Which Organisations Does DORA Apply to?

DORA is applicable to a wide range of organisations in the financial sector, including banks, insurance companies, investment firms, pension companies and credit rating agencies.  If your organisation needs to be registered with a financial authority in Europe, it is quite likely that it is scope of DORA.  

DORA also applies to major third-party ICT service providers that support in-scope financial institutions.   The current understanding is that this only covers those organisations providing fundamental, significant services to multiple financial institutions, such as data centres, major services such as Microsoft Azure and Amazon Web Services (AWS), etc.  

As DORA is a piece of EU legislation, only organisations operating in the EU or ICT service providers that support financial organisations operating in the EU are in scope.