By Alice Short
for the 2024 Risky Women Writing Competition, presented in partnership with Bovill Newgate
This article discusses the Digital Operational Resilience Act (DORA), a key regulation enhancing technology risk management in the EU’s financial services. DORA requires proactive measures against digital disruptions, accountability from third-party providers, and standardized incident reporting, promoting collaboration and innovation while ensuring consumer confidence in financial security.
In today’s rapidly evolving digital world, technology is at the core of the financial services industry. From online banking to investment platforms, our reliance on technology has created new opportunities but also exposed us to significant risks. Cyberattacks, system failures, and data breaches are just a few examples of the threats that can disrupt financial institutions and the broader economy. To address these growing risks, the European Union introduced the Digital Operational Resilience Act (DORA) in 2022. DORA is a game-changing regulation that is reshaping how financial institutions manage technology risks and protect consumers.
What is DORA?
DORA is designed to ensure that financial institutions in the EU can withstand digital disruptions, such as cyberattacks or IT failures, without endangering the financial system or customer data. The regulation applies not only to banks, insurance companies, and payment providers but also to the tech firms that serve them, like cloud service providers.
DORA aims to create a more secure and resilient financial ecosystem by requiring all institutions to have strong protections in place, regularly test their systems for vulnerabilities, and report incidents in a standardised way across the EU.
Shifting the Focus of Technology Risk Management
Before DORA, technology risk management in Europe was often inconsistent, with different countries having different rules. DORA has introduced a unified approach that compels financial institutions to take a proactive stance on risk management.
- Proactive Resilience, Not Just Reaction
DORA pushes financial institutions to move from merely reacting to problems after they happen to actively preventing them. Under DORA, institutions must regularly test their systems and identify potential weaknesses before they lead to serious issues. This includes running simulations of potential disruptions, like cyberattacks, to make sure their systems can handle these challenges. Rather than waiting for a disaster and scrambling to recover, DORA’s approach is all about being prepared in advance. - Managing Third-Party Risks
Many financial institutions rely heavily on external technology providers, like cloud computing services, for essential operations. While these providers bring efficiency, they also introduce risk. If one of these third-party providers experiences a problem, it could affect the financial institution’s operations. Under DORA, financial institutions are responsible for making sure their external providers are also following strict security and resilience guidelines. This adds a layer of accountability, ensuring that financial institutions are closely monitoring their vendors and minimizing risks that come from external sources. - Standardised Incident Reporting
When a major digital disruption occurs, such as a data breach or IT failure, time is of the essence. Before DORA, there was no consistent way for financial institutions across Europe to report these incidents. This often led to confusion and delays in responding to threats. DORA requires institutions to report significant disruptions quickly and consistently, helping regulators react faster and prevent the same issues from happening elsewhere. It also provides valuable data to help financial institutions identify patterns and strengthen their defenses.
Changing Risk Management Practices
DORA is driving more than compliance—it is changing how financial institutions think about technology risk and integrating it into their day-to-day operations.
- Breaking Down Silos
In many financial institutions, departments like IT, compliance, and risk management often operated in isolation, with little collaboration. DORA is pushing for a more unified approach, requiring these departments to work together to ensure digital resilience. By fostering collaboration between different teams, DORA helps institutions take a more comprehensive approach to risk, reducing the chance that something will slip through the cracks. - Encouraging Innovation Alongside Security
Regulation can sometimes be seen as a burden, but DORA shows that strong security measures can also enable innovation. By creating a secure foundation, financial institutions can confidently adopt new technologies like artificial intelligence, blockchain, or cloud services without worrying about whether their systems are vulnerable. DORA’s emphasis on testing and resilience ensures that as institutions innovate, they are also protecting their customers and their business from new threats. - Setting a Global Standard
DORA’s influence extends beyond Europe. As the financial industry becomes increasingly global, other regions may follow the EU’s lead and adopt similar regulations. By creating a unified standard for digital resilience, DORA positions the EU as a leader in the global financial industry. Financial institutions that meet DORA’s requirements are likely to be well-prepared for future regulations, giving them an edge in a competitive, interconnected marketplace.
Conclusion: The Future of Technology Risk Management
DORA is transforming the way financial institutions manage technology risks by emphasising prevention, promoting collaboration, and creating stronger oversight of third-party providers. It is helping the financial industry become more resilient in the face of digital threats and setting new standards for how risks are managed across the EU and beyond.
For consumers, this means greater confidence that their financial information is safe, even in an increasingly digital world. For financial institutions, DORA represents a shift toward a more proactive and integrated approach to risk management, helping them innovate while staying secure.
In a world where digital threats continue to evolve, DORA ensures that financial institutions are better prepared to protect their systems, their customers, and the broader financial ecosystem from disruption. The act serves as a reminder that technology and resilience must go hand in hand as we continue to push the boundaries of what is possible in the digital financial space.