ĺ Intelligence
To keep up to date on ĺ webinars, events and industry and product news,
sign up today
Subscribe NowAs a compliance professional working in payments or financial services, you've already been living with DORA for over a year. If you've landed on this article, you're probably looking for ways to make staying compliant simpler and more manageable.
You may be:
If any of that sounds familiar, regulatory change management software can help. For payment firms and financial institutions, the right tool can streamline how you manage DORA compliance, especially over multiple jurisdictions.
This guide covers what makes DORA compliance difficult to manage, what good software should do about it, and how ĺ helps compliance teams move from reactive firefighting to structured, confident oversight.
In this article:
ĺ gives compliance teams a more reliable way to monitor DORA developments, manage obligations across jurisdictions, and document every action with a full audit trail. If your current process is showing its limits, book a demo to see how ĺ can help.
The (Regulation EU 2022/2554) has applied to EU financial entities since January 17, 2025. It establishes a unified framework for managing ICT risk across the financial sector, built around five pillars:
DORA applies to a wide range of entities, including banks, payment institutions, EMIs, investment firms, crypto asset service providers, and their critical ICT third-party service providers. If you're operating in the EU financial sector, it very likely applies to you.
DORA’s implementation period is over. Regulators are now evaluating whether firms can demonstrate they're complying with it accurately and consistently across every jurisdiction they operate in.
Year one reporting made clear how challenging full compliance can be in practice. When the European Supervisory Authorities (ESA) ran a , only 6.5% of nearly 1,000 participating firms successfully passed all 116 data quality checks. Common failures included:
With the second annual Register of Information deadline falling in , national competent authorities have made clear they expect materially better submissions. The margin for error is getting smaller, which means the risk of getting it wrong is now higher. Compliance teams need to prove they’re compliant and feel confident that they can keep up with future changes, too.
Without dedicated compliance software, DORA management typically falls to spreadsheets, email threads, and internal (and often informal) coordination between compliance and IT.
When you handle compliance in-house without a change management platform, you’ll likely run into these problems:
Managing DORA in a single jurisdiction is hard enough. Once you scale across Europe, the complexity multiplies since different jurisdictions have unique deadlines, filing formats, and requirements. This makes it challenging for compliance teams to stay on top of deadlines and implement the correct requirements, heightening the potential risk for errors.
Each National Competent Authority (NCA) sets its own collection timeline before forwarding to the ESAs by the end of March, and those timelines can shift year on year.
Take the Register of Information submission as an example. :
If you’re operating in multiple markets, it can be difficult to stay on top of these deadlines and requirements all at once, especially as they continue to evolve.
File format requirements diverge, too. Germany currently accepts XBRL or Excel, while Ireland accepts XBRL only. Submitting in the wrong format can result in a compliance failure, with potential fines attached.
Many compliance teams track this information manually across spreadsheets, local compliance contacts, and NCA websites in multiple languages. However, this can be a higher operational burden on the compliance team. And with so many moving pieces, it’s easier to miss deadlines or seemingly small secondary requirements you need to follow.
Most compliance teams have a solid grasp of the core DORA regulation. The harder task is systematically tracking the 12+ batches of RTS, ITS, guidelines, and Q&As the ESAs have published alongside it. These are the standards that create most of the actual compliance obligations in practice, and they include:
continue to be published and updated, and teams that only track the core regulation are at risk of missing most of the practical compliance work that’s buried in the details. As NCA scrutiny intensifies in 2026, it’s the secondary standards that will determine whether a firm's submissions hold up.
For example, have clarified dozens of highly specific points, including that certain fields assumed to be optional are mandatory and that non-branch financial entities must report "Not Applicable" rather than leaving fields blank. These are the kinds of details that don't appear in the core regulation but will determine whether a submission passes validation.
DORA creates a unique challenge that most regulations don't: it spans two entirely different functions within the same organisation. Compliance defines what's required, and then IT has to implement it.
In most firms, the handoff between those teams happens over email, in meetings, or on Slack. Everything is in different places, which becomes a headache (and a compliance risk) to manage and track. The process is naturally prone to human error, including key team members missing messages, essential updates getting buried in threads, and even spreadsheets accidentally being deleted.
These manual systems may seem to work until a regulator asks for evidence. Supervisors need to see a documented record showing when a requirement was identified, how it was assessed, and which actions were taken by specific team members. That’s difficult and time-consuming to prove when your team is stuck relying on disjointed processes.
DORA's requirements span systems, vendors, contracts, and operational processes that sit squarely in IT's domain, including ICT risk frameworks, resilience testing, third-party registers, and incident classification. Despite this, the compliance obligation, the deadline, and the enforcement risk belong to the compliance function. The challenge for compliance and IT to work together over multiple systems is difficult to tackle when nothing is in one place.
Since these standards continue to be published and updated, teams that only track the core regulation are missing most of the practical compliance work.
The challenge compounds further when you consider that DORA sits alongside a growing list of other EU regulations landing on the same team, including PSD3, AMLA, MiCA, NIS2, FIDA, and the AI Act. Each one brings its own secondary standards, deadlines, and monitoring requirements. Manual processes simply don't scale at the rate the regulatory calendar demands.
Staying current with DORA means monitoring NCA websites, ESA publications, legislative databases, and enforcement updates across every jurisdiction you operate in. For teams covering multiple EU member states, that's a significant research burden that only grows with every new jurisdiction added to the footprint.
Understandably, some compliance professionals have tried using AI tools like ChatGPT to surface information quickly and reduce research time. However, the reliability problem is hard to ignore. A deadline published two weeks ago may not be in the training data; incorrect or incomplete data is a common occurrence, and there's no audit trail showing how a conclusion was reached.
The result is that compliance teams end up spending a disproportionate amount of time gathering intelligence rather than acting on it. They’re bogged down verifying sources, cross-referencing NCA websites, and double-checking AI outputs instead of assessing impact and taking action. With a regulation where a missed deadline or incorrect interpretation carries enforcement consequences, that is not a sustainable position.
Instead of chasing updates across regulator websites, reconciling spreadsheets, and reconstructing timelines after the fact, compliance software that tracks DORA enables compliance teams to focus on assessing what matters and acting on it with a clear record of every decision made along the way.
Good DORA compliance software should:
ĺ is a specialist regulatory intelligence platform built for financial services compliance teams across payments, banking, and fintech. It combines AI-powered monitoring with experienced in-house regulatory analysts who review, interpret, and contextualise every development before it reaches the platform. That way, compliance teams spend less time chasing information and more time acting on it.
Here’s what that looks like:
Most regulatory monitoring tools will share links to documents, but ĺ’s regulatory horizon scanning tool will provide the details that you actually need to know.
Every DORA development — whether it's a new RTS batch, an NCA submission guidance update, an enforcement action, or a clarification Q&A — is identified by ĺ as soon as it’s published. It’s then reviewed by our in-house regulatory analysts before it's published on the platform. This ensures that there’s no risk of hallucinations or unverified summaries, which means there’s no need to spend time manually cross-referencing the original source for accuracy.
Every update is linked back to the primary source document, such as the NCA guidance, ESA publication, or legislative text that triggered it. That way, teams can validate conclusions and cite sources directly in internal reporting and regulatory submissions.
Updates are classified into three tiers so teams can prioritise immediately:
This means teams are never spending time on updates that don't require action, and they’re never at risk of missing the ones that do.
Beyond daily monitoring, ĺ's forward-looking Country Outlook reports provide deeper strategic context to help teams anticipate what's coming and plan ahead proactively. This can reduce last-minute scrambling down the road, giving your team more time to adapt to likely changes.
Many firms struggle with the hand-off process from compliance teams to IT, and ĺ Workspace directly addresses this problem.
When a DORA development requires action, Workspace lets compliance teams create a task directly from the regulatory update. You can assign that task to the right person — whether that's in compliance, IT, or legal — with full context attached. The person receiving the task can see exactly what triggered it, what's required, and when it's due.
Progress is tracked in one central place. Every review, decision, and action is documented in a built-in audit trail. When a regulator asks for evidence of how an ICT risk was identified, assessed, and mitigated, the answer isn't a folder of emails. Instead, you’ll have a structured record showing what happened, who was responsible, when it was completed, and which regulatory development triggered it.
For firms that have struggled with the compliance-to-IT handoff under DORA, this is a significant workflow improvement. The regulatory obligation and the operational action are connected from the start instead of being reconstructed after the fact.
ĺ isn’t just about tracking DORA: that’s just one piece of the puzzle. ĺ aims to track all the other EU and global regulations that may impact your business, too.
DORA, PSD3, AMLA, MiCA, NIS2, FIDA, and the AI Act are all covered on the same platform, with the same analyst-reviewed intelligence, three-tier classification, Workspace workflow, and audit trail. As the EU regulatory calendar grows, ĺ's coverage grows with it.
For compliance teams managing multiple regulations across multiple jurisdictions, this means you don’t have to:
Having everything in a means compliance teams aren’t reconciling outputs from different tools, rebuilding context when a new regulation lands, or managing fragmented audit trails across multiple systems. And because ĺ is browser-based with no IT implementation required, teams can get started quickly without an internal project or procurement delay.
ĺ is trusted by 500+ organisations across payments, gambling, banking, and fintech to manage regulatory change at the speed the market demands.
“With compliance, you're always having to determine what’s very urgent and what you need to read immediately. ĺ sends us great summaries so we can decide straight away whether it's something that requires our immediate attention to read now or later.” —-Comfort Balogun, Senior Compliance Analyst, Trust Payments
ĺ gives financial services compliance teams a more structured way to manage DORA's complexity. ĺ’s platform combines analyst-reviewed regulatory intelligence, intelligent prioritisation across NCAs and ESAs, a clear compliance-to-IT workflow, and a full audit trail in a single platform that covers DORA alongside every other EU regulation your team is responsible for.
Book a demo to see how ĺ can help your team stay ahead of DORA and act on change with confidence.
DORA compliance software offers a few essential functions:
The best DORA compliance platforms also manage the workflow between compliance and ICT systems teams. ĺ's Workspace, for example, allows you to create tasks from regulatory updates, track progress, and maintain a documented, audit-ready trail so firms can demonstrate their compliance process to regulators when required.
No, DORA compliance software can be useful even if your business falls within a single jurisdiction. Even firms in a single EU member state face the challenge of tracking 12+ batches of secondary technical standards, managing the handoff between compliance and IT, and keeping pace with ongoing NCA guidance and Q&As. They also face the same risks of missed secondary standards, documentation gaps, and unverified AI output.
The difference is that multi-jurisdictional firms face those risks multiplied by every additional country in their footprint, making DORA compliance software even more critical.
General-purpose AI tools fall short in four specific ways:
ĺ's content is validated by our in-house regulatory analysts before it reaches the platform. Every update is linked to the primary source document, so you can easily review all key requirements, and the full lifecycle of how your team responded to each development is documented in Workspace for full auditability.
The right platform depends on your firm's size, jurisdictional footprint, and regulatory scope. At minimum, it should cover the full secondary standards picture, support real-time deadline tracking across multiple NCAs, give compliance and IT a shared workflow with documented handoffs, and extend beyond DORA to the broader EU regulatory environment.
ĺ's does all of this and combines it with analyst-reviewed intelligence so your team always knows what a development means and how to streamline its implementation.
Threat-led penetration testing (TLPT) is one of DORA's advanced digital operational resilience testing requirements. It involves simulating real-world cyber threats and cyberattacks against your live production systems to identify vulnerabilities before they can cause operational disruptions. Unlike standard testing, TLPT must be conducted by qualified external testers and follows a specific methodology set out in the relevant RTS.
TLPT does not apply to all firms. It is targeted at significant financial institutions identified by their NCA, based on factors including size, systemic importance, and ICT risk profile. If your firm is in scope, the requirements are substantial, and incident response planning forms a critical part of the overall programme. ĺ monitors TLPT-related developments across all NCAs so your team is never caught off guard by a designation or a change in testing requirements.
