DORA requirements: Which roles financial entities need

What requirements does DORA impose?

DORA, Regulation (EU) 2022/2554 on digital operational resilience for the financial sector, came into force in 2023 and has applied since 17 January 2025. The German accompanying legislation, the Financial Market Digitalisation Act (FinmadiG), supplements responsibilities and broadens the scope of application. Since early 2025, internal audit, statutory auditors, BaFin, and the European supervisory authorities have also been reviewing whether institutions are genuinely meeting the requirements.

In terms of content, the Regulation bundles obligations into five pillars:

• ICT risk management: a framework of strategies, policies, procedures, and controls overseen by the management body

• ICT incident management: detecting, classifying, and reporting major incidents to supervisors

• Digital operational resilience testing: regular testing, with threat-led penetration testing for selected institutions

• ICT third-party risk management: minimum contractual requirements, registers, and governance of all ICT service providers

• Oversight framework for critical ICT third-party service providers: direct supervision of systemically important providers

Two points turn DORA into a staffing issue. First, the management body bears ultimate responsibility for ICT risk management, defines and oversees the framework, and its members must actively keep their ICT skills up to date (Art. 5 DORA). Second, the required resilience strategy goes deeper into substantive matters than the previous IT strategy under BAIT, while sectoral outsourcing rules like MaRisk continue to apply in parallel.

The hook for the budget: FinmadiG classifies violations as administrative offences, carrying fines of up to five million euros. This is not legal advice, but rather the benchmark scale against which you should align your role planning for 2026.

Who is covered by DORA?

Article 2(1) DORA defines who must meet the requirements; exceptions are set out in Article 2(3) in conjunction with Article 3. The catalogue covers almost the entire financial sector:

• Credit institutions

• Payment institutions

• Investment firms and trading venues

• Insurance and reinsurance undertakings

• Crypto-asset service providers

• Institutions for occupational retirement provision and data reporting services

For payment institutions and licensed fintechs, this means DORA applies even if the team is small. The specific obligations depend on an institution's size and interconnectedness; we clarify the exemptions for micro and small institutions in detail below.

The second group comprises ICT third-party service providers. While they are not supervised as financial entities, they are held accountable via the contractual minimum contents under Article 30: cloud services, IT consulting, data processing, and hardware services all fall under this, and providers classified as critical are additionally subject to direct oversight by the European authorities. A nuance: if a supervised financial entity provides a regulated financial service to another, this does not count as an ICT service in terms of third-party risk management (Art. 3 DORA). Anyone serving banks as a fintech should understand this distinction before building registers and contracts around it.

In Germany, the FinmadiG extends the scope of application to insurance holding companies and institutions under Section 1(1b) of the German Banking Act (KWG). Non-CRR KWG institutions only need to implement the simplified ICT risk management framework under Article 16 instead of the standard framework in Articles 5 to 15, do not have to perform threat-led penetration tests, and can skip third-party obligations if they qualify as microenterprises. These obligations apply from 1 January 2027, though reporting requirements have already been active since 17 January 2025.

What roles are needed to implement DORA?

DORA doesn’t prescribe organisational charts, but it does mandate responsibilities. Once you assign each pillar to a named individual, you have your hiring profile. KPMG's benchmark study highlights where firms across the board are struggling: governance structures are mostly in place, but third-party governance, testing, and operational evidence suffer from a lack of staff and documentation.

Governance and ICT risk control

The framework is the responsibility of an independent control function, typically a risk or compliance manager with DORA knowledge (Art. 6(4) DORA). The profile demands regulatory depth beyond DORA, MaRisk, ZAG, and KWG, along with enough of a payments background to identify critical functions within the business model. In addition, there is documentation: each contractual relationship requires a designated contact person, and contracts including SLAs must be versioned and centrally available (Art. 30 DORA).

ICT third-party management

This is where the heaviest workload arises. A vast number of existing ICT contracts do not meet the stricter requirements and must be updated—often hundreds of contracts per institution in practice. What organisations are looking for are profiles that blend contract management, vendor management, and ICT literacy; we have outlined how to find and hire a GRC manager in a separate post.

Information security and incident management

Testing, classification, and reporting require security engineering close to the CISO role: a risk-based testing programme, threat-led penetration testing at least every three years for selected institutions, and initial, intermediate, and final reports in the event of major incidents (Art. 19(4) DORA). This is precisely where the talent market is stretched: the Lünendonk study with KPMG paints the same picture: 97 per cent of surveyed financial firms consider digital resilience important, but only 12 per cent rate their own maturity level as very high. We compare options from permanent hires to vCISOs in the linked article on the CISO role.

Build in-house or hire externally?

The decision comes down to three criteria. First, continuity: the ICT risk management framework isn't a project with an end date, but rather ongoing governance—core roles belong in permanent employment. Second, accountability: you can buy in capacity, but ensuring ICT risk management remains entirely the institution's responsibility (Art. 6(10) DORA). Third, proportionality: smaller institutions are permitted leaner structures, which the simplified framework under Article 16 explicitly allows for.

• As permanent hires: risk and compliance leadership, security leadership, and any role with visibility into critical functions

• Contracted on a project basis: peak workloads like contract campaigns, building the register, or TLPT preparation

• Never outsourced: the ultimate responsibility of the management body

The market makes all the difference. Profiles combining tech or compliance skills with payments and banking domain knowledge are scarce, and the skills shortage hits the very roles that DORA demands. Anyone hiring for such a role in 2026 is competing for a narrow top tier; salary and market data for fintech recruiting help to set salary bands and employer pitches realistically.

This is precisely what permanent recruitment by Nova Search is built for: following a briefing of around 60 minutes covering the role, tech stack, and team culture, you receive a shortlist of three vetted candidates within five business days—screened via in-depth technical assessments and culture interviews, backed by a 90-day guarantee. The role is filled before the next supervisory audit asks for the named individuals.