Key takeaways
- Since 17 January 2025, entities across the financial sector must comply with the Digital Operational Resilience Act (DORA).
- While DORA harmonises the substantive rules of the EU's digital operational resilience framework, the Act delegates the imposition of principle-based administrative penalties to the Member States under Article 50 of DORA. This has resulted in considerable divergence across Member States.
- The national regimes on administrative penalties differ considerably in terms of maximum monetary amounts, as well as the granularity of penalty regimes. These national differences may be relevant to financial entities in conducting risk assessments in relation to compliance with DORA.
Administrative penalties under DORA
As we reported in our previous briefing, since 17 January 2025 entities have been required to comply with Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector (Digital Operational Resilience Act / DORA). That briefing also explores how different Member States have implemented DORA into their national frameworks.
This briefing looks at one specific aspect of these frameworks: administrative penalties.
Article 50 of DORA lays down rules on administrative penalties. It requires Member States to implement national rules establishing 'appropriate administrative penalties' for breaches of DORA and to ensure their effective implementation. In addition, penalties must be 'effective, proportionate and dissuasive', which are common principles in European legislation (see for example the General Data Protection Regulation).
As DORA does not complement these principle-based rules with bright-line rules that set clear bounds, Member States have significant discretion regarding the maximum monetary amount that can be imposed under administrative penalties.
Differences across Member States1
The national regimes on administrative penalties differ considerably in terms of maximum monetary amounts, as well as the granularity of the statutory provisions regarding the calculation of penalties. Possible differences or similarities in supervisory practices, have not been
and then 