Is Your Crowdfunding Platform DORA-Ready?

The Digital Operational Resilience Act, better known simply as DORA, entered into application across the European Union on 17 January 2025. Regulation (EU) 2022/2554 establishes a binding rule‑set for every financial entity that relies on information and communication technology (ICT). 

If you raise capital online for start‑ups or community projects and your offer reaches at least a single EU resident, your platform needs to be DORA-compliant. In the article, we will check in more detail what it means and why it matters. 

What is DORA?

DORA requires banks, insurers, investment firms, crowdfunding platforms, financial service providers and their key ICT suppliers to prove they can withstand, respond to and recover from cyberattacks or system failures. This regulation ends fragmented national rules and sets a single, robust benchmark for operational resilience across Europe.

The Act requires firms to identify, protect, detect, respond and recover from ICT disruptions, which echoes the NIST Cybersecurity Framework but turns guidance into law. The rules are broad and cover governance, risk identification, incident reporting, threat‑led penetration testing, and the management of critical third‑party providers such as cloud hosts and API vendors.

Why crowdfunding platforms are in the spotlight

DORA lists more than 20 entity types, including crowdfunding service providers, along with banks, insurers and other entities. A modern crowdfunding portal is a fully‑fledged financial marketplace: it matches investors with issuers, holds sensitive personal data, processes payments and maintains secondary trading functions. A multi‑hour outage can strand hundreds of campaigns, freeze wallet balances and break legal disclosure deadlines.

The European Banking, Insurance and Securities Authorities (the ESAs) issued a joint roadmap (published on 18 February 2025) where they explain how they will designate and supervise critical third‑party providers (CTPPs), such as cloud, SaaS and infrastructure companies. 

The roadmap matters for the crowdfunding sector because many platforms run entirely on outsourced stacks, such as cloud compute, payment gateways, KYC modules, and marketing automation. If a provider is labelled “critical”, the firm and its supplier fall under direct ESA oversight.

5 DORA requirements for crowdfunding platforms

DORA organises its requirements into several categories. For crowdfunding operators, these requirements look as follows.

ICT risk management framework

The board of a financial entity must approve and review a policy that maps every critical process to its supporting technology. Backup frequency, patch cadence, encryption standards and recovery point objectives all move from best practice to legal mandate. Audit trails must show continuous control.

Incident classification and reporting

Financial entities shall have a classification of incidents based on such criteria as impact on users, data security, economics and prepare ways to mitigate the impact of such incidents.

Digital operational resilience testing (TLPT)

Mature platforms will face regular threat‑led penetration tests (not yet in force) supervised by joint examination teams. Tests must replicate tactics used by real attackers and cover both internal code and external interfaces. Weaknesses discovered must feed straight back into the risk framework.

Third‑party risk management

ICT providers may sub-contract third parties to ensure the proper functioning of all services. In such a case, a financial entity shall have a holistic and clear view of all the risks associated with subcontracting such services. On the other hand, the ICT provider has to ensure that its policies apply to all subcontractors.

Information sharing

DORA explicitly encourages sector‑wide sharing of threat intelligence. A phishing wave aimed at one portal should reach its peers quickly to limit investor harm.

Penalties for non‑compliance

Companies that don’t comply with DORA may be forced to pay of up to 1 % of average daily worldwide turnover (but not more than 2% of annual turnover), and for individuals, this fine may amount to $1,000,000. For a high‑volume equity crowdfunding site that earns just €3 million a year, those percentages can erase margins in weeks. More damaging is reputational fallout: campaigns migrate to competitors, investors withdraw, and exit valuations decrease.

Is your platform DORA-compliant? Readiness checklist

If you can meet the following requirements, your platform is DORA-compliant. 

• Keep the latest ICT audit logs.
• Map every microservice, database, and third‑party API, on which your platform relies. Assign a team or a specialist responsible for their operation and sustainability.
• Store crisis contact lists offline and review them quarterly.
• Review all contracts with ICT providers constantly and ensure they meet all regulatory requirements, such as DORA.
• Have backups and test them regularly to ensure that they are up-to-date and operational.
• Platforms processing retail payments and personal data should already plan for annual threat‑led tests, not the minimum three‑year cycle.

Legacy practice and DORA discipline

Earlier, speed was the most important thing for a crowdfunding platform: you launch a campaign quickly, help a project raise money, and get your part. That approach was successful, but it also led to the tolerance of so-called temporary architecture, when, for example, payment or security solutions were integrated quickly, without a proper revision.

DORA rejects improvisation. A platform that cannot trace every code change, prove segregation of environments, or show that its developers lack access to implement code in the production environment, fails the main requirement: continuity.

The main principles of DORA reflect long-standing financial discipline: protecting records, ensuring access to capital, and keeping markets stable. What’s changed is the nature of the threat today; it’s not balance-sheet failures but digital vulnerabilities that pose the greatest risk. Regulators are simply applying these proven principles to the digital age.

Timelines and roadmap

Although DORA became applicable in January 2025, the ESA roadmap sets some deadlines to implement different aspects of the act. The agencies plan to publish the first list of designated CTPPs by Q4 2025. Thus, affected providers have one year to prepare for full oversight. Platforms that rely on those providers must therefore complete contract renegotiations well before that list appears, or risk lock‑in to non‑compliant terms.

Build a reliable crowdfunding platform with LenderKit

LenderKit offers a white-label investment software designed to support the growth and scalability of crowdfunding businesses. Whether you’re launching an MVP, expanding across markets, or looking to improve operations, our software provides the foundation you need to manage investors, fundraisers, offerings and transactions in one customizable back office.

With LenderKit, you can:

• Automate capital raising processes and investor onboarding
  
• Manage offerings, payment statuses and export information for reports
  
• Choose the platform’s workflows and branding to fit your business model and identity
  
• Leverage third-party services like KYC, payment gateways and e-signature providers or request custom integrations
  
• Have the software deployed in cloud or on-premise environments based on your technical strategy

LenderKit is built to support compliance-driven platforms operating under different regulatory frameworks, including ECSPR, FCA, SEC/FINRA and others. While it’s not a compliance solution itself, it offers the features and flexibility that help platforms align with applicable regulatory and operational standards.