firms fall under its scope. When reviewing these definitions, it is also vital to understand the exemptions under DORA—whether certain entities are entirely excluded from compliance or subject to simplified ICT risk management requirements.

Entities subjected to simplified ICT risk management:

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

MiCA’s Transition Ends On 1 July 2026. Is Your Crypto Business Authorised To Continue?

The EU's Markets in Crypto Assets Regulation (MiCA) transitional period expires on 1 July 2026, marking a critical deadline for crypto-asset service providers operating in Europe. Without proper MiCA authorisation by this date, businesses must cease operations and implement orderly wind-down procedures, as pending applications do not grant permission to continue providing services. This comprehensive analysis examines the regulatory requirements, compliance obligations, and strategic considerations for cryp
CyprusFinance and Banking
AGPLAW | A.G. Paphitis & Co. LLC
AGPLAW | A.G. Paphitis & Co. LLC
Article

Can Cyprus Become A True Fintech Banking Hub?

Cyprus is evolving from a jurisdiction that simply attracts fintech licenses to one building genuine European fintech infrastructure. With new regulatory frameworks including PSD3, DORA, and MiCA converging, the country faces a critical question: can it develop the banking relationships, payment systems access, and institutional depth required to transform licensed entities into a truly interconnected financial ecosystem?
CyprusFinance and Banking
AGPLAW | A.G. Paphitis & Co. LLC
AGPLAW | A.G. Paphitis & Co. LLC
Article

High-risk Business Incorporation: Structuring iGaming, Crypto And Adult Industry Companies The Right Way

Launching a high-risk business in sectors like iGaming, crypto, fintech, or adult entertainment requires strategic corporate structuring from the outset. This comprehensive guide examines how jurisdiction selection, ownership transparency, payment flows, and compliance preparation directly impact licensing approval, banking access, and long-term operational stability in heavily scrutinized industries.
CyprusFinance and Banking
Michael Chambers & Co LLC
Michael Chambers & Co LLC
Article

Jenec: The Limits Of Automatic De-Risking In EU Banking Law

On 11 June 2026, the Court of Justice of the European Union (the “Court”) delivered its judgment in Case C-81/24, Jenec. The case concerned the relationship between the right of access to a payment account with basic features under Directive 2014/92/EU (the “Payment Accounts Directive”) and the AML/CFT obligations imposed on financial institutions under Directive (EU) 2015/849 (the “AML Directive”).
CyprusFinance and Banking
Elias Neocleous & Co LLC
Elias Neocleous & Co LLC
Article

From Cybersecurity To Supply Chain Sovereignty In CSA2: The Spotlight On Suppliers

In January 2026, the European Commission unveiled its plan to overhaul the EU's Cybersecurity Act, a proposal now known as CSA2. It's the natural next step in a story that began years earlier with the EU's 2020 "5G Security Toolbox" - a set of voluntary recommendations encouraging Member States to be cautious about certain telecom suppliers. That voluntary approach produced patchy results: by most accounts, fewer than half of EU countries had actually acted on those recommendations. It is worth asking whether the adoption levels were however a failure of design, or a reflection of Member States reaching different conclusions about their risk exposures.
CyprusTechnology
Elias Neocleous & Co LLC
Elias Neocleous & Co LLC