More than a year after the Digital Operational Resilience Act began to apply, many financial services firms are discovering that compliance is not a one-off project but a permanent operational burden.
According to RegTech provider Vixio, teams still relying on spreadsheets, email chains and disconnected tools risk falling short as national regulators sharpen their focus in 2026.
DORA (Regulation EU 2022/2554) has applied to EU financial entities since January 17, 2025. It sets a single framework for ICT risk built on five pillars: ICT risk management, incident reporting, digital operational resilience testing, third-party risk management and information sharing.
Its scope spans banks, payment institutions, e-money institutions, investment firms and crypto-asset service providers, while critical ICT providers face a separate EU oversight regime.
The scale of the reporting challenge became clear before the rules even took effect. In the ESAs’ voluntary 2024 dry run, only 6.5% of the 947 registers analysed passed all 116 data quality checks. Common failures included wrong file formats, blank mandatory fields, mishandled identifiers and incomplete mappings between contracts, functions and supply chains.
Vixio argues the difficulty lies less in the core regulation than in the growing body of regulatory technical standards, implementing technical standards, guidelines and Q&As. These dictate how incidents are classified, how the Register of Information is structured and how deep subcontracting chains must be documented.
Firms operating across several jurisdictions must also juggle differing national filing windows, formats and taxonomy versions.
Third-party oversight adds further complexity. Firms must link ICT contracts to the functions they support, assess concentration risk, maintain workable exit plans and secure audit and access rights. Accountability, meanwhile, remains firmly with the management body, which must approve and oversee the ICT risk framework regardless of what is delegated or outsourced.
Incident reporting is another pressure point. Major ICT incidents trigger a three-stage process of initial notification, intermediate reporting and a final report, often while IT is still fighting the disruption and legal is reviewing communications. Manual handoffs are particularly fragile in these moments.
Read the full Vixio post here.
Copyright © 2026 FinTech Global
