ProductsModulesPricingBlogAbout PL Log in See demo
DORA Compliance

DORA Fines. Up to 1% of daily turnover and Polish FSA (KNF) supervision.

DORA has applied to the financial sector directly since January 2025. For critical ICT providers it means periodic penalties counted as a percentage of turnover; for financial entities, administrative fines from the Polish FSA (KNF). Below: what is at risk, who is in scope, obligations, and a plan.

Sanctions

What a DORA violation costs

  • up to 1% / dayCritical ICT providers ; periodic penalty of up to 1% of average daily worldwide turnover, applied for a maximum of 6 months (Art. 35)
  • up to ~21 mln PLNFinancial entities ; administrative fines for violations, per the Polish DORA implementing legislation draft
  • up to ~3 mln PLNNatural persons ; personal liability for breach of obligations
  • remedial measuresPolish FSA (KNF) ; orders, requirements on providers, and supervisory actions (Art. 50 + national rules)

Based on Regulation 2022/2554 and the Polish DORA implementing legislation draft.

Scope

Who DORA applies to

Financial entities

Banks, investment firms, payment institutions and e-money institutions, insurance and reinsurance undertakings, fund managers, and other financial sector entities in the EU.

ICT providers

Critical third-party ICT service providers to the financial sector are subject to direct supervision and separate penalties.

From 17 January 2025

DORA is a regulation; it applies directly (no transposition needed). In Poland supervision is carried out by the Polish FSA (KNF).

Plan

Obligations and how to prepare

STEP 01

ICT risk management

ICT risk management framework, policies, roles and responsibilities, continuous monitoring.

STEP 02

ICT vendor register

Classification of critical functions, concentration risk, register in the format required by the Polish FSA (KNF) (SPR-PF-18).

STEP 03

Incident reporting

Classification and reporting of major ICT incidents to the supervisory authority within required timeframes.

STEP 04

Resilience testing

Regular testing; for significant entities also TLPT (threat-led penetration testing).

Vendor register, RTO mismatch, resilience testing, and Polish FSA (KNF) export ; all in the DORA module.

FAQ

Frequently asked questions about DORA fines

Against critical ICT providers the authority can impose periodic penalties of up to 1% of average daily worldwide turnover (for a maximum of 6 months). For financial entities administrative fines are provided; under the Polish implementing legislation draft these reach tens of millions of Polish zloty, and up to approximately 3 million PLN for natural persons.
Financial entities in the EU (banks, investment firms, payment institutions, insurers, and others) and critical third-party ICT service providers to that sector.
DORA has applied directly since 17 January 2025. In Poland supervision and sanctions rest with the Polish FSA (KNF) (Art. 50 and national rules).
Implement an ICT risk management framework, maintain a vendor register with critical function classification, report incidents, and test resilience. RealSec handles this operationally in one module.

DORA in practice, ready for the Polish FSA (KNF).

30-minute demo: ICT vendor register, concentration risk, RTO mismatch, and SPR-PF-18 export.

Book a demo → See the DORA module