DORA European Survey - 2026 edition

DORA compliance is progressing across financial institutions, but maturity levels vary significantly from one pillar to another.

ICT risk and incident management show the strongest advancement, with many organisations nearing high levels of compliance. In contrast, operational resilience testing and third-party risk management remain more complex, with fewer entities reaching comparable maturity.

These differences highlight where efforts are paying off, and where challenges persist. Understanding this gap is key to navigating the next phase of DORA implementation and strengthening overall resilience.

Key takeaways

1. Most institutions are not yet DORA compliant
Only 7% of surveyed institutions report full DORA compliance. While over 60% show high maturity in ICT risk and incident management, only 33% reach the same level in resilience testing and third-party risk, highlighting a gap between compliance efforts and operational readiness.

2. Critical functions are identified, not yet fully protected
While 62% of surveyed entities identify critical or important functions (CIFs) through a business-led business impact analysis (BIA), many still protect only a limited share of related assets and focus primarily on availability, overlooking confidentiality and integrity. In practice, what matters most is known, but not yet sufficiently shielded.

3. A dangerous blind spot in supply chain resilience
No institution has full supply chain visibility; 39% lack exit strategies for critical providers, and testing remains limited, with only 12% assessing provider failure scenarios. As a result, dependencies are neither fully understood nor adequately tested, leaving continuity in disruption scenarios unproven.

Download the full publication to explore the data, insights, and implications across all four pillars.