DORA (Digital Operational Resilience Act): the Implementing Regulation approved by the European Parliament
17-11-2022
The Regulation relating to the so-called DORA (Digital Operational Resilience), was approved by the European Parliament on 10 November 2022.
This regulation was issued to regulate the activities of ICT suppliers (acronym for Information and Communications Technology) who supply and manage the processes and practices connected with the transmission, reception and processing of data and information for financial institutions.
The purpose of the Regulation is to reduce a systemic risk created by the interconnections and interdependencies between financial entities and third party ICT providers.
The EU standard is relevant for ICT companies based in the EU or having relationships with a financial entity in the EU.
In particular, it concerns all financial entities, i.e. any company that provides financial services, including:
Banks/Money and Payment Service Providers
Insurance and reinsurance service providers
Brokers/CSDs/CCPs
Investment firms/Pension funds
Credit Institutions/Credit Rating Agencies
On the other hand, with regard to ICT service providers, the Regulation concerns any provider of critical ICT services for financial entities, including:
Cloud Service Providers/SaaS/Outsourcers
Software Vendors
Critical ISVs and System Integration Vendors
GRC/Risk Management Vendors
Fraud prevention and management system providers
Penetration Testing Vendors
Collaborative tool providers
Data Storage Solution Providers
Suppliers of information management systems / CRM solutions
Payment solution providers
Financial entities will need to review their partners and third-party vendors to ensure that those partners' policies and processes meet the new requirements.
The financial entities are responsible for ensuring that the ICT suppliers used by the ESFs have policies and processes in place to meet the requirements imposed by the new regulations.