DORA Penalties: Fines and Enforcement Explained

Understanding the penalty regime helps prioritize compliance efforts and demonstrates to stakeholders the importance of DORA obligations.

Key Takeaways

Point	Summary
Turnover-based fines	Financial entities face fines up to 2% of total annual worldwide turnover
Individual penalties	Individuals can face personal fines up to 1 million
CTPP penalties	Critical ICT Third-Party Providers face fines up to 5 million or 1% of daily turnover
Beyond fines	Regulators can impose binding instructions, suspend activities, and more
Management liability	Senior executives can be held personally accountable

Quick Answer: DORA empowers competent authorities to impose financial penalties of up to 2% of total annual worldwide turnover (or 1% of average daily global turnover) on financial entities that breach the regulation. Individual penalties can reach 1 million. Beyond fines, regulators can issue binding instructions, suspend operations, and hold management personally liable. Critical ICT Third-Party Providers face penalties up to 5 million.

Penalty Structure for Financial Entities

Administrative Penalties

Competent authorities can impose financial penalties on financial entities for DORA breaches:

Metric	Maximum Penalty
Percentage of turnover	Up to 2% of total annual worldwide turnover
Daily turnover basis	Up to 1% of average daily global turnover
Absolute amounts	Member states may set fixed maximums

The actual penalty depends on factors including:

• Severity and duration of the breach
• Degree of responsibility
• Financial strength of the entity
• Profits gained or losses avoided
• Previous infringements
• Level of cooperation with authorities

Periodic Penalty Payments

Authorities can impose ongoing penalties to compel compliance:

• Daily payments until breach is remedied
• Designed to ensure timely corrective action
• Continue accruing until compliance is achieved

Other Enforcement Measures

Beyond financial penalties, competent authorities can:

Measure	Description
Public statements	Identify entity and nature of breach publicly
Binding instructions	Order specific compliance actions
Remediation orders	Require correction of deficiencies
Security audits	Order audits at entity's expense
Operational restrictions	Suspend or limit specific activities
Withdrawal of authorization	Revoke license in severe cases

Penalties for Critical ICT Third-Party Providers

Designated Critical ICT Third-Party Providers (CTPPs) face a separate penalty regime under the oversight framework.

Lead Overseer Powers

The Lead Overseer (appointed from ESAs) can impose:

Penalty Type	Maximum
Periodic payments	Up to 1% of average daily worldwide turnover per day
Maximum period	Up to 6 months
Absolute maximum	EUR 5 million

Grounds for CTPP Penalties

Penalties may be imposed when CTPPs:

• Fail to comply with oversight recommendations
• Fail to provide required information
• Provide incomplete, incorrect, or misleading information
• Fail to submit to examinations

Non-EU CTPPs

Non-EU providers designated as critical must establish an EU subsidiary within 12 months. Failure to do so can result in:

• Recommendation to financial entities to suspend or terminate arrangements
• Prohibition on financial entities entering new arrangements

Individual Liability

Personal Accountability

DORA creates personal liability for members of the management body:

Responsibility	Consequence
Framework approval	Personal liability for failure to approve ICT risk management framework
Oversight	Liability for inadequate supervision of implementation
Training	Obligation to undergo and provide cybersecurity training

Individual Penalties

Member states may impose penalties on individuals:

Metric	Maximum
Financial penalty	Up to EUR 1 million per individual
Other measures	Temporary bans on management functions

Director Disqualification

In severe cases, authorities may:

• Temporarily prohibit individuals from exercising management functions
• Require removal of non-compliant directors
• Bar individuals from future management positions

Factors Affecting Penalties

Aggravating Factors

Penalties may increase when:

• Breach was intentional or resulted from negligence
• Entity failed to cooperate with investigation
• Repeated or persistent non-compliance
• Significant profits gained from the breach
• Breach caused substantial harm to clients or markets

Mitigating Factors

Penalties may decrease when:

• Entity cooperated promptly with authorities
• Breach was quickly identified and remediated
• Entity voluntarily reported the breach
• Strong compliance culture otherwise demonstrated
• Steps taken to prevent recurrence

Enforcement Process

Investigation

Competent authorities have powers to:

• Require information and documents
• Conduct on-site inspections
• Summon and question individuals
• Seize records and documents
• Request records from third parties

Due Process

Before imposing penalties, authorities must:

• Notify the entity of findings
• Provide opportunity to respond
• Consider representations made
• Provide reasoned decision
• Allow rights of appeal

Publication

Final decisions imposing penalties are typically published, including:

• Identity of the entity or individual
• Type of breach
• Penalty imposed

Publication may be delayed or anonymized where it would cause disproportionate harm.

Comparison with Other Frameworks

Framework	Maximum Penalty
DORA	2% of turnover (financial entities)
NIS 2	2% of turnover (essential entities)
GDPR	4% of turnover
PSD2	Varies by member state
MiFID II	10% of turnover or 5 million

DORA penalties are substantial but align with other major EU regulations affecting the financial sector.

Practical Implications

Compliance Investment Justification

The penalty regime provides clear justification for compliance investment:

• Maximum penalties can exceed typical compliance costs by orders of magnitude
• Reputational damage from public enforcement adds to financial impact
• Management personal liability increases board attention

Risk-Based Prioritization

Focus compliance efforts on areas with highest penalty exposure:

• Incident reporting failures (visible and measurable)
• Third-party risk gaps (Register of Information submission)
• Governance deficiencies (management accountability)

Insurance Considerations

Consider how cyber insurance and D&O policies address:

• Regulatory investigation costs
• Penalty coverage (where insurable)
• Management personal liability

Common Questions

Have any DORA penalties been imposed yet?

DORA became fully applicable in January 2025. As a transition year, significant enforcement action is expected to focus on entities significantly short of compliance rather than minor gaps. Enforcement activity will increase as the transition period ends.

Can penalties be appealed?

Yes. Decisions imposing penalties can be challenged through appropriate legal channels. Entities have rights to fair hearing and judicial review.

Are penalties insurable?

Regulatory penalties are typically not insurable under most insurance policies as a matter of public policy. However, investigation costs and defense expenses may be covered. Review your insurance arrangements with advisors.

How do penalties interact with other regulations?

An entity may face penalties under multiple regulations for related conduct. Authorities coordinate to avoid duplicative penalties for the same underlying conduct.

What about criminal liability?

DORA establishes administrative penalties. Criminal liability for cyber-related conduct is determined by member state criminal law. Serious breaches could potentially trigger criminal investigation separately.

How Bastion Helps

Bastion helps financial entities minimize penalty exposure through proactive compliance:

• Gap assessment: Identify areas of potential non-compliance
• Prioritization: Focus on highest-risk areas first
• Remediation: Address gaps before regulatory attention
• Documentation: Build evidence of compliance efforts
• Ongoing monitoring: Maintain compliance over time

Ready to reduce your DORA compliance risk? Talk to our team

---

Sources

• DORA Articles 50-52 - Administrative penalties and remedial measures
• DORA Articles 35-37 - Oversight framework penalties for CTPPs
• EBA Enforcement Guidance - Supervisory approaches to DORA enforcement