When the Digital Operational Resilience Act (DORA) became fully applicable in January 2025, financial institutions across Europe faced a new reality. Banks, brokers, payment providers, crypto firms, and technology vendors were suddenly required to report major ICT incidents under a unified framework, conduct resilience testing, strengthen third-party oversight, and improve incident response capabilities.
Now, the European Supervisory Authorities (EBA, ESMA, and EIOPA) have published the first annual report on major ICT-related incidents under DORA, providing an unprecedented look at how resilient the financial sector really is after its first year of implementation. The findings reveal several surprising trends.
At first glance, the number may sound alarming. During 2025, financial institutions reported 3,383 major ICT-related incidents across the European Union. However, regulators stress that incident volume alone should not be interpreted as a sign of weakness.
In highly digitalised financial markets, operational incidents are inevitable. What matters is how quickly firms detect, contain and recover from them. And this is where the report becomes encouraging.
Risks Are Borderless
Financial services have become increasingly interconnected across Europe.
- 31% of all major incidents had a cross-border impact
- More than 1,000 incidents affected multiple countries
- Around 8% impacted more than 10 countries
This finding is particularly relevant for multi-jurisdiction brokers, cross-border payment providers, crypto exchanges, and trading infrastructure providers, all of which operate across interconnected markets and depend heavily on shared technology and service providers. A disruption originating in one market can quickly spread through shared technology platforms and vendor ecosystems.
This interconnectedness helps explain why regulators opted for a harmonized framework rather than a patchwork of national reporting standards.
- EU’s First DORA Review Finds One-Third of Financial ICT Incidents Spread Across Borders
- One Year After DORA, Brokers Are Playing Catch-Up
- As DORA Deadline Approaches, Broadridge Enhances Post-Trade Processing Capabilities
Cyber Threats Are Evolving
Although cybersecurity incidents accounted for only around 10% of all major incidents, they remain a significant concern. Among reported cyber incidents:
- DDoS attacks accounted for 33%
- Data theft, data manipulation, and identity theft accounted for 31%
- Social engineering, ransomware, and supply-chain attacks accounted for the remainder
Interestingly, regulators conclude that the relatively low number of cybersecurity incidents may indicate that existing security controls are generally effective.
However, this does not mean firms can afford to relax. The report specifically notes that institutions must continue strengthening their cybersecurity capabilities as attackers increasingly adopt AI-driven tools and automation.
Read the comprehensive breakdown of the review, in the full version on our FM Intelligence portal.
