Digital Operational Resilience Act

	Members Registration Investors Careers

Become a sponsor »

Digital Operational Resilience Act (DORA) is a European Union regulation aimed at strengthening the cybersecurity and operational resilience of financial institutions across the EU. It was introduced to establish a comprehensive and harmonized framework for managing Information and Communication Technology (ICT) risks in the financial sector.

History

DORA was proposed by the European Commission in September 2020 as part of its digital finance strategy. It entered into force on January 16, 2023, and will apply from January 17, 2025, giving financial entities and regulators a two-year implementation period.

Key Provisions

DORA is structured around five key pillars:

ICT Risk Management

Financial entities are required to establish comprehensive frameworks for ongoing risk assessment and mitigation related to their ICT systems.

Incident Reporting

The regulation mandates the development of procedures to identify and report significant ICT-related incidents quickly using standardized formats.

Digital Operational Resilience Testing

DORA requires regular, advanced threat-led penetration testing of critical ICT systems to ensure they can withstand cyber attacks.

Third-Party Risk Management

Financial institutions must assess and manage risks associated with third-party ICT service providers, with stringent oversight requirements for those deemed critical.

Information and Intelligence Sharing

The act encourages collaboration and information exchange among financial entities and ICT providers to collectively combat cyber threats.

Scope and Application

DORA applies to a wide range of financial entities, including:

• Banks
• Insurance companies
• Investment firms
• Crypto-asset service providers
• Credit rating agencies
• Statutory auditors and audit firms

It also extends to critical ICT third-party service providers, bringing them under the supervision of European financial regulators for the first time.

Implementation and Compliance

Financial institutions are required to implement DORA's provisions by January 17, 2025. This includes:

• Establishing comprehensive ICT risk management frameworks
• Developing incident reporting mechanisms
• Conducting regular resilience testing
• Implementing robust third-party risk management processes

The European Supervisory Authorities (ESAs) are responsible for developing technical standards and guidelines to support DORA's implementation.

Impact on the Financial Sector

DORA is expected to have significant implications for the financial industry, including:

• Increased focus on cybersecurity and operational resilience
• Harmonization of ICT risk management practices across the EU
• Enhanced oversight of critical ICT third-party service providers
• Potential challenges for smaller firms in meeting compliance requirements
• Increased need for investment in ICT infrastructure and risk management capabilities

The regulation aims to enhance the overall stability and security of the EU financial system by ensuring that financial entities can withstand, respond to, and recover from ICT-related disruptions and threats.