DORA Year One

On June 3, 2026, the European Supervisory Authorities (EBA, EIOPA, and ESMA) published their first joint report on major ICT-related incidents under Article 22 of the Digital Operational Resilience Act (DORA). This is the first time we have aggregate, cross-sector data on how the EU financial system performed under DORA's incident reporting framework in its inaugural year. 

The numbers deserve attention because they reveal where supervisory focus is building. 

In 2025, financial entities across the EU reported 3,383 major ICT incidents, averaging 282 per month, or roughly 0.18 incidents per financial entity subject to DORA. The credit sector (banks) and payments sector (EMIs, payment institutions) accounted for more than three-quarters of all reports. 

The ESAs are careful to note that incident volume alone is not a risk indicator. The concentration in credit and payments reflects the highly digital, customer-facing nature of those services and the fact that both sectors had prior reporting obligations under PSD2. 

Perhaps the most counterintuitive finding: only approximately 10% of major incidents were categorized as cybersecurity-related. System failures and external events dominate the incident landscape. 

What this suggests to me: the industry conversation around operational resilience is still too narrowly anchored in cybersecurity. DORA is asking a broader question. Can your operations withstand disruption from any source, whether that is a ransomware attack, a failed deployment, a third-party outage, or an infrastructure event like the Iberian Peninsula blackout that disrupted financial services across Spain and Portugal in April 2025? 

Implication: Resilience programs that focus exclusively on cyber defense are addressing only a fraction of the risk regulators are tracking. 

Almost one-third of all major incidents originated from a failure attributable to a third-party provider (TPP). The ESAs are explicit about what this means:

"Dependencies on TPPs, even those not designated as CTPPs, constitute an area of critical supervisory attention."

This finding underscores why DORA places significant obligations on financial entities to manage third-party ICT risk through contractual provisions, exit strategies, and the Register of Information (Art. 28). The ESAs note that supervisory attention will continue to focus on whether financial entities have adequate oversight, due diligence, and contingency planning for their TPP relationships.

Approximately one-third of reported major incidents had cross-border impact, affecting financial entities or clients in multiple EU member states. The ESAs attribute this to shared infrastructure, common ICT services, and cross-border business models. 

This validates DORA's core premise: digital operational resilience cannot be managed at a national level alone. For financial entities operating across multiple jurisdictions (or their ICT providers serving customers in multiple member states), a single incident increasingly becomes a multi-NCA reporting event. 

Implication: Incident response and reporting capabilities need to account for multi-jurisdiction notification. The entities building unified, cross-border reporting workflows now will be better positioned as supervisory coordination matures. 

Two-thirds of major incidents resulted in no or minor disruption to clients and transactions. The ESAs interpret this as evidence that: 

"Timely detection, paired with effective incident response and containment measures were often successful in limiting operational harm and spillover effects." 

What this data suggests to me: the regulation rewards containment, not perfection. Incidents in a highly digital financial system are, to some extent, unavoidable. DORA's purpose is to ensure the sector can contain them. Year-one data suggests that, broadly, it can. 

The report specifically calls out ransomware attacks as disproportionately targeting the insurance sector, attributed to insurers holding large volumes of sensitive health and financial data. This has implications for TLPT planning and third-party risk management in the insurance vertical. 

As the second-highest reporting sector, payments entities (including EMIs) face heightened supervisory visibility. New market entrants receiving provisional EMI licenses should note that their sector is already well-represented in the incident data. 

The ESAs acknowledge: 

"Divergent reporting practices across sectors and jurisdictions are still observed." 

They attribute this to the early stage of DORA implementation, this being the inaugural year of reporting under the new framework. Nearly all submissions (~93%) passed basic quality checks, but a full set of automated data quality rules was not yet in place for year one. 

This is, in my view, the most important signal for forward-looking compliance teams. Regulators know the data is imperfect. They are not drawing enforcement conclusions from year-one numbers. But they are building the baseline. By 2027, they will have two years of trend data and the analytical infrastructure to identify outliers, late reporters, and entities whose incident patterns diverge from sector norms. 

The French regulator (AMF) is already citing this report in their 2026 enforcement priorities, with AI-driven cyber risk as a stated focus area (https://www.financemagnates.com/forex/amf-puts-ai-driven-cyber-risk-at-the-centre-as-retail-financial-firms-face-rising-pressure/). NCAs are not waiting. They are acting on this data now. 

Implication: The entities that invest in clean, consistent reporting now are not just meeting a compliance obligation. They are establishing themselves as low-risk in a dataset that supervisors will increasingly mine for anomalies. 

A note on framing: AWS services are enablers, not compliance guarantors. No architectural pattern directly "ensures" DORA compliance. DORA requires governance, policies, processes, and organizational accountability that sit above any technology choice. What AWS provides are capabilities that support meeting those requirements. 

With that caveat, here is how customers are using AWS capabilities in the context of what this report highlights: 

The entities that contained incidents effectively in year one likely had automated detection pipelines rather than manual identification processes. AWS services like CloudTrail, GuardDuty, EventBridge, and Security Hub provide detection and classification capabilities that can support DORA's 4 hours from classification (24-hours from detection) initial notification requirement, but the reporting process itself (classification decisions, NCA notification, governance approvals) remains an organizational responsibility. 

The report's finding that system failures (not cyberattacks) dominate the incident landscape reinforces the value of resilience testing that goes beyond penetration testing. AWS Fault Injection Service supports chaos engineering and scenario-based testing aligned to DORA Art. 24-25 requirements. AWS published a detailed guide on this approach: 

DORA Scenario Testing with AWS Fault Injection Service: https://aws.amazon.com/blogs/industries/dora-scenario-testing-with-aws-fault-injection-service 

Given the ESAs' focus on TPP-originated incidents, the Register of Information requirement (Art. 28) takes on added urgency. AWS Artifact provides compliance reports and certifications that support customers' third-party due diligence. The shared responsibility model provides the delineation of responsibilities that customers need to document in their Register of Information (RoI). 

AWS has published several resources for financial entities navigating DORA: 

AWS DORA Compliance Page: https://aws.amazon.com/compliance/dora/ 

Introducing the AWS User Guide to DORA: https://aws.amazon.com/blogs/industries/introducing-the-aws-user-guide-to-the-digital-operational-resilience-act-dora/ 

AWS Guide to the ECB Guide on Outsourcing (June 2026): https://aws.amazon.com/blogs/industries/introducing-the-aws-guide-to-the-ecb-guide-on-outsourcing-cloud-services-to-cloud-service-providers/ 

Detailed DORA guides (Level 1, Level 2) are available through AWS Artifact (requires AWS account login) 

The ESAs have signaled that they will continue monitoring and analyzing major incidents, provide additional guidance to competent authorities, and support greater supervisory convergence. The oversight framework for CTPPs, now operational, will provide additional data that can be analyzed alongside this incident reporting. 

For compliance leaders, the message I take from this report is clear: year one was about standing up the reporting infrastructure. Year two will be about demonstrating that you can use it effectively, consistently, and at the quality level supervisors expect. The entities that treat 2026 as a maturation year rather than a maintenance year will be in the strongest position when the first supervisory benchmarking begins. 

 

© 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved. This document is provided for informational purposes only. It does not constitute legal advice. Customers should consult their own legal counsel for guidance on regulatory compliance. 

 

Source: ESAs 2025 Report on Major ICT-Related Incidents (JC 2026 16, published 03 June 2026) 

https://www.eiopa.europa.eu/publications/esas-joint-report-major-ict-related-incidents-2025_en