DORA: The Legislative Decree adapting the national legislation published in the Official Journal

In the Official Journal no. 58 of 11 March 2025, Legislative Decree no. 23/2025 in the body of which there is also the adaptation of national legislation to the non-directly applicable provisions of the DORA regulation, with the specification of the necessary interventions to adapt the national legislation in force.

The new regulation concerns financial entities and ICT service providers falling within the scope of application of the DORA Regulation.

The Authorities that assume responsibility for the application of this Regulation are indicated, including the receipt of incident reports and voluntary notifications, coordination with the NIS 2 and CER regulatory frameworks, as well as the supervisory powers and sanctions provided for financial entities and suppliers.

As far as is relevant here, the sanction regime introduced by the DORA decree provides two different legal frameworks based on the severity of the violation of the Regulation, with the application of higher administrative pecuniary sanctions in cases of violation of the provisions of the Regulation relating to governance and organisation, to the framework for the management of IT risks, to the identification, to the back-up policies and procedures - procedures and methods of restoration and recovery, to the simplified framework for the management of IT risks, to the process for managing incidents related to ICT, to the reporting of serious incidents ICT, the general requirements for carrying out digital operational resilience tests and, finally, also the technical regulatory and implementation standards.

Furthermore, unless the fact constitutes a crime, a pecuniary administrative sanction of up to 5 million euros is provided for persons carrying out administrative, management or control functions, as well as personnel, who have violated the Regulation, or up to double the amount of any superior advantage obtained by the subject, and also the accessory administrative sanction of disqualification, from 6 months to 3 years, from carrying out administration, management and control functions with intermediaries and companies authorized pursuant to the TUF, of TUB, of the Private Insurance Code, of Legislative Decree no. 252/2005 or at pension funds.