DORA applies to all EU member state financial services and organizations, as well as their associated critical ICT providers. This includes credit institutions, payment institutions, electronic money institutions, investment firms, crypto-asset service providers, alternative investment funds, insurance managers, and ICT providers servicing covered entities.