Key Aspects Of The EU's DORA Regulation According To Spain's CNMV

The Spanish National Markets and Securities Commission (Comisión Nacional del Mercado de Valores, or CNMV), has released a document compiling answers to some of the most frequently asked questions concerning the Digital Operational Resilience Act (DORA or the Act). Key elements of the document –which considers best practices, cybersecurity standards, Delegated Regulations 2024/1772¹ and 2025/301², and Implementing Regulation 2025/302³ (which develop regulatory and implementation technical provisions)– are summarised below.

1. Scope and proportionality

The CNMV notes that there is no national register of DORA subjects, and that financial entities are responsible for assessing, on a proactive basis, whether and how DORA applies to their activities. However, the authority clarifies that the DORA applies to various CNMV-supervised financial entities including investment firms, crypto‑asset service providers, market infrastructures, management companies, alternative