Since January 2025, banks, insurers, investment firms, payment companies and crypto-asset service providers across the European Union have been operating under the Digital Operational Resilience Act (DORA). Unlike older guidance, DORA is a regulation with direct legal force, and supervisors are now checking how firms put it into practice.
DORA never uses the phrase "dark web monitoring". But several of its articles require exactly what dark web monitoring delivers: continuous identification of external ICT risk, intelligence on cyber threats, early detection of incidents, and visibility into third-party exposure. This guide explains those requirements and shows where dark web intelligence fits.
This article explains how dark web monitoring can support DORA compliance. It is not legal advice. Confirm your specific obligations with your compliance team and national competent authority.
What Is DORA?
DORA, formally Regulation (EU) 2022/2554, sets a single set of rules for how financial entities manage ICT and cyber risk. It applies to around 20 types of financial entity, including credit institutions, payment and e-money institutions, investment firms, insurers and reinsurers, crypto-asset service providers and trading venues. It also brings the most important technology suppliers to the financial sector under direct EU oversight.
Because DORA is a regulation, not a directive, it applies directly in every member state without national transposition. Where a financial entity also falls under NIS2, DORA is treated as the sector-specific law that takes precedence on these topics.
The Five Pillars of DORA
Where DORA Expects Threat Intelligence
Several articles in the ICT risk management chapter assume that a firm looks outward, not just at its own systems:
Article 8: Identification
Financial entities must identify all sources of ICT risk on a continuous basis. Leaked employee credentials, exposed customer data and access to your network being offered for sale are external sources of ICT risk that only show up outside your perimeter.
Article 10: Detection
Firms need mechanisms to promptly detect anomalous activities. A stealer log containing an employee's VPN login, or your domain appearing on a ransomware leak site, is often the first sign that something is wrong.
Article 13: Learning and evolving
DORA requires firms to have the capabilities and staff to gather information on vulnerabilities and cyber threats, and on ICT-related incidents, particularly cyber attacks, and to analyse their likely impact. This is a direct requirement for a threat intelligence function.
Article 45: Information sharing
Financial entities may share indicators of compromise, attacker tactics, alerts and configuration tools with each other in trusted communities, subject to confidentiality, GDPR and competition rules. They must tell their competent authority when they join or leave such an arrangement. Dark web findings, such as a credential dump targeting several banks, are exactly the kind of intelligence these communities exchange.
Mapping Dark Web Monitoring to DORA Articles
Incident Reporting: Why Early Detection Matters
Under the ESAs' technical standards, once a financial entity classifies an incident as major it has tight deadlines:
- Initial notification within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it.
- Intermediate report within 72 hours of the initial notification.
- Final report within one month of the intermediate report.
Those clocks start from awareness and classification. A firm that only learns about a breach when customer data is posted on a leak site, weeks after the intrusion, is already far behind. Dark web monitoring shortens that gap: an alert that your domain is on a ransomware group's site, or that a database containing your customers' records is being sold, can trigger classification much earlier.
DORA also allows firms to voluntarily notify their competent authority of significant cyber threats that have not yet caused an incident. Credible dark web intelligence, such as network access to your organisation offered for sale, is a good example of a threat worth flagging.
When a leak site claims to hold your data, supervisors will want to know what was taken and how you assessed it. Monitoring that captures listing dates, samples and context gives your incident team the evidence it needs for accurate reports.
Third-Party Risk and Critical ICT Providers
DORA makes financial firms responsible for the ICT risk introduced by their suppliers. They must keep a register of information covering all ICT third-party contracts and monitor those relationships throughout their lifecycle.
DORA also created EU-level oversight of the most important suppliers. Between April and November 2025 the European Supervisory Authorities designated 19 critical ICT third-party providers, and published the list on 18 November 2025. These providers are now overseen directly at EU level, with a lead overseer assigned to each.
For your own supply chain, dark web monitoring helps answer questions a contract cannot:
- Have any of our IT providers or outsourcers had employee credentials leaked?
- Is a supplier listed on a ransomware leak site?
- Is data we shared with a vendor now being sold?
Ransomware groups increasingly attack service providers to reach their clients, so supplier exposure is a direct risk to you. See our guide to dark web monitoring in third-party risk management.
Threat-Led Penetration Testing
Larger and systemically important financial entities must carry out threat-led penetration testing (TLPT) at least every three years. TLPT follows the approach of the TIBER-EU framework: before the red team tests anything, a threat intelligence phase identifies which attackers are likely to target the firm and how.
Dark web intelligence makes that phase realistic. It shows which of your credentials are already exposed, which access brokers are advertising financial-sector targets, and which ransomware groups are active against similar firms. Test scenarios built on that evidence reflect real attackers rather than generic assumptions.
Building a DORA-Aligned Monitoring Program
- Define what to watch. Domains, executive and employee emails, customer identifiers, brand names, IP ranges, and key suppliers from your register of information.
- Connect alerts to your incident process. Make sure a high-severity dark web alert feeds into the same classification workflow used for DORA reporting.
- Document decisions. Record how each significant finding was assessed and what action followed. Supervisors expect evidence, not just tools.
- Include suppliers. Extend monitoring to critical ICT providers and outsourcers, and agree how you will notify them.
- Feed testing and sharing. Use findings in TLPT threat intelligence and, where appropriate, share indicators through your Article 45 arrangements.
- Report to the board. DORA makes the management body ultimately responsible for ICT risk. Summarise exposure trends in board reporting.
DarkThreat helps financial firms monitor stealer logs, forums, Telegram channels and ransomware leak sites for exposure of their domains, staff, customers and suppliers. Learn more on our financial services page or see DarkThreat plans.
Key Takeaways
- DORA has applied since 17 January 2025 to around 20 types of EU financial entity.
- Articles 8, 10 and 13 require continuous risk identification, prompt detection and threat intelligence capability.
- Major incidents must be reported within 4 hours of classification, so earlier detection matters.
- Firms remain responsible for supplier risk, and 19 critical ICT providers are now under EU oversight.
- Dark web monitoring supports detection, reporting evidence, TLPT intelligence, third-party risk and information sharing.
Frequently Asked Questions
Does DORA explicitly require dark web monitoring?
No. DORA is technology-neutral and does not name specific tools. It does require continuous identification of ICT risk, threat intelligence gathering and prompt detection, and dark web monitoring is one practical way to meet those requirements for external threats.
Who does DORA apply to?
It covers around 20 types of EU financial entity, including banks, payment and e-money institutions, investment firms, insurers, crypto-asset service providers and trading venues, plus critical ICT third-party providers designated for EU oversight.
How does DORA relate to NIS2?
For financial entities covered by both, DORA acts as the sector-specific law and takes precedence on ICT risk management and incident reporting. Non-financial companies are more likely to fall under NIS2.
Can dark web findings trigger a DORA incident report?
They can trigger an investigation that leads to classification. If the investigation confirms a major ICT-related incident, the reporting deadlines apply. Credible threats that have not yet caused an incident can be reported voluntarily.
Should we share dark web findings with other banks?
DORA encourages sharing cyber threat intelligence within trusted communities under Article 45, provided confidentiality, data protection and competition rules are respected, and your competent authority is notified of your participation.
Related Resources
- Dark Web Monitoring for European Businesses Under NIS2
- Cyber Resilience Act: Dark Web Intelligence Requirements for EU Businesses
- Dark Web Threat Intelligence for Financial Services CISO Teams
- Dark Web Monitoring as Part of Your Third-Party Risk Management Programme
- GDPR Breach Notification and Dark Web Monitoring: A Compliance Guide
Sources
- DORA Regulation (EU) 2022/2554, Article 45: Information-sharing arrangements
- Morgan Lewis: Preparing for DORA, ESAs publish incident reporting requirements
- Finance Magnates: EU regulators advance third-party ICT oversight under DORA
- EIOPA: European Supervisory Authorities designate critical ICT third-party providers
- NCC Group: How cyber threat intelligence enhances DORA compliance efforts
