DORA in plain English
DORA stands for the Digital Operational Resilience Act. It is an EU law about keeping financial services resilient when technology fails or a cyber incident occurs. It has applied since 17 January 2025.
For customers, the issue is simple: can they make a payment, reach their account or use the service they need? For firms, the work involves understanding the systems and suppliers behind those services, preparing for disruption and checking that the response works.
Does it apply to a UK business?
Being a UK business does not answer the question on its own. Check the legal entity, the financial activities and the services involved. An EU financial entity within DORA’s scope has direct duties. A UK technology supplier may face contract requirements from an EU financial customer. These are different positions.
Do not assume that every UK firm, branch or supplier is directly covered. UK financial firms must also consider the separate UK requirements that apply to them. Start with a clear scope assessment before choosing a compliance programme.
What does DORA cover?
- Technology risk: understanding threats, protecting systems and assigning responsibility.
- Incident reporting: identifying and reporting major technology incidents under the applicable rules.
- Resilience testing: checking how systems and response arrangements perform.
- Supplier risk: assessing technology providers, maintaining required records and setting suitable contract terms.
ICT means information and communication technology. In everyday terms, it includes the systems and technology services used to run the business. The detailed requirements vary, so the list above is a starting point rather than a complete checklist.
What does this mean for suppliers?
A financial customer may ask how you protect its service, who supports it and how quickly you can share information about an incident. It may need evidence for its own assessment, testing and reporting duties.
Check the actual contract and service requirements. There is no single notification promise or testing arrangement that should be copied into every supplier contract. Agree practical contacts, responsibilities and escalation steps. Make sure your team can meet them outside normal office hours where required.
Turn the requirements into useful work
Start with the services customers depend on. Identify the technology and providers behind them, including important shared dependencies. Record the risks, evidence and open actions. Give each action an owner and deadline.
Then test a realistic situation. For example, what would happen if a key provider stopped responding during a payment outage? Who would make decisions, contact the provider and keep customers informed? Use the exercise to find gaps and improve the plan.
How Logica helps
We help financial firms and their teams understand the gaps, organise supplier evidence and turn requirements into practical steps. The work can connect security, risk, compliance and delivery teams around the same priorities. Your organisation keeps responsibility for its decisions.
Explore our DORA guide or supplier-risk support.
Check the source requirements
Use the ESMA DORA overview and linked rules for EU requirements. For UK firms, also check the FCA’s operational resilience guidance and your firm’s applicable rules.