The DORA Regulation - Final Countdown: Contracting Third Parties

The DORA Regulation

As of 17 January 2025, Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector ("DORA Regulation") will apply as a special law which, in cases of conflict, overrides Directive (EU) 2022/2555 of 14 December 2022 on measures for a high common level of cybersecurity across the Union. Entities covered by this Directive will continue to be subject to the resulting obligations.

This law covers a wide range of financial institutions¹ operating in the European Union (e.g. credit institutions, payment institutions, electronic money institutions) as well as third party ICT²service providers (e.g. cloud service providers). It has been in force since 16 January 2023 and is now mandatory.