DORA update: the sector is making progress, but some areas require attention

Strong improvement in input for information registersregisters of information

The number of registers approved by the European Banking Authority rose from 40% in 2025 to 94% in 2026. We suspect this is because firms now have a better understanding of how to enter information in the register and how the required format works. Nevertheless, they must continue paying attention to the quality of the register and the underlying data, to ensure that future requests for information can be processed smoothly and efficiently. 

Vigilance with regard to procedures and policies

We also call on firms to assess at regular intervals whether their organisation remains fully compliant with the DORA requirements. Supervisory reviews show that not all firms have all the required policy documents and procedures, or that these do not comply fully with the regulations. Firms should therefore check whether their ICT risk management, policies, and procedures are up to date and reflect day-to-day practice.  

Firms that use policies and procedures drawn up at group level must check for themselves whether all relevant DORA requirements have been fully incorporated into those documents and procedures. This is because the financial entity subject to DORA (licensee) remains responsible at all times for compliance with the DORA requirements. 

Number of incident reports lower than expected

Another area requiring attention is the incident process. The number of DORA incident reports received has been lower than expected. Firms must ensure that incidents are promptly detected, classified and,  where quired, reported within the statutory time limits. 

Clarity concerning insurance intermediaries

The ESAs provided more clarity regarding the method to be used to calculate thresholds where insurance intermediaries have a very limited activity dedicated to the insurance business. There is now also greater clarity with regard to the calculation of thresholds within group structures. Firms should therefore check whether the recent Q&As have implications for their organisation.

More information

DORA update 7 (pdf, 220 kB)