Does DORA apply to UK firms?
DORA is not UK law, so it does not apply to a UK firm simply for being a UK financial firm. It can still reach UK businesses through EU-regulated group entities and contracts with EU financial firms. UK firms answer to FCA and PRA rules instead, and the Cyber Security and Resilience Bill (CSRB) is a separate regime.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
The short answer
The EU's Digital Operational Resilience Act (DORA) is not part of UK law. It began applying on 17 January 2025, after the UK had left the EU, so it was never carried over. A UK-authorised firm with no EU presence is not caught simply for being a financial firm.
That doesn't mean UK businesses can ignore it. DORA can reach them in the ways set out below, and UK firms have their own rules. The Cyber Security and Resilience Bill (CSRB) is a separate regime again.
How DORA can still reach a UK business
| Your situation | Does DORA matter? | Why |
|---|---|---|
| UK firm with no EU entity or EU customers | Generally no | UK rules apply instead |
| UK group with an EU-authorised subsidiary | Yes, for that subsidiary | The EU entity is a financial entity in its own right |
| UK ICT supplier to EU banks, insurers or investment firms | Yes, by contract | Customers must include DORA's terms in their ICT contracts (Article 30) |
| UK ICT provider designated as critical at EU level | Yes, directly | EU financial firms can only keep using it if it sets up an EU subsidiary within 12 months of designation (Article 31(12)) |
The supplier row catches most UK technology firms. Article 30 expects contracts to cover where services and data are handled, incident support and cooperation with regulators. For critical or important functions, it also expects performance targets, security obligations, participation in resilience testing, audit rights and exit arrangements. Expect EU customers to ask for these terms even though no UK regulator is enforcing DORA against you.
If you're not sure which row you fall into, check whether the entity you contract with is itself regulated in an EU member state.
What UK financial firms follow instead
There is no single "UK DORA". Several separate rules cover similar ground.
| UK rule | What it does | Status |
|---|---|---|
| Operational resilience rules (PRA SS1/21 and FCA equivalents) | Firms identify important business services and stay within impact tolerances | Firms had to be able to remain within tolerances by 31 March 2025 |
| Critical third parties regime (PS16/24, SS6/24) | Direct oversight of major suppliers designated by HM Treasury | Rules took effect on 1 January 2025, but only bind a provider once designated |
| Operational incident and third party reporting (FCA PS26/2, PRA PS7/26) | One incident reporting framework and a register of material third parties | Due to start on 18 March 2027 |
The biggest difference from DORA is that the UK splits these subjects across separate rules, while DORA puts them into one regulation. Firms operating in both places shouldn't assume that meeting one satisfies the other, because definitions and thresholds differ.
For more detail, see FCA and PRA cyber requirements and critical third parties and the Bill.
Where the Bill fits
The Bill amends the NIS Regulations 2018. Banking is not a subsector in Schedule 2 of those Regulations, and the Bill as brought from the Commons does not add one, so being a bank doesn't make a firm an operator of essential services.
A financial group can still be caught through another activity. For example, a group company might provide a managed service or cloud service to outside customers, or supply a regulated organisation closely enough to be considered for critical supplier designation. Work through OES vs RDSP vs RMSP for each legal entity.
What to do
- List every legal entity in your group and where it is authorised.
- List your EU customers, and note which are financial entities.
- Review supplier and customer contracts for DORA clauses.
- Map UK duties separately: operational resilience, third party reporting and the Bill.
- Keep one incident process that can produce each regime's report, as the deadlines and recipients differ.
Sources
Frequently asked questions
No. DORA is an EU regulation that began applying on 17 January 2025, after the UK left the EU, so it was not carried into UK law.
There is no single equivalent. The closest rules are the FCA and PRA operational resilience rules, the critical third parties regime, and the operational incident and third party reporting rules due to start on 18 March 2027.
Not directly as a matter of UK law, but EU financial customers must include DORA terms in their ICT contracts, so a UK supplier can take on those requirements by contract. A UK provider designated as critical at EU level would need an EU subsidiary.
Banking is not a subsector in Schedule 2 of the NIS Regulations 2018, and the Bill as brought from the Commons does not add one. A financial group could still be caught through another activity, such as providing a cloud or managed service.