How is DORA enforced?

DORA is enforced by designated regulators in each EU member state, known as competent authorities.  These competent authorities can request that financial organisations implement specific security measures and remediate vulnerabilities.  Meanwhile, EU member states can impose penalties on organisations that fail to comply.  The nature of these penalties is decided by each member state.  

ICT service providers classified as critical by the European Commission are directly supervised by the European Supervisory Authorities (ESAs), which have similar powers to competent authorities (i.e., requesting the implementation of security measures and the remediation of vulnerabilities).  ESAs also have the power to fine non-compliant ICT service providers up to 1% of their average daily worldwide turnover.