UK Regime and DORA Comparison

UK operational resilience and DORA are different regimes, and this guide keeps them apart. UK: under FCA and PRA policy statements published in March 2021, firms identify important business services, set impact tolerances for each service, map supporting resources, test against severe but plausible scenarios, and self-assess. UK timetable: services and tolerances by 31 March 2022, and remaining within tolerance for severe but plausible scenarios by 31 March 2025. DORA: the EU digital operational resilience framework for financial entities, with its own regulation, technical standards and concepts, applied from 17 January 2025, labelled here as DORA. A document, test or tolerance written for one regime does not automatically satisfy the other, and copying an answer across regimes risks leaving neither regime properly addressed.

The comparison matters because many firms operate across both regimes, or use advisers and templates that span both. Familiarity can breed merging: similar language about resilience, testing and third parties makes it tempting to produce a single document and present it twice. That temptation should be resisted. Each regime has its own source, its own unit of analysis and its own expected evidence, and a supervisor examining a UK self-assessment will look for UK services and UK tolerances, not for a DORA register or a DORA test programme relabelled as UK work.

UK: the source is FCA and PRA policy statements, with supervisory guidance and engagement from those regulators. UK: the unit of analysis is the important business service, defined by the harm its disruption would cause to users or to market integrity. UK: the central artefacts are the service list, the impact tolerance for each service, the map of resources supporting each service, the scenario test results for each service, and the board owned self-assessment that gathers those elements. UK: the judgement is whether a named service would remain within its tolerance under severe but plausible disruption.

DORA: the source is EU legislation and its associated technical standards, developed for the EU financial sector. DORA: the unit of analysis is organised around the financial entity and its information and communication technology risk management, with its own registers, testing concepts and third party arrangements. DORA: the central artefacts include ICT risk management arrangements, incident classification and reporting arrangements, testing programmes including threat led penetration testing concepts, and third party risk arrangements for ICT providers. DORA: the judgement is framed in DORA terms, against DORA requirements, rather than against a UK impact tolerance for a named service.

The clearest divergence is the unit of analysis. UK work starts from a service and its user harm, while DORA work starts from the entity and its ICT risk. A firm could therefore have a thorough DORA ICT risk assessment and still lack a UK tolerance for a particular payment service, because the DORA assessment was not organised around that service and its harm. Conversely, a firm could have a sound UK tolerance for a service and still need DORA artefacts that the UK regime does not require in the same form. Recognising that divergence prevents the false comfort of assuming that strength in one regime implies strength in the other.

A firm subject to both regimes should run two clearly labelled workstreams, even where underlying operational work, such as incident response capability or supplier management, supports both. Shared operational capability is efficient, but shared documentation that blurs regime boundaries is not. Each regime should have its own service or entity analysis, its own tests designed for its own question, and its own assessment document that can be examined on its own terms. Cross references between workstreams can note where operational capability is shared, provided the reference does not substitute a document from one regime for evidence in the other.

The pitfall is copying a DORA answer into a UK self-assessment, or the reverse, so that neither regime is actually addressed. It can be spotted by reading a document and asking which regime its concepts belong to. If a UK self-assessment is organised around ICT registers and DORA testing categories, without named UK services and UK tolerances, it has likely been copied. If a DORA assessment is organised around UK impact tolerances, without DORA concepts and artefacts, the same error has occurred in reverse. In both cases, the document may be lengthy and professional, but length does not cure a regime mismatch.