<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2024-12-04","gaps":[],"covered":["JC/2024/99 — Statement — DORA application [published] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the ESAs publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/level-3/statements/jc-2024-99-statement-dora-application","url":"https://www.headlesslaw.com/dora/level-3/statements/jc-2024-99-statement-dora-application","title":"JC/2024/99 — Statement — DORA application [published]","family":"l3","work_id":"spaces/dora/level-3/statements/jc-2024-99-statement-dora-application","status":"published","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"joint publication","check":{"against":"the ESAs publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.esma.europa.eu/document/esas-statement-dora-application","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"2cf08480f43baac1","change_date":null,"nearest_versions":["2024-12-04"],"first_text_date":"2024-12-04","correction_applies":false,"versions":["2024-12-04"],"version_url":"https://www.headlesslaw.com/dora/level-3/statements/jc-2024-99-statement-dora-application/versions/2024-12-04","revision_url":"https://www.headlesslaw.com/dora/level-3/statements/jc-2024-99-statement-dora-application/versions/2024-12-04/rev/2cf08480f43baac1","versions_url":"https://www.headlesslaw.com/dora/level-3/statements/jc-2024-99-statement-dora-application/versions","relations_url":"https://www.headlesslaw.com/dora/level-3/statements/jc-2024-99-statement-dora-application/relations","source_line":"Statement by the Joint Committee of the ESAs · not legislation · dated 4 Dec 2024 [published]","attribution":{"prepared_by":"Joint Committee of the ESAs","published_by":"ESMA","published_in":null,"document_type":"statement","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"document_date":"2024-12-04","locators":{"document_date":"PDF page 1: \"4 December 2024\""}},"adoption":null}}} -->
---
title: "JC/2024/99 — Statement — DORA application [published]"
shortTitle: "JC/2024/99 — Statement — DORA application [published]"
type: statement
instrument_type: statement
authority: joint
binding: false
binding_character: non_binding
legal_status: in_force
regulation: DORA
dora_level3: true
mica_level2: false
reference: "JC 2024 99"
legal_basis: "DORA"
date: 4 December 2024
source_link: "https://www.esma.europa.eu/document/esas-statement-dora-application"
source_pdf: "https://www.esma.europa.eu/sites/default/files/2024-12/JC_2024_99_ESAs_Statement_on_DORA_application.pdf"
lifecycle: "published"
text_version: "joint publication"
source_url: "https://www.esma.europa.eu/document/esas-statement-dora-application"
check_status: matched
verified: true
last_checked: 2026-10-26
checked_against: "the ESAs publication"
source:
  prepared_by: "Joint Committee of the ESAs"
  published_by: "ESMA"
  evidence:
    prepared_by: "JC 2024 99"
    locator: "PDF page 1 (https://www.esma.europa.eu/sites/default/files/2024-12/JC_2024_99_ESAs_Statement_on_DORA_application.pdf)"
document_type: "statement"
legal_nature: "not_legislation"
addressees: "not stated in the document"
dates:
  document_date: "2024-12-04"
  locators:
    document_date: "PDF page 1: \"4 December 2024\""
lifecycle_label: "published"
---

**Statement by the Joint Committee of the ESAs · not legislation · dated 4 Dec 2024 [published]**

*Published · joint publication · Checked against the ESAs publication on 26 Oct 2026 · [Official source](https://www.esma.europa.eu/document/esas-statement-dora-application)*

| | |
|---|---|
| **Full title** | JC/2024/99 — Statement — DORA application \[published\] |
| **Prepared by** | Joint Committee of the ESAs |
| **Published by** | ESMA |
| **Reference** | JC 2024 99 |
| **Document type** | Statement |
| **Legal nature** | Not legislation |
| **Addressees** | Not stated in the document |
| **Dates** | Dated 4 December 2024 |
| **Legal basis** | DORA |
| **Related instruments** | None recorded |
| **Text on this page** | Word for word — the full text of the ESAs publication |

4 December 2024 JC 2024 99

## DORA application

1\. As the Digital Operational Resilience Act[^1] (DORA) together with the technical standards and guidelines developed by the European Supervisory Authorities (ESAs) in January[^2] and July 2024[^3] will apply from 17 January 2025, the ESAs call on financial entities and third-party providers to advance their preparations to ensure their readiness.

2\. As DORA does not provide for a transitional period, the ESAs emphasise the importance for financial entities to adopt a robust, structured approach in order to meet their obligations in a timely manner.

3\. Financial entities are expected to identify and address in a timely manner gaps between their internal setups and the DORA requirements. The latter are not entirely new as many financial entities have been subject to existing sectorial guidelines[^4], regulations or supervisory expectations in the areas of ICT risk management, incident reporting and outsourcing for years. The ESAs also acknowledge that the eƯorts to comply with DORA may be higher for some financial entities which have been subject to less sectoral requirements regarding digital operational resilience management so far. In any case, the ESAs and competent authorities (CAs) have been providing guidance to support the smooth implementation of DORA and will continue to do so.

4\. Financial entities should also prepare for the new reporting obligations. In particular, financial entities need to have their registers of ICT third-party providers’ contractual arrangements available for competent authorities early in 2025, as the latter will have to report them to the ESAs by 30 April 2025[^5]. They should draw on the lessons learnt from the 2024 ESAs dry-run exercise in support of industry preparation and consider the ITS on the Register of Information adopted by the Commission on 29 November[^6]. Furthermore, it is important that financial entities are equipped to classify and report their major ICT-related incidents from the date of application.

5\. Considering the risk profile, size, scale, and complexity of the activities of the various financial entities, competent authorities are prepared to supervise the DORA requirements in a risk-based manner and taking into account the EBA’s, ESMA’s and EIOPA’s Union Strategic Supervisory Priorities (USSPs[^7]) and the EBA’s 2025 European Supervisory Examination Programme (ESEP[^8]), which highlight cyber and digital operational resilience.

6\. The ESAs continue to work with competent authorities to deliver a pragmatic, outcomes-focused and timely approach to implementation.

7\. The ESAs also invite ICT third-party service providers, which consider they may meet the criticality criteria published in May 2024[^9], to assess their operational setup against DORA requirements. The first designation of CTPPs is expected to take place in H2 2025.

[^1]: Publications OƯice (europa.eu)
[^2]: ESAs publish first set of rules under DORA for ICT and third-party risk management and incident classification (europa.eu)
[^3]: ESAs published second batch of policy products under DORA (europa.eu), and ESAs published joint Final report on the draft technical standards on subcontracting under DORA (europa.eu)
[^4]: For example, EBA guidelines on ICT security risk management ([EBA/GL/2019/04](../guidelines/eba-gl-2025-02-amend-ict-security-risk.md)), EBA Guidelines on outsourcing arrangements ([EBA/GL/2019/02](../guidelines/eba-gl-2019-02-outsourcing-arrangements.md)), EBA Guidelines on major incident reporting under PSD2 (EBA/GL/2021/03), EIOPA guidelines on ICT security and governance (EIOPA-BoS-20/60), ESMA guidelines on outsourcing to cloud service providers (ESMA50-164-4285) and EIOPA guidelines on outsourcing to cloud service providers (EIOPA-BoS-20-002).
[^5]: https://www.esma.europa.eu/sites/default/files/2024-11/ESA\_2024\_22\_Decision\_on\_reporting\_of\_information\_for\_CTPP\_designation.pdf
[^6]: Implementing regulation - EU - 2024/2956 - EN - EUR-Lex
[^7]: EIOPA: 0d45dc78-d9ad-4641-a7f7-9e9d20ad8518\_en. ESMA: ESMA to put cyber risk as a new Union Strategic Supervisory Priority (europa.eu)
[^8]: https://www.eba.europa.eu/sites/default/files/2024-07/ef6cf1ab-94fe-453f-9e4d-37231153cfac/2025%20EBA%20ESEP.pdf
[^9]: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:L\_202401502