Regulatory news: Circular 285 fully enters the DORA era

La Bank of Italy Circular No. 285has for years represented the main regulatory reference for the organization, risk governance and internal control systems of Italian banks.
It is, in fact, the regulatory lintel through which prudential supervisory principles are translated into operational requirements, with direct impacts on governance, ICT, business continuity and overall resilience of intermediaries.

This is precisely why each of its updates is never merely formal, but reflects a substantive evolution of the regulator’s expectations.

Among the most relevant regulatory developments in recent weeks in Italy is certainly worth mentioning the51st update, published by act of February 3, 2026 and in the Official Gazette on February 18, 2026. The act implements the Regulation (EU) 2022/2554 (DORA) and Directive (EU) 2022/2556,amending in particular Chapter 4 “The Information System” and Chapter 5 “Business Continuity,”as well as some reconciliations in the introductory provisions, in Chapter 1 on authorization for banking and in Chapter 3 on internal controls.

The most important difference from the previous framework is conceptual even before it is editorial. The “previous” framework on ICT and continuity,essentially built on the 40th update of 2022,had been shaped to implement EBA guidance on ICT and security risk management. With the 51st update, however, the Bank of Italyperforms a real reorganization:many national sections that regulated in detail ICT governance, ICT and security risk management, ICT information and operations security, ICT project and change management, and ICT service outsourcing are repealed and replaced by a direct reference to the now directly applicable DORA provisions and related RTS/ITS. In other words, Circular 285 ceases to be the “primary” text of detail on these issues and becomes the national point of connection with the European framework.

I refer to DORA

This change in regulatory architecture is most visible in Chapter 4, which now opens by stating that the subject matter is directly governed by DORA and its delegated acts, including those on contractual arrangements for ICT services in support of essential or important functions and on the subcontracting of such services. This is also a very operationally relevant step, because it reinforces the idea that compliance can no longer be read only from a local perspective:for ICT governance, third-party risk, significant incidents and contractual safeguards, the main reference is now European.

Another point of note is thatthe discipline on the data management system, which is not covered directly by DORA, is retained and relocated to Chapter 3 on internal controls, with a special Annex D. This is a consistent choice: what remains in 285 is what continues to be an organizational and internal control oversight of the bank, while the strictly ICT/digital resilience part is absorbed into the DORA perimeter.

Operational continuity

On the business continuity front, the 51st update amends Chapter 5 to align it with the changes introduced by the DORA Directive.Here the difference from the previous version is very stark: the ICT business continuity requirements are removed from the Circular, because they are now directly presided over by DORA and the related delegated regulation on IT risk management.Instead, the core “general business” business continuity requirements,applicable to banks as operators,remain, while digital continuity is definitively Europeanized. Banca d’Italia also clarified that it has not yet amended Annex A, Section III, on systemically important processes, for the time being, because broader investigations involving financial operators other than banks are underway.

Then there is a less conspicuous but important aspect: the section on payment service-specific provisions has been updated in light of the EBA Guidelines of February 11, 2025, keeping in place, alongside DORA, the relevant references for managing the relationship with payment service users. This confirms that the final set-up is not a pure “one-for-one” replacement, but a regulatory mosaic in which DORA becomes the backbone, while some vertical principals remain anchored in specialized sources such as PSD2/EBA.

Comments and opinions

Outside commentators also converge on this reading.Banking Lawdescribes the intervention as a “reordering” of the framework in light of DORA and highlights precisely the repeal of the old national sections on governance and ICT risk, replaced by references to the European regulation and delegated acts.Studio Marchetti, in turn, points out that the parts that are no longer consistent with the new European framework are removed, whileCesare Gallotti, from an information security perspective, notes that the most significant novelties are concentrated in Title IV and that Chapter 4 now refers substantially in full to the DORA requirements and related RTS/ITS.

Conclusion

In practical terms, the message for banks, supervisory functions, ICT risk managers, and continuity managers is clear:DORA does not simply add to Circular 285, but redesigns its center of gravity.285 remains essential as a national supervisory framework, but for digital resilience, ICT outsourcing, incident management and ICT continuity, the center of gravity has now shifted to the European body of law. The new provisions came into effect the day after publication in the Official Gazette,while for changes to Chapter 5 Bank of Italy has set aside six months for compliance.