Who Does DORA Apply To? The 20 Types of Financial Entities and Their ICT Providers

Article 2 of Regulation (EU) 2022/2554 defines who DORA applies to. In practice: 20 types of financial entities (points (a)–(t)) plus ICT third-party service providers (point (u)).

Related: DORA hub · What is DORA? · For ICT providers.

Scope count: Article 2(1) lists 20 financial entity categories (a–t) that the Regulation collectively calls “financial entities,” and separately includes ICT third-party service providers (u). Paragraphs 3–4 set exclusions and Member State options — confirm your legal analysis against the Official Journal text.

Financial Entity Categories (a–t)

Credit institutions
Payment institutions (including certain exempted payment institutions)
Account information service providers
Electronic money institutions (including certain exempted e-money institutions)
Investment firms
Crypto-asset service providers and issuers of asset-referenced tokens (as referenced in Article 2)
Central securities depositories
Central counterparties
Trading venues
Trade repositories
Managers of alternative investment funds
Management companies
Data reporting service providers
Insurance and reinsurance undertakings
Insurance, reinsurance and ancillary insurance intermediaries
Institutions for occupational retirement provision
Credit rating agencies
Administrators of critical benchmarks
Crowdfunding service providers
Securitisation repositories

ICT Third-Party Service Providers (u)

Providers of ICT services to financial entities are in scope of the Regulation’s ICT third-party chapter and may face CTPP designation. They are not labelled “financial entities” under Article 2(2), but contractual and oversight consequences are real — see DORA for ICT service providers.

Exclusions

Article 2(3)–(4) exclude or allow exclusion of certain small intermediaries, small IORPs, and other specified cases. Do not assume exemption without legal review.

How CyberSilo Helps

Pillar-by-pillar evidence maps in CSA for DORA
Detection and major-incident timelines with ThreatHawk SIEM
Advisory scoping — contact CyberSilo

Confirm Scope Before Building Controls

Map your entity type and ICT providers, then evidence the five pillars in CSA.

Talk to CyberSilo DORA Hub

Frequently Asked Questions

How many financial entity types does Article 2 list?

Twenty categories in points (a) to (t), plus ICT third-party service providers in point (u).

Are ICT providers ‘financial entities’?

No under Article 2(2)’s definition — but they are still within the Regulation’s scope as ICT third-party service providers.

Does DORA apply outside the EU?

DORA binds EU-regulated entities and shapes contracts with non-EU ICT providers serving those entities. Non-EU groups with EU subsidiaries or services commonly face flow-down requirements.

Hub · Checklist · CSA

Who Does DORA Apply To? The 20 Types of Financial Entities and Their ICT Providers

Financial Entity Categories (a–t)

ICT Third-Party Service Providers (u)

Exclusions