The European Union's Digital Operational Resilience Act (DORA) is poised to revolutionise the European financial sector, enhancing operational resilience, and streamlining legislation on digital operational processes. PwC Luxembourg has created a handy guide to navigate the intricacies of the new regulation entitled “DORA What Matters Now for Your Business Resilience”. 

DORA aims to harmonise existing regulations, integrate information and communication technology (ICT) risks into comprehensive risk management policies, and increase transparency in dealings with ICT third-party providers. This landmark regulation, applicable to virtually all financial entities in Europe, is set to bring about significant changes in internal operations, necessitating strategic business decisions, updated operational and ICT setups, and increased training and upskilling efforts.  

A key highlight of DORA is its extra-territorial reach, requiring entities outside the EU that provide ICT services to comply with its provisions if serving financial entities within the EU. With the compliance deadline set for the beginning of 2025, financial entities face a race against time, prompting urgent action from the C-Suite of the financial sector.  

"In leveraging DORA as a catalyst for strategic foresight, businesses empower themselves to reinforce their digital bedrock, but it is far more than just an IT exercise. It is also about cultivating innovation, adaptability, and forming a formidable defence against emerging threats. As a professional services firm, we’re not immediately in scope ourselves, but we are endorsing the DORA standards on those parts of our company that service the financial services industry". - Olivier Carré, Deputy Managing Partner, Technology & Transformation Leader  

Digital transformation and geopolitical realities  

The digital transformation has interconnected financial entities like never before, relying on a growing array of in-house and outsourced ICT. Geopolitical tensions, especially between the United States and China, have spurred technological rivalries, adding complexity to global ICT dynamics. In this multipolar environment, characterised by political and military uncertainties worldwide, vulnerabilities in global ICT supply chains have become apparent, necessitating change that remains largely invisible to financial entities and regulatory bodies.  

Imperative for strong defences  

As financial entities increasingly digitise, the threat of cyberattacks looms large. Geopolitical players utilise cyber capabilities for espionage and information warfare, while non-state players resort to attacks for various malicious purposes. Regulatory requirements for ICT resilience have evolved on both sides of the Atlantic, but the divergent nature of provisions remains region-specific. The European Commission addresses this through the introduction of DORA, applicable to EU-regulated financial entities, scheduled to come into force on 17 January 2025.