The EU law for when your bank’s IT falls over

3,383. That is how many major IT incidents banks, insurers, payment firms and the rest of the EU’s financial sector reported to their supervisors in 2025. It comes to about nine a day by my arithmetic, which is a lot more than I would have guessed, probably because I only hear about the ones that reach the news.

The figure comes from a report published this June by the EU’s three financial watchdogs, the European Supervisory Authorities or ESAs. It’s the first of its kind under a law called DORA, the Digital Operational Resilience Act, which since 17 January 2025 has given the whole sector one set of rules for reporting when its technology fails.

I’ve been reading the regulation and what the ESAs publish about it, and these are my notes. This first one covers what DORA is and why anybody thought it was needed.

Two bad days in 2025

The report singles out two events from last year, and they explain the subject better than any definition I could find.

On 27 February, T2 stopped for about ten hours. T2 is the system through which the euro area’s central banks settle payments, including those between banks, so this was plumbing most people never think about. The cause, according to the report, was a fault in a core part of a storage system, “an extremely rare hardware malfunction not previously observed worldwide in similar systems”. Some salary and pension payments ended up delayed.

Two months later, on 28 April, the Spanish electricity grid suffered a total blackout that also hit Portugal, for around ten hours. Big banks and insurers kept their data centres running on backup generators, as you’d hope. Anyone trying to pay for something got little out of that. Internet outages cut people off from banking apps that were still working, many branches had no power or connection, and card terminals either ran out of battery or dropped offline.

That second case changed how I read the word “resilience”. The big banks’ data centres were fine, and plenty of customers still couldn’t reach them.

Fewer hackers than I assumed

I went in expecting the 3,383 to be mostly cyberattacks, and I was wrong. Cybersecurity incidents made up 10% of the total. System failures were named in 51% of cases and outside events in 27%, although the report warns that those shares need careful reading because of how firms fill in the forms. Almost a third of incidents began with a failure at somebody else’s end, whether an IT supplier, another financial firm or an infrastructure provider.

My nine a day needs a health warning too, and the authors supply it themselves: “the number of incidents per se is not a risk indicator”. When one event hits several firms, each of them has to report it, so nine reports doesn’t mean nine separate disasters. More than 60% came from the credit sector, meaning banks, and one of the explanations offered is that banks and payment firms have had to report major incidents since 2018. In almost 60% of cases customers were either unaffected or fewer than 1,000 of them felt it, though a few incidents reached more than a million customers. The analysis also had to leave out about 15% of notified incidents because their final reports hadn’t arrived in time.

According to the ESAs, the low share of attacks “may suggest that existing security safeguards and detection mechanisms were effective”. Note the “may”. I’d want at least a second year of figures before believing that.

Fire regulations for computers

Regulation (EU) 2022/2554 is long and very dry, and the picture that helped me was fire safety rules, applied to a financial firm’s technology. Your building may never burn, and you still have to have certain things in place in case it does. (The law says ICT, for information and communication technology. I’ll mostly stick to IT.)

• Have a plan. Firms need a framework for managing IT risk, and the people at the top can’t wave it away: the management body has to “bear the ultimate responsibility for managing the financial entity’s ICT risk”.
• Call it in. A first notification is due within four hours of classifying an incident as major, and no later than 24 hours after the firm became aware of it. An intermediate report follows within 72 hours of that first notice, then a final one no later than a month after the latest intermediate report.
• Hold drills. All but the very smallest firms need a programme for testing their systems.
• Check the contractors. IT suppliers count as part of a firm’s risk, and the law sets requirements for the contracts with them.
• Warn the neighbours. Firms may swap information about cyber threats with one another. Here the law gives permission and stops there.

Article 2 reaches a long way. It names twenty kinds of financial firm, from banks and insurers to crypto-asset service providers and crowdfunding platforms, then adds the IT providers that serve them. Being a regulation, it applies directly in every member state, and there was no transition period to hide behind, as the ESAs reminded everyone in December 2024. Size does count for something, since the risk-management rules are applied according to how big and how risky a firm is.

Why a new law at all? The regulation’s own account is that IT risk was “only partially addressed at Union level”, which left “gaps or overlaps” in areas like incident reporting and testing, while national rules drifted apart. In fairness, the ESAs also told firms that the requirements “are not entirely new”, because many of them had been living with similar guidelines for years. How much DORA adds beyond tidying up is something I want to come back to.

Amazon answers to a financial watchdog now

This part I hadn’t seen coming. A bank can rent its computing from a cloud company, but it can’t rent out the blame: firms “at all times, remain fully responsible” for meeting their obligations. With almost a third of incidents starting at an outside party, that leaves an obvious question about who keeps an eye on the suppliers.

DORA’s answer is to reach past the banks. On 18 November 2025 the ESAs published a list of 19 providers designated as critical. The European arms of Amazon Web Services, Google Cloud and Microsoft are on it, as you’d expect, and so are Deutsche Telekom and Orange, along with SAP and Bloomberg. The ESAs now oversee these companies directly and assess whether their risk management and governance are up to it. A provider that refuses to hand over information or let inspectors in can be charged a penalty of up to 1% of its average daily worldwide turnover, every day, for as long as six months. The list has to be updated every year.

And if you only have a current account?

Then there isn’t much you can point to. The clearest line for customers I found is in Article 19: when a major incident “has an impact on the financial interests of clients”, the firm has to tell them without undue delay and say what it has done about it. Everything else reaches you indirectly, if at all, in the form of a card that works more often.

Does it work more often? One year of data can’t say. The Commission has to review the law by 17 January 2028, and by then somebody should have enough figures to check.

Where this goes next

Next I’ll follow a single incident through those deadlines, because four hours looks tidy on paper and I’d like to know what anyone can actually say at hour four. The cloud companies get a post of their own later.

Sources

All of these checked in November 2026:

• EUR-Lex: Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA) (14 December 2022)
• EUR-Lex: Commission Delegated Regulation (EU) 2025/301 on the content and time limits of incident reports (OJ 20 February 2025)
• European Supervisory Authorities: 2025 Report on major ICT-related incidents, JC 2026 16 (3 June 2026)
• European Banking Authority: European Supervisory Authorities designate critical ICT third-party providers (18 November 2025)
• European Supervisory Authorities: List of designated critical ICT third-party service providers (18 November 2025)
• European Supervisory Authorities: Public statement on the application of DORA, JC 2024 99 (4 December 2024)
• European Central Bank: T2