DORA Scope and Financial Entities

DORA names categories of financial entities in the European Union and places duties on them for digital operational resilience, and it applies from 17 January 2025. The regulation also reaches ICT third-party providers, in defined ways, where they support financial entities, including through a dedicated oversight framework for providers identified as critical. Scope is therefore wider than a single firm's own staff and systems, yet narrower than the whole technology market, and the distinction matters for contracts, registers, and supervision.

A firm that wants to understand its own scope should start from its services rather than from an abstract list. Which services do customers rely on, which systems carry those services, and which outside providers sit behind them? Those questions reveal the entities and providers that DORA is concerned with far more reliably than a glance at a corporate chart.

DORA names a broad range of financial entities, including credit institutions, payment institutions, electronic money institutions, investment firms, insurers, and other regulated financial businesses, with the regulation itself setting out the categories and any limits. The breadth is deliberate, because digital disruption does not respect old sector boundaries: a payment, a trade, a claim, and a loan can all depend on similar systems, networks, and providers. At the same time, breadth does not mean uniformity. A category label tells a reader where to look in the regulation, but the practical duties still depend on the services involved, the risks they carry, and the proportionality principle explained in another guide in this cluster.

Group structures complicate scope in a useful way, because they expose how a service is really delivered. A service sold by one entity may be run on systems owned by a parent, supported by a sister company, or hosted by an outside provider, and DORA is interested in that delivery chain rather than in the sales label alone. Branches and shared service centres raise similar questions, since the entity that faces the customer may not be the entity that operates the system or holds the data. Mapping the service, entity by entity and system by system, is therefore a scope exercise in its own right, and it often surfaces dependencies that a purely legal reading would miss.

ICT third-party providers supply the systems, platforms, and services that financial entities rely on, from cloud hosting and data services to software and connectivity. DORA treats those providers as part of the resilience picture through the financial entity's own third-party risk duties, which include keeping a register of information, assessing risk before and during a relationship, and agreeing contractual terms that support oversight, audit, and exit. Separately, providers identified as critical under the regulation fall under a dedicated oversight framework, with a Lead Overseer arrangement. That framework does not turn every technology supplier into a regulated financial entity, but it does mean that the most systemically important providers face direct oversight attention.

Scope stops where the regulation stops naming an entity or a role, and that boundary deserves care. A technology company that sells a general product to many industries is not automatically a financial entity because a bank happens to buy its product, yet it may still be affected indirectly through the financial entity's contractual requirements and, where relevant, through the critical provider framework. Conversely, a firm that is outside DORA in its own right may still need to understand DORA if it wants to serve financial entities, because its customers will ask for information, cooperation, and contractual commitments that reflect their own duties. Scope, in other words, has both a direct edge and a practical shadow.

A practical scope map begins with a list of customer facing services, then adds the systems, data stores, and providers behind each service, and then checks each entity and provider against the categories and roles in DORA. The result should be readable by someone who was not involved in drawing it: a service, the entities behind it, the providers behind those entities, and the places where a question remains open. Open questions are normal, especially where a group or a provider arrangement is unusual, and they are more useful when they are named and dated than when they are smoothed over. A scope map that can be revised after a new service, a new provider, or a new standard is a working tool, whereas a scope map frozen at one moment soon becomes a historical document.