DORA Compliance Costs: The EUR 2-5 Million Question Nobody Wants to Answer

The Number Everyone Quotes and Nobody Believes

EUR 2-5 million. That is the compliance cost estimate cited by 96% of respondents in the Deloitte European DORA Readiness Survey. It has become the industry's default answer — convenient, widely repeated, and misleading.

The figure captures the direct program expenditure that fits inside a compliance budget line item: gap assessments, policy drafting, technology procurement, and consultant fees. It does not capture the structural cost increases that DORA embeds into the operating model. It does not capture the opportunity cost of diverting senior technical staff from revenue-generating projects. It does not capture the ongoing run cost of maintaining compliance in a regulation that demands continuous — not annual — assurance.

McKinsey's operational assessment provides the more revealing data point: 70% of financial institutions expect permanently higher run costs for their IT and control functions as a direct result of DORA. This is not a one-time implementation expenditure. It is a structural increase in the cost of operating a regulated financial institution in the European Union.

One large European financial group — a G-SIB with operations across multiple EU jurisdictions — reports nearly EUR 100 million in total DORA program spend. That figure, disclosed in investor communications, includes technology investment, organizational restructuring, third-party risk management infrastructure, and the consulting engagements required to coordinate implementation across dozens of legal entities.

The EUR 2-5 million estimate is not wrong. It is incomplete. This analysis dissects what DORA actually costs, why costs vary by orders of magnitude across institution types, and where the hidden cost drivers live.

Anatomy of DORA Compliance Spending

DORA compliance costs decompose into five categories, each with distinct cost dynamics:

The distribution shifts dramatically by institution size. For a Tier 1 institution, technology and infrastructure dominate because the complexity of integrating DORA requirements into existing enterprise architecture is substantial. For a Tier 3 institution, external advisory costs often dominate because the institution lacks internal regulatory expertise and must procure it entirely from outside.

The FTE Reality: 40% Dedicate More Than 7 Staff

McKinsey's finding that 40% of institutions dedicate more than 7 full-time employees to DORA compliance deserves scrutiny. Seven FTEs, at a fully loaded cost of EUR 100,000-150,000 per person in Western Europe, represents EUR 700,000-1,050,000 annually in personnel costs alone — before any technology, consulting, or testing expenditure.

These are not temporary project roles. DORA requires ongoing operational functions:

• Third-party risk management requires continuous register maintenance, vendor assessment cycles, concentration risk monitoring, and contract governance. A mid-size bank with 200+ ICT vendor relationships needs 2-3 FTEs for this function alone.

• Resilience testing requires programme management, scenario development, test execution, evidence collection, and results integration into the risk framework. Art. 25 mandates at least annual testing of all ICT systems supporting critical functions. For institutions subject to TLPT (Art. 26-27), add specialized red team coordination.

• Incident management requires 24/7 detection capability, classification expertise, and the ability to produce regulatory reports within the 4-hour initial notification window (Art. 19(4)(a)). This typically requires at least 2 FTEs plus on-call rotations.

• Governance and reporting requires framework maintenance, management body reporting (Art. 5(2)), audit trail integrity, and regulatory correspondence. This is at minimum 1 FTE for any institution above microenterprise scale.

These figures represent steady-state annual costs after initial implementation. The implementation phase typically adds 50-100% to the first two years.

The Technology Stack: Build, Buy, or Suffer

DORA's operational requirements create demand for technology capabilities that most institutions did not have pre-regulation:

Evidence management. Art. 11 requires evidence of recovery capability. Art. 24-25 require evidence of testing. Art. 28(3) requires a structured register. These artifacts must be integrity-protected, version-controlled, and audit-ready. Spreadsheets and shared drives — the industry's default tools — cannot provide chain-of-custody, tamper detection, or reproducible audit exports.

Incident classification and reporting. Art. 18-20 specify classification criteria and reporting templates. The 4-hour initial notification window requires automated detection pipelines, structured severity assessment, and pre-formatted report generation. Manual processes that work for annual audits break under real-time reporting obligations.

Testing orchestration. Art. 24-25 require structured testing programmes with defined scenarios, evidence collection, findings management, and remediation tracking. A testing programme that exists only in a project manager's head is not auditable.

Third-party risk management. Art. 28-29 require not just a register but ongoing risk assessment, concentration analysis (Art. 29), exit strategies (Art. 28(8)), and contractual governance (Art. 30). The data model for this — linking vendors to services to functions to contracts to risk assessments — exceeds what any spreadsheet can maintain with integrity.

The GRC (Governance, Risk, and Compliance) technology market reflects this demand. Industry analysts project the global GRC market at USD 21 billion in 2025, growing to USD 42 billion by 2031 at a 12.3% CAGR. DORA is a significant driver of the European segment of this growth — one estimate puts incremental RegTech spending attributable to DORA at USD 3-4 billion between 2025 and 2028.

The build-versus-buy decision is consequential. Building a DORA-grade compliance platform internally — with evidence integrity, workflow governance, RBAC, audit trails, and regulatory reporting — is a multi-year, multi-million-euro engineering effort. Buying introduces vendor dependency and integration complexity. But the cost of neither building nor buying — of operating on spreadsheets and email — is measured in audit findings, regulatory actions, and the person-days consumed by manual processes.

The Hidden Cost: Operational Drag

The most underestimated cost of DORA compliance is not a budget line item. It is the operational drag imposed on the institution's ability to execute its primary business.

Consider a mid-size bank launching a new digital lending product. Pre-DORA, the technology team would build, test, and deploy. Post-DORA, the launch requires:

• ICT risk assessment of all new systems and third-party dependencies (Art. 8)
• Update to the Register of Information for any new ICT service providers (Art. 28(3))
• Resilience testing of the new platform covering critical function support (Art. 25)
• Business continuity assessment including RTO/RPO for the new service (Art. 11)
• Third-party due diligence for any new vendor supporting the product (Art. 28)
• Evidence collection and documentation throughout (Art. 5-6)

None of these requirements is unreasonable. Each serves a legitimate resilience objective. But in aggregate, they add weeks to project timelines and require coordination across compliance, risk, IT, and business functions that were not previously in the critical path for product launches.

This operational drag is the structural cost increase that McKinsey's 70% figure captures. DORA does not just add a compliance function — it inserts compliance considerations into every technology decision, every vendor selection, every infrastructure change, and every product launch.

A Cost Framework: The DORA Budget Model

For institutions building or refining their DORA budget, the following framework maps cost drivers to DORA pillars:

Total annual steady-state range for a mid-size bank: EUR 1.5M-3.75M. Implementation surge (Year 1-2): 1.5-2x annual cost.

The ROI Argument: Cost of Non-Compliance

DORA's penalty framework provides the negative ROI calculation. Art. 50-64 authorize national competent authorities to impose sanctions including:

• Financial entities: up to 2% of total annual worldwide turnover
• Individuals (including board members): up to EUR 1,000,000
• Critical ICT third-party providers: up to EUR 5,000,000
• Daily penalties: up to 1% of average daily worldwide turnover for ongoing non-compliance

For a bank with EUR 5 billion in annual revenue, 2% represents EUR 100 million — a figure that makes even the largest DORA compliance programme look like a rounding error. But fines are the least interesting cost of non-compliance.

The real costs are operational: the three-day Barclays outage in January 2025 that resulted in GBP 5-7.5 million in customer compensation; the reputational damage when UK MPs demanded bank executives explain their IT failures; the supervisory scrutiny that follows a major incident and consumes management attention for quarters.

The institutions that have completed their ROI analysis consistently reach the same conclusion: DORA compliance is not cheap, but the cost of non-compliance — in fines, incidents, reputation, and supervisory friction — is materially higher.

What Smart Institutions Are Doing Differently

Institutions that have managed DORA costs most effectively share common strategies:

1. Platform consolidation over point solutions. Rather than procuring separate tools for each DORA pillar, leading institutions invest in integrated platforms that serve multiple requirements — evidence management, testing orchestration, third-party risk, and incident reporting — from a unified data model. The upfront cost is higher; the total cost of ownership is lower.

2. Automation of recurring obligations. The Register of Information (Art. 28(3)) must be maintained continuously. Incident reports must be generated within hours. Testing evidence must be collected and catalogued. Institutions that automate these recurring obligations reduce the FTE burden and improve consistency.

3. Integration with existing frameworks. DORA does not exist in isolation. Institutions with mature ISO 27001, ISO 22301, or NIST frameworks can map existing controls to DORA requirements, reducing the net-new compliance effort. The work is in gap analysis and augmentation, not ground-up construction.

4. Proportionate scoping. Art. 4's proportionality principle is an explicit invitation to calibrate effort to risk profile. Institutions that rigorously scope their DORA programme — focusing resources on critical functions and important third-party relationships — avoid the trap of applying maximum effort to every requirement regardless of materiality.

5. Investment in internal capability. The long-term cost trajectory favors institutions that build internal expertise over those that remain dependent on external advisors. McKinsey's 7+ FTE figure reflects the reality that DORA requires permanent operational capability, not periodic consulting engagements.

The Market Response: USD 21 Billion and Growing

The GRC market's projected growth from USD 21 billion in 2025 to USD 42 billion by 2031 is not a coincidence. DORA, alongside NIS2, the AI Act, and evolving Basel requirements, is creating sustained demand for compliance technology that can operate at regulatory speed and scale.

The USD 3-4 billion in incremental RegTech spending that DORA is expected to generate between 2025 and 2028 represents a structural shift in how financial institutions procure and operate compliance infrastructure. The era of annual audit preparation — where compliance was a periodic exercise rather than an operational discipline — is ending.

For CFOs and COOs evaluating DORA budgets, the strategic question is not "how much does compliance cost?" but "what does a resilient, auditable, continuously compliant operating model cost — and how much of that investment also reduces operational risk, improves incident response, and strengthens the institution's competitive position?"

The institutions that frame DORA spending as pure regulatory cost will optimize for minimum compliance. The institutions that frame it as operational resilience investment will build capabilities that serve them well beyond the regulation's specific requirements.

---

Cost figures reflect 2024-2025 industry data from Deloitte, McKinsey, and public disclosures. Individual institution costs vary significantly based on size, complexity, existing maturity, and jurisdiction. This analysis does not constitute financial advice.

---