Rules on digital operational resilience come into effect for EU financial sector

The European Union’s new regulation digital operational resilience for the financial services sector has now come into force, a little over four years after it was first proposed.

Specifically for the financial sector, the Digital Operational Resilience Act (DORA) came into effect on 17 January 2025 and to establish a framework for managing digital operational risks within the European financial sector.

DORA is a regulatory framework designed to strengthen the resilience against digital disruptions and applies to banks, insurers, investment firms and other financial institutions, as well as to key third-party service providers, including cloud computing services.

Although the measures were first proposed in September 2024 and were adopted by the European council in 2022, several major IT outages have occurred since, highlighting the strong need for such a regulation. Among the major IT outages that have severely impacted businesses in all in all industries and regions, is the July 20224 CrowdStrike outage. This was caused by a content update for Microsoft Windows hosts, which brought down more than eight million computers using Microsoft systems around the world.

The incident was estimated to have cost Fortune 500 companies more than US$5 billion and was not the first outage to cause widespread chaos.

In December 2022, TSB was fined £48.65 million relating to “operational risk management and governance failures”, including management of outsourcing risks relating to the bank’s IT upgrade program. The technical failures in TSB’s IT systems resulted in customers being unable to access banking services leading the bank to pay a further £32.7 million in redress to customers. CIO Carlos Abarca was fined personally.

Jonathan Armstrong, partner at Punter Southall Law in the UK, says: “At its core is the recognition that financial systems across the EU are part of each country’s critical national infrastructure. Many financial services organisations rely on a few key services providers, meaning that an incident compromising one of those providers could have a significant effect on financial services across the EU.”

Although an important regulation for digital resilience, DORA has naturally caused concern among the financial services, tech and cyber security communities.

Armstrong says: “So it’s important for businesses to understand fully their responsibilities. Whilst DORA is an EU measure, operational resilience is high on the agenda for UK financial firms too, with operational resilience requirements introduced in 2022 coming into full effect in March 2025.”

Although DORA does not apply to to the UK financial services sector, it does apply to those that are also subject to the EU regime and in total is estimated to impact 22,000 entities.

What is the DORA regulation?

DORA isn’t entirely new. It is designed to consolidate and upgrade IT risk requirements through the financial services sector in the EU. This will standardize regulations by ensuring a wide range of financial services participants are subject to a common set of standards to mitigate ICT risks, including those posed by cyber security incidents.

It isn’t just about keeping financial services online during outages. DORA also covers supply chain resilience with requirements for:

• Dedicated ICT risk management capabilities
• Reporting of major ICT-related incidents
• Digital operational resilience testing
• Management by financial entities of ICT third-party risk
• Information sharing among financial entities

Because so much of the IT infrastructure used in financial services is cloud based, the rules also extend to critical ICT providers, such as cloud service providers.

Armstrong says: “It is important to remember that the main DORA Regulation is binding legislation that is directly applicable in Member States after its entry into force. The DORA Directive will need to be transposed into each Members States’ national law.”

How businesses can adhere to DORA

Armstrong highlights that any organization in the DORA regime, or providing services to those that are, will need to consider how to meet their responsibilities under the new rules.

Whilst existing risk management and GDPR systems and processes can help, Armstrong implementation is still likely to be “a significant project for most”.
Armstrong says implementation should include the following key steps:

A gap analysis to focus on the work that needs to be done. This could include scope questionnaires for various parts of the business.

• Training on operational resilience, which is likely to include the IT team, communications professionals and the compliance function.
• Implementing processes and procedures to do horizon scanning and respond promptly to incidents. This is likely to include a review and testing of an organization’s incident response process.
• Assessing skills and expertise among the board and senior management teams and recruiting to plug any gaps that emerge. 
• Understanding the regulatory regime, including who the key regulators will be and how organizations will meet their obligations to keep them informed.
• Looking at and assessing contracts to see whether it will be necessary to add a DORA addendum.
• Mapping critical and important functions.
• Robust testing of new processes and the measures put in place.

Armstrong also highlighted the specific actions both financial services business and third-party providers should take:

• For financial services organizations: Working out key dependencies, mapping devices and storage locations etc. and ensuring that compliant contracts are in place with all third-party providers.
• For third-party providers: Working out which key clients are likely to be in the DORA regime and anticipating the assistance they will need to comply. This could include white papers, FAQs or template responses.

Armstrong concluded: “Financial services firms are required to have in place sound, effective and comprehensive strategies, processes and systems that enable them adequately to comply with the applicable operational resilience requirements. Organizations should seek specialist advice to ensure they fully understand how DORA and the UK rules apply to them.”

Quick links

• The top 20 CX leaders in financial services
• CX leaders in finance reveal top trends: AI, digital twins, customer empowerment
• How the UK’s Consumer Duty will reshape CX

All Access: Voice of the Customer 2025

Join us to hear from industry leaders, innovators, and CX experts as they share insights, strategies, and tools for harnessing customer feedback to drive meaningful change. 

Register Now