# DORA

DORA, the EU Digital Operational Resilience Act, applies since January 2025 and obliges financial entities to manage ICT risk end to end, including the third-party technology providers they depend on. Vendor resilience, exit strategies, and concentration risk are now regulatory requirements, not preferences.

## What DORA means for custody technology choices

Banks must assess providers' resilience, avoid dangerous concentration, and keep credible exit and substitution options. Deployment freedom becomes a compliance property: on-premises capability, multi-cloud operation, and data portability all reduce the dependencies DORA scrutinizes.

Taurus is DORA-compliant as a provider, and the platform's deployment model, managed, on-premises, hybrid, and multi-cloud across providers, is designed to keep concentration risk and exit options in the bank's hands.

FAQ:

- Does DORA apply to custody technology vendors? Yes, through their bank clients: critical ICT third parties fall under the framework, and banks must contractually secure audit, resilience, and exit rights. Providers built for banking oversight absorb this; retrofitted ones struggle.

Related: https://www.taurushq.com/glossary/multi-cloud-deployment/ https://www.taurushq.com/glossary/on-premises-custody/ https://www.taurushq.com/glossary/isae-3402/

Learn more: https://www.taurushq.com/glossary/dora/