On 17 January 2025 DORA, the EU’s digital operational resilience regulation, began to apply. Banks, insurers and fund managers must show they can withstand a serious technology failure.
Regulation (EU) 2022/2554 on digital operational resilience for the financial sector, known as DORA, began to apply on 17 January 2025, two years after it entered into force. As a regulation, it applies directly in every member state. Its aim is for the European financial system to keep working in the face of a cyberattack, an IT outage or the failure of a technology provider.
Who it covers
DORA reaches some twenty types of entity: banks, insurers and reinsurers, payment and e-money institutions, investment firms, fund managers, crypto-asset service providers, market infrastructures and some intermediaries. The smallest have a simplified regime. For the first time, moreover, large technology providers deemed critical, such as cloud service providers, come under the direct oversight of the European authorities.
In Spain compliance is supervised by the Bank of Spain, the National Securities Market Commission and the Directorate-General for Insurance and Pension Funds, each in its own field.
What it requires
The regulation rests on five pillars: a technology-risk management framework approved and overseen by the board; the classification and reporting of major incidents to the authorities within very short deadlines; regular resilience testing, which for the most important entities includes simulated attacks; management of technology-provider risk, with a register of all contracts; and the sharing of information on threats.
Contracts with technology providers must include minimum clauses: service levels, access to information, audit rights, exit plans and cooperation in the event of an incident. Many entities have had to renegotiate contracts with their cloud and software providers.
What it means for a client or a business
For the client of a bank or a fund manager, DORA is an additional safeguard: the entity must be able to keep providing the service and protect data even if a system fails. For technology firms serving the financial sector, it means more contractual demands, audits and reporting obligations.
If your company provides technology services to financial entities, it is worth reviewing contracts, continuity plans and the ability to report incidents. Ask your adviser how it affects you.
In the financial sector, technology is no longer a department: it is part of the risk that has to be governed.
This article is general information. It is not legal, tax or investment advice, and it does not take anyone’s particular circumstances into account.
