DORA for Fintech Startups
Whether DORA applies to a fintech depends on its regulated status, not its self-description. A fintech that is a licensed payment institution, e-money institution, investment firm or CASP is in scope under Article 2; an unregulated software vendor selling to financial entities is instead treated as an ICT third-party provider. DORA has applied since 17 January 2025.
"Fintech" is not a DORA category
DORA lists financial-entity types; "fintech" is a business descriptor. The right question is which regulated licence, if any, the firm holds, that determines whether it complies as a financial entity or supports its clients as an ICT third party.
Proportionality and microenterprises
In-scope fintechs that are microenterprises may use a simplified ICT risk-management framework and are generally outside mandatory TLPT, a meaningful relief for early-stage teams. Governance, incident reporting, and the third-party register still apply.
A common mix-up: "small" is not the same test for every entity type
Article 16 does not grant the simplified framework to every small fintech on headcount alone, it names specific categories, and the qualifying test differs by entity type. For investment firms, the route is being a small and non-interconnected investment firm under the Investment Firms Regulation (EU) 2019/2033. For payment and e-money institutions, the route is different and narrower: Article 16(1) only covers payment institutions and e-money institutions that are specifically exempted from full authorisation under PSD2 Article 32(1) or the E-Money Directive Article 9(1), the national regime for very small providers whose average monthly payment volume stays under a ceiling set at no more than EUR 3 million. A fintech holding a full payment or e-money authorisation, rather than this narrower exemption, does not qualify for the simplified framework under Article 16 no matter how few people it employs, since it is the exemption itself, not headcount or turnover, that Article 16(1) requires for these two entity types. Confirm which register entry your firm actually holds, exempted or authorised, before assuming the lighter-touch framework applies.
Selling to financial entities
If your fintech provides ICT services to banks or insurers, expect DORA-driven contractual demands (audit rights, exit strategies, sub-outsourcing controls) even when you are not directly regulated. See ICT third-party providers.
Frequently asked questions
Does DORA apply to every fintech?
No. It applies to fintechs that hold a relevant financial licence. Unregulated fintech vendors are covered indirectly as ICT third-party providers.
Do early-stage fintechs get proportionality relief?
Yes. In-scope microenterprises may apply a simplified ICT risk-management framework and are generally outside mandatory threat-led penetration testing.
We sell software to banks, does DORA affect us?
Indirectly but materially: your financial-entity customers must impose DORA contractual terms and register your services, so expect audit, exit, and security requirements.
Does a small payment institution automatically qualify for the simplified framework?
Not on size alone. Article 16(1) only extends the simplified framework to payment and e-money institutions that are specifically exempted from full authorisation under PSD2 Article 32(1) or the E-Money Directive Article 9(1), the regime for very small providers below roughly EUR 3 million in average monthly payment volume. A fintech holding a full payment or e-money authorisation does not qualify, regardless of headcount or turnover.