DORA Supervision and Enforcement

DORA is supervised by competent authorities in the European Union, with the European Supervisory Authorities playing a coordinating and standard-setting role, and DORA applies from 17 January 2025. Financial entities are supervised by the authority responsible for them in their home state, under arrangements that reflect their sector and their authorisation. Separately, ICT third-party providers identified as critical fall under a dedicated oversight framework, with a Lead Overseer. Enforcement, in this context, means supervisory action taken when a firm or a provider does not meet its duties, and the form of that action depends on the authority, the sector, and the applicable national framework.

Supervision under DORA is best understood as an evidence conversation. An authority will look for a coherent service view, a credible risk assessment, a tested recovery approach, a monitored provider picture, and an incident record that shows learning, rather than for a single perfect document.

A financial entity is supervised by its competent authority, which is generally the authority that authorises and supervises it in its sector, whether banking, insurance, or securities markets. That authority will already know the firm, its business model, and its governance, and DORA supervision builds on that knowledge rather than starting from a blank page. Cross-border groups add complexity, because different entities in a group may answer to different authorities, and a shared system or provider may be relevant to several supervisors at once. Cooperation arrangements between authorities are therefore part of the supervisory picture, and a firm should be ready to explain its group service map in a way that each authority can follow.

The European Supervisory Authorities develop technical standards and guidance, coordinate supervisory practice, and support the oversight framework for critical ICT third-party providers. Their role is not to replace national competent authorities, but to make supervision more consistent across sectors and states, so that a similar service receives a similar supervisory conversation wherever it is authorised. For a firm, ESA publications are a useful early signal of supervisory expectations: a new standard, a set of questions and answers, or a report on incidents or testing can indicate where supervisors will look next. Reading those publications as part of ordinary horizon scanning is more useful than discovering them during an examination.

Providers identified as critical under DORA fall under a dedicated oversight framework, led by a Lead Overseer appointed from among the ESAs, with a joint examination team drawn from relevant authorities. Oversight in this framework focuses on the provider's risk management, security, and resilience arrangements as they affect financial entities, and it involves information requests, inspections, and recommendations. The framework does not make a critical provider a financial entity, and it does not remove the financial entity's own duty to oversee its providers, but it does add a direct supervisory channel for the providers whose failure would matter most across the sector. A financial entity should understand which of its providers are in this framework, and what that means for its own monitoring and escalation.

Supervisors look for connection and credibility. Connection means that risk, incident, testing, and provider records all refer to the same services, with the same owners and the same dependencies. Credibility means that the records reflect what actually happens: a test that found a weakness and led to a change is more credible than a test that found nothing, and an incident record that shows a difficult decision is more credible than one that shows a smooth narrative. Supervisors also look for governance, in the sense that senior management understands the service picture and the risks that matter, and for follow-up, in the sense that findings are owned, dated, and closed. A firm that can show those qualities, even where its picture is imperfect, is having a different conversation from a firm that can only show policies.

When a supervisor finds a weakness, the usual path is a finding, a remediation expectation, and a follow-up check, with the firm expected to own the remediation and to evidence it. More serious or persistent shortcomings can lead to stronger supervisory measures, under the applicable sectoral and national framework, and the precise measures available depend on that framework rather than on a single DORA list of measures. The practical lesson for a firm is to treat findings as part of the resilience loop, not as an external interruption: a finding that is owned, dated, and traced to a service change strengthens the next supervisory conversation, while a finding that is answered only with a new policy weakens it. Keeping a clear record of findings, owners, and closure evidence is therefore both a supervisory and an operational discipline.