DORA

What it means

DORA is the European Union regulation on digital operational resilience in the financial sector. It applies directly, with no Slovak transposing act, and since January 2025 it governs banks, insurers, investment firms, payment institutions and crypto-asset service providers.

It is not a data protection law, nor a general security rule. Where the NIS2 directive spans many sectors, DORA is the special regime for finance: its question is whether the firm survives an outage, not what happened to client data.

DORA deals with information and communication technology risk, not with capital or liquidity. It applies proportionately: smaller and less interconnected entities have a simplified risk management framework, and large-scale threat-led penetration testing is required only of selected significant institutions, not of every payment institution.

How it works in practice

It rests on five pillars: ICT risk management, reporting major incidents to the supervisor, resilience testing, managing ICT third-party risk and sharing threat information. Testing means tested disaster recovery plans, not paperwork. The National Bank of Slovakia supervises.

It reaches firms outside the sector too. Supply a bank with software, hosting or support and the contract carries mandatory clauses on access, audit, subcontracting and exit, stricter than an ordinary SLA, and you appear in that client’s register of information. Cyber insurance on its own discharges none of it.

For a small payment institution or investment firm the first step is a list of every ICT service it depends on - accounting software, e-mail and cloud storage included - marking which of them support critical functions. That list becomes the register of information, and only on top of it can a sensible risk matrix be built.

What to watch out for

A small vendor assumes the regulation is not its problem because it is not a financial institution. At renewal it cannot sign the audit and exit clauses, assembles the documentation under time pressure, and at worst loses the regulated client.

Under DORA an incident is reported not by gut feeling but against severity criteria and within fixed deadlines counted from its classification. A firm that has not decided in advance who assesses an incident and who reports it loses the first hours looking for someone responsible. Where it is also a personal data breach, a separate duty towards another authority runs in parallel.