Digital Operational Resilience Act Now Applies to EU Financial Firms

According to the European Insurance and Occupational Pensions Authority (EIOPA), DORA covers 20 different types of financial entity as well as ICT third-party service providers. The aim is to ensure that the financial sector can withstand, respond to and recover from ICT-related disruption and threats.

What the rules require

The regulation is built around a number of core areas:

• ICT risk management: financial entities must maintain an internal governance and control framework for ICT risk, with the management body ultimately responsible.
• Incident reporting: major ICT-related incidents must be classified and reported to competent authorities.
• Resilience testing: entities must test their digital operational resilience, with advanced threat-led penetration testing for certain firms.
• Third-party risk: contracts with ICT providers must contain key provisions, and entities must keep a register of information on their ICT contractual arrangements.
• Information sharing: arrangements for exchanging cyber threat information between financial entities.

Oversight of critical ICT providers

DORA also creates an EU-wide oversight framework for ICT third-party service providers designated as critical. EIOPA explains that this responds to systemic and concentration risks arising from the financial sector's reliance on a limited number of technology providers. Oversight is carried out by the European Supervisory Authorities, which may issue recommendations to designated providers.

Who is affected and what happens next

Credit institutions, payment and e-money institutions, investment firms, crypto-asset service providers, insurers and reinsurers, and other entities listed in the regulation must now be able to show supervisors that their frameworks meet the new requirements. Non-EU technology companies that serve EU financial entities are affected indirectly through contractual requirements and, where designated as critical, directly through oversight. Much of the detail sits in regulatory and implementing technical standards adopted under DORA, including standards on incident classification, testing and the register of information, so firms will need to track both the regulation and its delegated texts.

Sources

• EIOPA: Digital Operational Resilience Act (DORA)
• EUR-Lex: Regulation (EU) 2022/2554 on digital operational resilience for the financial sector