Understanding DORA compliance and regulatory expectations for financial institutions

The DORA (Digital Operational Resilience Act) regulation came into force across the financial sector on 17 January 2025. Unsurprisingly, only a small number of firms affected by DORA have declared themselves completely ready and compliant with all areas of the regulation.

The European Supervisory Authorities (ESAs) have affirmed their position on the minimum requirements firms should meet in 2025, with the regulators’ first supervisory reviews planned for the second half of the year. Essentially, the market is expecting an initial year of “testing” in which the ESAs will check the pulse of key players in financial sectors’ progress and maturity regarding the regulation, before taking a more stringent stance in future exercises.

Even now, few people know for certain what the regulators’ specific focus areas will be. Nonetheless, the ESAs have expressed their minimum expectations and will seek to assess companies’ overall DORA compliance levels, particularly on the following topics:

• the organisation of the DORA compliance programme and the target governance of ICT risk management,

• the establishment of a coherent risk management framework to address the minimum requirements of the regulation,

• the establishment of an effective incident reporting system to enable incidents impacting the digital resilience of their activities to be reported to regulators from 2025,

• the establishment of a coherent ICT third-party management framework to ensure the identification of ICT third parties linked to critical and important business functions and the creation of a comprehensive ICT third-party information register.

• the organisation of the DORA compliance programme and the target governance of ICT risk management,

• the establishment of a coherent risk management framework to address the minimum requirements of the regulation,

• the establishment of an effective incident reporting system to enable incidents impacting the digital resilience of their activities to be reported to regulators from 2025,

• the establishment of a coherent ICT third-party management framework to ensure the identification of ICT third parties linked to critical and important business functions and the creation of a comprehensive ICT third-party information register.

Before taking a closer look at the market positions of, and the difficulties encountered by financial institutions in DORA implementation, we will first recap the scope, goals and principles of the DORA regulation.

Key pillars of DORA regulation

DORA regulation was adopted at the end of 2022 by the European Commission, for implementation on 17 January 2025. The regulation requires financial institutions to have specific governance and control frameworks in place relating to Information and Communication Technologies (ICT) operational resilience.

DORA establishes rules and obligations around cybersecurity, third-party management, and ICT risk management. The regulation requires financial institutions to establish a digital operational resilience strategy, which management will be responsible for implementing. Strategies should align with the following objectives:

• unifying IT risks management practices,

• improving incidents management, in particular to meet the reporting requirements to a single European body,​

• strengthening the conduct of resilience tests (intrusion tests, continuity plans),​

• managing third parties risks related to ICT service providers.

Pillar 1 – ICT risk management

The first pillar of the regulation concerns ICT risk management. DORA’s first pillar aims to integrate ICT risk management into financial institutions’ overall risk management strategy. To do this, firms must develop precise mapping of their business processes and information systems to identify weaknesses and critical interdependencies. They must also formalise a global ICT risk profile, which is integrated into the risk management system and kept up to date to reflect changes in threat levels and the internal control system.

Pillar 2 – incident reporting

The second pillar relates to incident management, including incident reporting. The objective of the second pillar is to strengthen firms’ ability to detect, classify and report incidents effectively. To this end, firms must set up a system for reporting and classifying incidents, and define a clear, detailed communication plan to promptly notify stakeholders, including supervisors and customers, of incidents. The use of automatic detection tools is recommended to reduce the manual part of incident detection.

Pillar 3 – resilience testing

The third pillar concerns resilience strategies and testing. Its objective is to ensure the operational resilience of critical systems through regular and rigorous testing. Organisations must develop a resilience testing strategy based on the organisation’s risk analysis and strengthen their operational resilience testing to ensure that critical systems can withstand disruptions.

Pillar 4: third-party risk management

The fourth pillar deals with the control of critical ICT service providers. The objective of third-party risk management is to guarantee that third-party providers uphold security and resilience standards. Firms subject to DORA regulation must define objective criteria to identify critical ICT suppliers and gather the information essential to managing the risks they represent. Firms must also carry out regular supplier audits to ensure compliance with security and resilience standards and consider concentration risks presented by third-party ICT service providers. Developing a multi-supplier strategy and exit strategies may help address concentration risk.

DORA, a complex implementation process and major issues faced by organisations

Implementing DORA regulation remains a source of difficulty for risk management professionals, given the multiplicity of ways operational principles can be applied across each DORA pillar.

However, this is not the first time the financial sector has faced robust risk management requirements: Solvency II regulation has also required firms to have robust risk management frameworks in place. Many firms already have operational processes governing the management and functioning of information systems, and their resilience, in place. The deployment of DORA requirements relating to ICT risk management (pillar 1) or incident reporting (pillar 2) has therefore, for many firms, consisted of adjusting existing policies, procedures and practices to be more DORA aligned. More significant investments had to be made to bring less mature processes into compliance, mainly regarding ICT third-party risk management (pillar 4).

Aligning the risk management framework, a fundamental task for financial institutions

The integration of ICT risk management into financial institutions’ overall risk management strategies has not been without its difficulties. Gap analysis work conducted by firms in the months prior to DORA implementation frequently revealed discrepancies in firms’ perception of the criticality of their functions, and therefore by definition, which “critical” digital systems fell within scope of DORA regulation.

“Compliance with DORA requirements requires the implementation of a cross-functional project organisation, a precise identification of critical and important functions and effective governance.”

Emilie Legroux, Partner, Forvis Mazars Group

Consistency has been required when rationalising DORA’s risk-based approach and the idea of “criticality” to key stakeholders affected by its implementation (ICT risk management, cyber risk management, operational risk management, procurement management, etc.).

A consensus has gradually been established in the sector through the use of Business Impact Analysis (BIA) as a tool to evaluate firms’ critical and important functions, and consequently, their relevance to DORA’s scope. However, this approach implies the existence of coherent and exhaustive digital asset repositories that allow for reconciliation between a firm’s key processes, and the associated application systems and IT components, which is not the case.

ICT third-party information register, a complex exercise to populate the register with quality information

The development and completion of the third-party information register remains one of the major concerns of companies subject to the DORA regulation. Although the target date for the submission of third-party registers is approaching, many organisations are still experiencing difficulties compiling a register that fully meets the technical requirements of regulators.

Beyond collecting and quality control of third-party data, completing the third-party register requires firms to retrieve non-centralised and potentially unstructured information from third-party providers. Regulators have carried out test exercises, which have revealed firms’ struggle to compile a comprehensive third-party register with appropriate data quality. For many firms, automation has been key to producing an accurate third-party information register with quality information.

ICT subcontracting chain, expected clarifications to adjust contractual relationship with service providers

On 20 January 2025, the European Commission rejected the Regulatory Technical Standard linked to Article 30 of DORA regulation regarding the control of the subcontracting chain by ESAs. Without impacting the constitution of the ICT third-party information register, this decision raises uncertainties on the regulators’ positions and therefore on the principles of control to be applied to subcontracting chains. The ICT service provider contractual adjustment resulting from DORA – an exercise already complex considering the hard positions of several international ICT service providers against the regulation – will become more and more complex to properly identify and assess subcontracting chains in line with the regulation.

Ultimately, the application of the DORA regulation and the underlying contractual amendments will involve higher acquisition costs for new ICT service providers, the extension of contractual lead times and increased third-party audits.

Adapting to DORA regulations, a key exercise to raise awareness among stakeholders

Firms may undergo organisational transformation as a result of DORA, which often requires stakeholder involvement. However, some stakeholders’ primary concerns may be far removed from the realm of digital resilience, ICT risk and third-party risk.

Adopting a programme to integrate DORA and its impacts into a firm’s culture, including all operational stakeholders, is a useful tool to support organisational transformation. DORA implementation programmes have highlighted a lack of emphasis on the importance of change in the wake of DORA, and consequently, poor prioritisation of the actions to be undertaken.

“DORA, is aligning historical risk-oriented considerations to secure the numeric resilience of financial organisations. Achieving the DORA regulatory transformation implies pragmatic solutions to offer a organizational response to DORA adjusted to each organisation”

Christophe Khalife, Partner, Forvis Mazars Group

We can be certain that DORA compliance will lead to new realities for financial institutions as they start to implement the first regulatory controls. Given the complexities of putting DORA requirements into practice, it is important to remember its underlying goal: to guarantee coherent and coordinated digital resilience in conjunction with supervisory authorities. It is essential for financial institutions’ response to DORA to be proportionate to their organisation’s size, to guarantee the sustainability of that response over time.