DORA ICT Requirements for an EMI Licence: What the Application and the First Year Need
DORA applies to every e-money institution from 17 January 2025: ICT risk framework, incident reporting in 4 and 24 hours, testing, ICT register.
DORA, the EU Digital Operational Resilience Act (Regulation (EU) 2022/2554), has applied to every electronic money institution since 17 January 2025, including EMIs exempted under the E-Money Directive. An EMI applicant therefore writes its ICT and security file to DORA from the start: an ICT risk management framework approved by the management body, an incident process that reports major incidents within 4 and 24 hours, a yearly testing programme, and a register of every ICT contract.
INNOVA prepares the security side of an EMI licence: the policies, the risk register and the technical measures, while the licence file itself runs through our licensing practice. An EMI licence takes six to twelve months end to end in our Fintech Launch package; the provider contracts and the regulator's questions set the final pace.
Applying for an EMI licence? We write the ICT and security part to DORA and run the licence file with our licensing practice. EMI licence in Estonia → · Book a paid 30-minute consultation (USD 99, credited to the project)
Does DORA apply to an e-money institution?
Yes. Article 2(1) of DORA lists "electronic money institutions, including electronic money institutions exempted pursuant to Directive 2009/110/EC" among the financial entities it covers, and Article 64 sets the date of application at 17 January 2025. The regulation is directly applicable in every Member State, so an EMI licensed in Estonia, Lithuania or any other EU country applies the same text.
Two groups get lighter rules:
- Exempted (small) EMIs apply the simplified ICT risk management framework of Article 16 in place of Articles 5 to 15, detailed in Title III of Commission Delegated Regulation (EU) 2024/1774.
- Microenterprises, financial entities with fewer than 10 staff and an annual turnover and/or balance sheet total of up to EUR 2 million (Article 3(60)), are spared several duties, such as the independent ICT risk control function of Article 6(4) and parts of the testing programme.
A fully authorised EMI applies the whole framework, in proportion to its size and risk profile (Article 4).
The five DORA areas and what an EMI needs in each
| DORA area | Articles | What the EMI must have | Documents in the file |
|---|---|---|---|
| ICT risk management | 5–16; RTS 2024/1774 | A documented ICT risk management framework, a digital operational resilience strategy, the management body's approval and oversight, an ICT risk control function | ICT risk management framework, resilience strategy, ICT security policies, ICT risk register, board approval minutes |
| ICT incident management and reporting | 17–23; RTS 2024/1772 and 2025/301 | A process to detect, classify and log ICT incidents, and to report major ones to the competent authority | Incident management procedure, classification matrix, reporting templates and roles |
| Digital operational resilience testing | 24–27 | A risk-based testing programme; tests at least yearly on the ICT systems that support critical or important functions | Testing programme, test plan for the first year, remediation log |
| ICT third-party risk | 28–30; ITS 2024/2956 | A strategy on ICT third-party risk, a register of information on every ICT contract, the contract clauses of Article 30 | Register of information, third-party policy, contract gap list for each provider |
| Information sharing | 45 | Voluntary arrangements to exchange cyber threat information | Note on whether and how to join |
What sits inside the ICT risk management framework
Commission Delegated Regulation (EU) 2024/1774 lists the policies and procedures the framework contains. For an EMI the document set usually covers:
- ICT asset management: an inventory of information and ICT assets and their classification;
- encryption and cryptographic key management;
- ICT operations, capacity and performance management;
- vulnerability and patch management;
- data and system security, logging, and network security;
- ICT project management, systems acquisition and development, and change management;
- physical and environmental security;
- identity management and access control, with strong authentication for remote and privileged access;
- the ICT business continuity policy, its testing, and ICT response and recovery plans;
- backup policies and restoration (Article 12 of DORA).
The management body defines, approves and oversees all of it and bears the ultimate responsibility for the EMI's ICT risk (Article 5(2)). Board minutes that record the discussion and approval of each policy show that this duty is met.
Incident reporting deadlines under DORA
A major ICT-related incident goes to the competent authority in three steps, set by Commission Delegated Regulation (EU) 2025/301:
| Report | Deadline |
|---|---|
| Initial notification | within 4 hours of classifying the incident as major, and no later than 24 hours after the EMI became aware of it |
| Intermediate report | within 72 hours of the initial notification, and again when regular activities are recovered |
| Final report | no later than one month after the latest intermediate report |
Classification follows the criteria and thresholds of Delegated Regulation (EU) 2024/1772. The incident procedure names who classifies, who signs and who sends, including at weekends.
Testing: yearly tests and threat-led penetration testing
DORA asks every EMI that is not a microenterprise to run a risk-based testing programme carried out by independent internal or external testers, and to test all ICT systems and applications that support critical or important functions at least yearly (Article 24). Article 25 lists the kinds of test, among them vulnerability assessments and scans, network security assessments, gap analyses, scenario-based tests, source code reviews where feasible, and penetration testing.
Threat-led penetration testing (TLPT) at least every three years applies only to the financial entities the competent authorities identify under Article 26(8); exempted EMIs and microenterprises fall outside it (Article 26(1)).
ICT providers: the register of information and the contracts
Every EMI keeps a register of information on all its contractual arrangements for ICT services, at entity level, and shows separately those that support critical or important functions (Article 28(3)). The templates are fixed by Commission Implementing Regulation (EU) 2024/2956. The EMI reports on new arrangements to the competent authority at least yearly.
Article 30 lists what each ICT contract must contain, such as the description of services and subcontracting, the locations where services run and data is processed, data protection and return of data, service levels, the provider's assistance in an ICT incident, cooperation with the authorities and termination rights. A new EMI usually builds its stack from cloud, core banking and KYC providers, so each provider's standard terms are checked against Article 30.
What the Estonian EMI application asks about ICT
Finantsinspektsioon's list of documents for a payment or e-money institution licence asks for "data on the information technology and other technological equipment and systems, security systems, and control mechanisms", and for a description of internal controls and measures to ensure compliance with anti-money laundering rules. It takes its decision within three months of receiving all the documents and data, and no later than six months after the application. An EMI also holds initial capital of at least EUR 350,000 at the time of authorisation (Directive 2009/110/EC, Article 4). The full licence route is on EMI licence in Estonia.
DORA and ISO/IEC 27001
DORA sets its own requirements and makes no certification mandatory, ISO/IEC 27001 included. The RTS on the ICT risk management framework asks financial entities to consider leading practices and, where applicable, standards, so an information security management system built on ISO/IEC 27001 covers a large part of the policies above. The register of information, the incident reporting deadlines and the management body's duties are DORA's own. See ISO 27001 readiness for a fintech company.
What INNOVA does and what it costs
Our cybersecurity practice prepares the policies, the risk register and the technical measures behind them; our licensing practice runs the EMI application. Every test of your systems starts with a scope letter signed by the system owner, and a person checks every finding before it reaches the report. We run our own information security management system built on ISO/IEC 27001:2022.
The cybersecurity work is a fixed quote once the scope is agreed. The Fintech Launch package on INNOVA pricing covers advisory on an EMI licence, the AML programme and the bank file. Related services: Cybersecurity and ISO/IEC 27001 readiness · EMI licence in Estonia
FAQ
Does DORA apply to a small or exempted e-money institution?
Yes. Article 2(1) covers electronic money institutions, including those exempted under the E-Money Directive. Exempted EMIs apply the simplified ICT risk management framework of Article 16 in place of Articles 5 to 15.
What ICT documents does an EMI need under DORA?
An ICT risk management framework with a digital operational resilience strategy, ICT security policies, an ICT risk register, a business continuity policy with response and recovery plans, a backup policy, an incident management and reporting procedure, a testing programme and a register of information on ICT contracts.
How fast must an EMI report a major ICT incident?
The initial notification goes within 4 hours of classifying the incident as major and no later than 24 hours after becoming aware of it. The intermediate report follows within 72 hours of the initial notification, and the final report no later than one month after the latest intermediate report.
Does a new EMI need threat-led penetration testing?
TLPT at least every three years applies only to the financial entities that the competent authorities identify under Article 26(8). Exempted EMIs and microenterprises fall outside it. Every EMI that is not a microenterprise still tests the systems that support critical or important functions at least yearly.
Is ISO/IEC 27001 certification required for an EMI licence under DORA?
DORA makes no certification mandatory. An ISMS built on ISO/IEC 27001 helps with the policies and controls, and the register of information, the incident reporting deadlines and the management body's duties still have to be written to DORA.
Who is responsible for DORA compliance inside an EMI?
The management body. Article 5(2) says it defines, approves, oversees and is responsible for the implementation of the ICT risk management framework and bears the ultimate responsibility for managing the EMI's ICT risk.
Next steps
Tell us the country of the licence, the services you plan and the IT providers you have chosen. We reply in writing within 24 hours; the exact fee follows in writing once we have scoped the task. Cybersecurity and ISO/IEC 27001 readiness → · Contact us
Related: ISO 27001 readiness for a fintech company, Choosing a jurisdiction for a fintech, Crypto licensing in 2026.
Sources (checked 21 October 2026):
- Regulation (EU) 2022/2554 (DORA), Articles 2, 3(60), 4, 5, 6, 12, 16, 17–19, 24–26, 28, 30, 45, 64: eur-lex.europa.eu, CELEX 32022R2554
- Commission Delegated Regulation (EU) 2024/1774, ICT risk management tools, methods, processes and policies and the simplified framework: CELEX 32024R1774
- Commission Delegated Regulation (EU) 2024/1772, classification of ICT-related incidents: CELEX 32024R1772
- Commission Delegated Regulation (EU) 2025/301, content and time limits of incident reports, Article 5: CELEX 32025R0301
- Commission Implementing Regulation (EU) 2024/2956, register of information templates: CELEX 32024R2956
- Directive 2009/110/EC, Article 4 (initial capital EUR 350,000): CELEX 32009L0110
- Finantsinspektsioon, Operating licences for payment institutions and e-money institutions (page last edited 18 March 2026): fi.ee
For information only, checked against the EU texts and the Finantsinspektsioon page on 21 October 2026. The Commission's Digital Omnibus proposal of 19 November 2025 would change how incidents are reported; until an amendment is adopted and in force, the deadlines above apply.
This material is for general information only and does not constitute legal or tax advice. Accurate as of the publication date.