.png&w=3840&q=75&dpl=dpl_Ba6pf7ueYcNioUvDkWkKkJsULeG7)
Does DORA apply to Swiss financial institutions?
Direct answer
Not to a Swiss institution as such. DORA (Regulation (EU) 2022/2554) applies to financial entities authorised in the EU, so a Swiss bank, insurer or asset manager falls under FINMA, not DORA. It applies in full to their EU subsidiaries, and it reaches Swiss ICT providers through the contracts their EU financial clients must sign.
Who DORA covers
Article 2 of DORA lists the financial entities in scope: credit institutions, payment and electronic money institutions, investment firms, crypto-asset service providers, insurance and reinsurance undertakings, fund managers, trading venues and more, all authorised under EU law. It has applied since 17 January 2025. Switzerland has not adopted DORA, and FINMA supervises Swiss institutions under Swiss law.
How DORA reaches Swiss groups and providers
- EU subsidiaries. A Swiss bank’s subsidiary authorised in Luxembourg, Germany or another member state is a financial entity under DORA and meets it in full, including the register of information and major incident reporting.
- ICT providers. A Swiss provider of ICT services to EU financial entities is not supervised under DORA, but its clients must include the contract terms of Article 30 and keep it in their register of information under Article 28. Expect audit rights, exit plans and incident cooperation clauses.
- Critical providers. A third-country ICT provider designated as critical under Article 31 must set up a subsidiary in the EU within 12 months of designation, or EU financial entities can no longer use its services.
What Swiss institutions follow instead
FINMA Circular 2023/1 on operational risks and resilience, in force since 1 January 2024, sets FINMA’s expectations for banks and securities firms on ICT and cyber risk, critical data, business continuity and operational resilience. FINMA Guidance 03/2024 sets how supervised institutions report cyberattacks: within 24 hours of discovery, then a full report within 72 hours. Many of the themes match DORA, but the texts, deadlines and supervisors differ. See DORA vs FINMA Circular 2023/1.
One programme for both in Acuna GRC
In Acuna GRC you adopt DORA and FINMA side by side in Comply and assign each to the legal entities it covers through scopes. Common Measures are mapped across frameworks, so a measure counts for each requirement it meets. The business impact analysis holds RTO, RPO and MTPD per process with the suppliers behind it, and the third-party register keeps tiering and the supply chain for both regimes. See FINMA compliance software.
How Acuna GRC handles it
Acuna GRC runs DORA and FINMA in one programme, with one business impact analysis and one provider register serving both.
- Solution
DORA
Keep one ICT third-party register, map critical processes with RTO and RPO, find single points of failure and follow ICT incidents in one place.
- Solution
FINMA
Map critical processes and recovery objectives, find single points of failure, manage outsourcing and ICT providers, and run FINMA next to DORA.
- Module
TPRM (Supplier Shield)
Suppliers, questionnaires, assessments and campaigns, with a supplier portal and supplier risk intelligence: daily scans condensed into an A to F grade, with breach and sanctions checks.
Sources
- Regulation (EU) 2022/2554 (DORA), Articles 2, 28, 30 and 31
- FINMA circulars, including Circular 2023/1 Operational risks and resilience
- FINMA guidance, including Guidance 03/2024 on cyber attack reporting
This page explains the rules in general terms and is not legal advice.
Frequently asked
Does a Swiss branch in the EU fall under DORA?
It depends on how the branch is authorised in that member state. Check with the competent authority there. An EU-authorised subsidiary is in scope.
We are a Swiss ICT provider to EU banks. What do we need?
Be ready for the Article 30 contract terms, information requests for your clients’ register of information, audits and incident cooperation. A current ISO 27001 certificate and a clear exit plan help.
Does FINMA require DORA compliance?
No. FINMA applies Swiss law, mainly Circular 2023/1 for operational resilience. Swiss groups with EU entities often align both to avoid two programmes.
See how Acuna GRC runs this.
Tell us your frameworks and your team. We show you how Acuna GRC runs the program.
Hosted in Switzerland, the EU or the US