High Stakes Ahead: Navigating The Post-DORA Era

High Stakes Ahead: Navigating The Post-DORA Era

The long-awaited EU Digital Operational Resilience Act (DORA) regulation officially came into effect on January 17, 2025, after a 2-year preparatory period. Financial services and technology institutions across the world began the race toward DORA compliance in December 2022, following the EU's finalization and publication of the regulation. The legislation also covers non-EU based financial institutions and ICT service providers that operate within or provide services to the EU market. DORA’s implementation has prompted organizations globally to strengthen their ICT risk management frameworks, incident response strategies and third-party risk management practices. Furthermore, it has influenced international regulatory approaches to cyber security and operational resilience. For instance, the Basel Committee on Banking Supervision has proposed principles for operational resilience and the management of outsourcing risks, reflecting concerns similar to those addressed by DORA. This alignment indicates a broader global movement towards more robust regulatory frameworks governing ICT risks in the financial sector.

Firms have implemented extensive measures to comply with DORA, including comprehensive assessments of ICT systems to identify critical assets and vulnerabilities. Risk management frameworks have been refined to include regular vulnerability assessments, penetration testing and continuous monitoring. Many organizations have adopted new software solutions, created specialized compliance teams and enhanced third-party risk management by cataloguing ICT service providers, assessing risks, and establishing clear exit strategies for critical services. These initiatives have come at a significant cost, with some firms spending over €1 million on compliance efforts in the last two years.

Despite these efforts and investments, 43% of UK financial services firms are still unprepared for compliance with DORA, according to a survey by Orange Cyberdefense. While senior professionals recognize the value of the regulation, compliance has proven challenging due to its prescriptive nature, which demands thorough documentation and cost-intensive governance structures, as well as the achievement of resilience outcomes.

Regulators have emphasized the severe consequences of non-compliance. Organizations face fines of up to 2% of their global annual turnover or €10 million ($10.2 million), whichever is higher. Critical third-party ICT providers may incur penalties as high as €5 million – or up to 1% of their average daily global turnover for up to six months – for prolonged non-compliance. Additionally, regulatory authorities may limit or suspend non-compliant firms’ business activities by imposing administrative penalties, such as licence suspension or revocation, and mandate corrective actions to address deficiencies until full compliance is achieved. Business leaders also face individual accountability, with penalties reaching €1 million ($1.02 million) for compliance failures under their watch.

To stay informed on further regulatory updates, subscribe to the Verdantix risk management newsletter. Also, watch out for our upcoming market insight report on how DORA will influence expectations of operational resilience.