DORA Regulation (EU) 2022/2554 — Sectoral Amendments, Application, and Legislative References

The legislative function

Articles 59 to 63 amend five earlier EU Regulations. They connect sector-specific operational duties to DORA where ICT systems, ICT continuity, recovery, or network security are involved.

The sectoral rule does not disappear. A CCP, CSD, trade repository, or other entity still has its own operational objective. DORA becomes the referenced framework for the ICT component.

Three drafting actions

• Replaced: the Regulation supplies new wording.
• Deleted: the provision is removed; this slice does not state a substitute.
• Excluded: an RTS mandate is limited so ICT matters are dealt with elsewhere.

How to avoid overreading

Do not treat every operational-risk duty as an ICT duty. Several amendments expressly preserve rules for non-ICT operational risk while moving ICT-risk matters to DORA.

Status checkpoint

As of 24 July 2026, DORA is in force and has applied since 17 January 2025. This lesson nevertheless teaches the supplied Articles 59 to 64 in their own wording.

Two linked amendments

Article 59 replaces Annex I, Section A, point 4, then replaces Annex III, point 12. The first states the control requirement; the second describes the corresponding infringement.

Mandatory organisational controls

A credit rating agency shall have sound administrative and accounting procedures, internal control mechanisms, and effective procedures for risk assessment.

Exact ICT linkage

The agency shall have effective control and safeguard arrangements for managing ICT systems in accordance with Regulation (EU) 2022/2554.

What Annex III captures

The infringement description covers not having the listed procedures or arrangements. It also covers not implementing or maintaining required decision-making procedures or organisational structures.

Interpretation

Article 59 connects the agency's sectoral governance requirement and its infringement description to the same DORA-based management of ICT systems.

CCP organisational structure

Article 26(3) requires a CCP to maintain and operate an organisational structure ensuring continuity and orderly functioning, using appropriate and proportionate systems, resources, and procedures.

Those systems, resources, and procedures include ICT systems managed in accordance with Regulation (EU) 2022/2554. Article 26(6) is deleted.

CCP continuity and recovery

Article 34(1) requires an adequate business continuity policy and disaster recovery plan. It shall include DORA-aligned ICT continuity policy and ICT response and recovery plans.

A deliberate division of rulemaking

Article 34(3) excludes ICT business continuity policy and disaster recovery plans from ESMA's RTS mandate. Article 56(3) similarly excludes ICT-risk-management requirements from registration-detail RTS.

Trade repositories

Article 79 requires trade repositories to identify and minimise operational risk using appropriate controls, including DORA-managed ICT systems, and to maintain DORA-aligned continuity and recovery planning.

Trade repository infringements

Article 60 updates Annex I so failure to identify or minimise operational risk through systems, controls, and procedures including DORA-managed ICT systems is described as an infringement.

Failure to establish, implement, or maintain the required DORA-aligned continuity policy and disaster recovery plan is also described as an infringement. Annex I, Section II, point (c) is deleted.

Tier 2 CCP organisational failure

Annex III, Section II, point (c) covers failure to maintain an organisational structure ensuring continuity and orderly functioning, or failure to use appropriate and proportionate resources, systems, or procedures.

A specific recovery threshold

For a Tier 2 CCP, the plan must at least allow recovery of all transactions at the time of disruption, continued operation with certainty, and settlement on the scheduled date.

Core lesson

DORA alignment supports, rather than displaces, the sectoral objective: a CCP must preserve clearing operations and complete settlement despite disruption.

Operational risk across the CSD

Article 45(1) requires a CSD to identify internal and external operational-risk sources and minimise their impact, including across every securities settlement system it operates.

The CSD uses appropriate ICT tools, processes, and policies set up and managed under DORA, alongside relevant tools, controls, and procedures for other operational risks.

Continuity at two levels

Article 45(3) applies both to CSD services and to each settlement system. The arrangements include including ICT business continuity policy and ICT response and recovery plans established in accordance with Regulation (EU) 2022/2554.

Required recovery outcome

The plan shall recover all transactions and participants' positions at disruption, allowing continued operation with certainty and settlement on the scheduled date.

Non-ICT qualifier

The authority-notification duty in Article 45(6), and ESMA's Article 45(7) RTS mandate, concern operational incidents and risks other than in relation to ICT risk.

Three data reporting services

Article 62 covers an APA, a CTP, and an ARM. The same DORA security linkage appears in Article 27g(4), Article 27h(5), and Article 27i(3), respectively.

Exact compliance requirement

Each relevant provider shall comply with the requirements concerning the security of network and information systems set out in Regulation (EU) 2022/2554.

Technical-standard cross-references

Article 62 changes which organisational paragraphs are cited for APA, CTP, and ARM technical standards. This slice changes references; it does not set out the content of those organisational requirements.

Critical benchmarks only

Article 63 adds Article 6(6) to the Benchmarks Regulation for critical benchmarks. The scope qualifier must be retained.

The administrator shall have governance, control, and risk-assessment arrangements, including effective control and safeguard arrangements for managing ICT systems in accordance with Regulation (EU) 2022/2554.

Start with the entity

A cyber disruption may affect several infrastructures, but Articles 60 and 61 do not prescribe one identical sectoral outcome. Begin by identifying whether the entity is a CCP, trade repository, or CSD.

CCP outcome

A CCP needs continuity and orderly functioning, plus an adequate continuity policy and disaster recovery plan. A Tier 2 CCP plan must at least recover all transactions at disruption.

Trade repository outcome

A trade repository must identify and minimise operational-risk sources through suitable controls, and maintain continuity and recovery arrangements aimed at maintaining functions and timely recovery.

CSD outcome

A CSD plan must recover all transactions and participants' positions at disruption, enabling participants to operate with certainty and complete settlement on the scheduled date.

Method

Use this sequence: `entity -> amended article -> exact sectoral outcome -> DORA-linked ICT element`. It prevents a vague, one-size-fits-all description of resilience.

Three distinct ideas

Article 64 distinguishes entry into force, application, and direct applicability. These are related but not interchangeable legal concepts.

Application date

It shall apply from 17 January 2025. As of 24 July 2026, DORA already applies. Do not describe that date as future.

Legal effect

This Regulation shall be binding in its entirety and directly applicable in all Member States. Article 64 does not frame this as a national-transposition deadline.

Legislative procedure

Footnote (3) records the Parliament's position of 10 November 2022 and the Council decision of 28 November 2022. The phrase about not yet being published reflects the footnote's historical wording.

Reference map

The footnotes identify NIS2, the digital-operational-resilience amending Directive, GDPR, and the statutory-audits Directive. A cross-reference is not a complete statement of each referenced instrument's rules.