DORA Compliance in Brussels

Brussels is the regulatory capital of the European Union and home to SWIFT (the backbone of global interbank messaging), Euroclear (one of the world's largest securities settlement systems), and major Belgian banks including KBC, Belfius, and ING Belgium. The European Commission, which drafts EU financial regulation including DORA and NIS2, is headquartered here. Belgium's dual supervisory model — FSMA for markets and NBB (National Bank of Belgium) for prudential oversight — adds national requirements on top of EU frameworks.

Request a demo
100+
Banks
45M+
SWIFT daily messages
20,000+
Finance employees
Yes
EU regulatory capital

Why DORA matters in Brussels

The Digital Operational Resilience Act (DORA) requires financial entities to implement comprehensive ICT risk management frameworks, including incident reporting, resilience testing, and third-party oversight. Mandatory since January 17, 2025, it applies to over 22,000 financial entities across the EU.

SWIFT processes over 45 million financial messages daily and is arguably the most systemically important financial infrastructure in the world — making its DORA compliance critical for global financial stability. Euroclear settles over EUR 1 quadrillion annually in securities transactions. Brussels-based institutions face unique pressure because the European Commission, European Council, and European Parliament are all local, meaning regulatory enforcement is literally in their backyard. Belgium's NIS2 transposition through the NIS2 Law of April 2024 was among the first in the EU, creating early compliance obligations.

Supervisory Bodies

FSMA, NBB (National Bank of Belgium)

Key Industries

  • Financial Market Infrastructure
  • Banking
  • Securities Settlement
  • EU Regulatory Affairs

Notable financial institutions in Brussels

SWIFTEuroclearKBCBelfiusING BelgiumEuropean CommissionDegroof PetercamArgenta

DORA Key Requirements

ICT risk management framework (Art. 5-16)
Major incident reporting to BaFin within 4 hours (Art. 17-23)
Threat-led penetration testing / TLPT every 3 years (Art. 24-27)
Register of all ICT third-party providers (Art. 28-44)
Cyber threat information sharing (Art. 45)
ICT business continuity and disaster recovery plans