Article

Category: Regulatory & compliance

What DORA means for financial institutions

Institutions will need to comply with the regulation from 17 January 2025. In this article, we explore compliance with DORA and consider the opportunities it presents for financial institutions.

The Digital Operational Resilience Act (DORA) is an EU regulation designed to make financial entities more resilient against cyber-attacks and other Information and Communication Technology (ICT) risks, including a focus on third-party providers.

Under DORA, financial institutions such as banks, investment firms and insurance companies, among others, will be mandated to test, assess and ensure digital operational continuity, adopt robust security networks and respond swiftly to ICT incidents. By introducing clear guidelines on detecting and protecting against ICT risks, and containing and recovering from incidents, the regulation seeks to safeguard the stability of the financial system.

Dive into DORA here

 

What are the consequences of non-compliance?

According to a report by the International Monetary Fund in April 2024, extreme losses from cyber incidents are increasing, with the financial sector ‘uniquely exposed’. The report finds that attacks on financial firms account for almost one-fifth of all incidents with the sector suffering more than 20,000 cyberattacks and $12 billion in losses over the past two decades.

Read the report

With the sector’s growing reliance on third-party service providers, the resilience of the ICT supply chain is equally vital to protect against attacks, such as the ransomware attack on C-Edge Technologies, a technology provider in India, which impacted payment systems at almost 300 local banks.

It is, then, no surprise that the consequences of non-compliance with DORA are hard-hitting. Under the regulation, if a financial entity does not comply with the regulations, they can face fines of up to 2% of their global annual turnover. The fine given will depend on the severity of the violation and the level of cooperation extended from an organisation to relevant authorities.

Critical third-party ICT providers can also be fined up to £5 million if a breach of the regulations is found, and again the amount will be dependent on the degree of cooperation demonstrated by the organisation and the severity of the issue.

Read about the ransomware attack (The Economic Times)


 

  Under the regulation, if a financial entity does not comply with the regulations, they can face fines of up to 2% of their global annual turnover.

 


How complicated is compliance?

Organisations in the financial space may be concerned as time is ticking to achieve compliance with DORA ahead of January’s deadline. However, in many respects, the Act is a way to bring various existing guidelines under one piece of compliance legislation.

Some of DORA’s requirements already exist in other directives, regulations and standards and in many cases, firms are likely to have suitable controls already in place that can be updated to incorporate the new regulation. This means compliance may be as straightforward as enhancing existing processes to bring them up to speed with DORA.

However, what is important is for institutions to identify where the gaps are and then plan and deliver the remediation of these gaps, including embedding suitable controls and processes into business-as-usual.

The bar will be raised for critical third-party ICT providers to meet stringent requirements to security, availability, quality, and scalability of respective services to financial entities under DORA. EU financial services regulators will be able to make audit and inspection requests of ICT providers, which forces them to create open and transparent approaches to outlining operational resilience. ICT providers must ensure their IT, legal, compliance and business stakeholders are aligned on regulatory audit and inspection requirements.

 

What practical steps should financial institutions take?

Financial entities should introduce a framework to track and document all relevant information, including ICT assets and infrastructure. Firms must use the framework to consistently track ICT risk, including potential issues linked to third-party providers, and be aware of cybersecurity threats. These inventories must be reviewed frequently to ensure there are no new risks.

As part of this process, businesses should look at what regulatory processes and controls they already have in place and leverage these where possible, because DORA is largely bringing together existing rules and requirements.

 

Opportunity, not burden

Financial institutions are accustomed to a much needed ‘compliance burden’, to protect consumers and keep the crucial financial sector stable. DORA could be seen as an opportunity to carry out a thorough audit, streamline controls and protections, and introduce an extra layer of security.


 

  Businesses should look at what regulatory processes and controls they already have in place and leverage these where possible, because DORA is largely bringing together existing rules and requirements.

 


Consumers face substantial challenges if a banking system were to collapse as a result of an IT failure or breach. Whether this impacts an important transfer, inter-company payment, property purchase or social welfare payment, the robustness of financial systems is critical to the everyday lives of most people.

DORA’s harmonised framework and, in particular, the stress testing and contingency planning aspects of the regulations aim to prevent potentially significant and detrimental effects on consumers in the case of an incident, therefore increasing the safety and confidence of customers in the financial system.

Ready to find out more?

Ensure your business is compliant with DORA ahead of 17 January 2025.

Blog

Read more

left-arrow
right-arrow

Expertise strategy

The rise of sustainability-linked loans

In this article, Jesper Diget, CPO at emagine, explores how linking sustainability initiatives to the bottom line is reshaping business strategies.

Expertise strategy

How to keep teams productive in the hybrid working era

Martin Hartley, CCO of emagine, shares insights on successful hybrid working through balancing in-person collaboration, creating team synergy through the use of virtual tools, and supporting individual productivity patterns.

Expertise strategy
Trends

Business trend in 2025: Urgency for CEOs to take back IT ownership to drive growth

Dive into the evolving role of technology in business growth and explore the strategies leaders are using to balance outsourcing and insourcing, all while navigating the challenges of a dynamic, tech-driven landscape.

Expertise strategy

Possibilities and risks for Germany as a modern tech nation

This article explores Germany’s digital challenges, where gaps in skills and tech adoption risk its global competitiveness despite a strong industrial base and top technical universities.

Expertise strategy
Strategy, change & transformation

Using AI to streamline resource allocation

As global digital transformation spending heads toward $3.9 trillion by 2027, this article explores an AI resource allocation case from emagine HQ, other AI optimizations, and common challenges.

Data & Analytics
Expertise strategy

AI and the Ethics Tango

Discover the evolving relationship between humans and advanced technologies. Our article delves into the ethical considerations and risks associated with modern machines, highlighting how the complexity of today’s tech goes beyond simple utility.

Expertise strategy
Risk & Compliance

How to enhance cybersecurity measures

Enhance cybersecurity measures with updated systems, training, and secure remote work practices to protect your business. Explore here.

Expertise strategy
Training

The future of workplace upskilling and training

This article examines the importance of workplace upskilling, current trends, and how technological advancements will shape the future of workplace learning.

The agile transformation of a large enterprise is a complex process that requires profound changes in leadership, structure, and corporate culture.
Expertise strategy
Projects & Implementation
Tech & Development

Developments of AI in Project Management

This article discusses how the integration of artificial intelligence (AI) and machine learning (ML) into project management is driving a cultural shift towards innovation and agility within organizations.

Consultants assessing regulatory documents
Expertise strategy
Risk & Compliance

What is NIS 2 and how should businesses prepare?

With increasing cyberattacks, organizations must prioritize compliance, improve cyber hygiene, and implement standards like ISO/IEC 27001 to build resilience and reduce risks. Learn what NIS 2 is and how businesses should prepare for this comprehensive European cybersecurity directive.

Expertise strategy
Risk & Compliance

The future of preventing Financial Economic Crime and the importance of KYC

Understanding KYC protocols, AML regulations, and broader financial crime trends is vital for maintaining financial integrity. This article discusses key developments in compliance, KYC, and AML.

Data & Analytics
Expertise strategy
Tech & Development

New EU Act on Artificial Intelligence

Learn the ins and outs of the world’s first comprehensive legal framework on AI, the new EU AI Act and its anticipated impact on businesses.

Illustration of a solid chain with code written in the metal
Expertise strategy
Risk & Compliance

Digital Operational Resilience Act (DORA)

Here’s everything you need to know about the Digital Operational Resilience Act (DORA) which will apply from 17th January 2025.

Expertise strategy
Risk & Compliance

Proposed Code of Practice on cybersecurity governance

Explore the UK Government’s latest draft on cybersecurity governance Code of Practice together with emagine’s expert, Trine Øksnebjerg.

A business consultant ready to give a presentation at work.
Expertise strategy
Strategy, change & transformation

Embracing change as an opportunity for growth

In this article, we outline the best practices when it comes to navigating organizational change, including how to tackle challenges and maintain a clear vision when unprecedented issues arise.

Modern business environment with a man and woman in front of window facing a city
Expertise strategy

People-centric leadership: Tips for fostering digital wellbeing at work

This article equips team leaders with strategies for fostering digital wellbeing in the workplace, empowering them to guide their teams through the challenges that come with prolonged screen-time, hybrid work, and other factors of digitalisation in a modern workplace.

Expertise strategy
Strategy, change & transformation

Empower your teams through strategic thinking

This article considers why strategic thinking is crucial to effective leadership and explores some practical ways for leaders at all levels to develop this skill.

Consultants and advisors i an office space seen from above
Expertise strategy
Trends

Insights into 2024 business trends

With 2023 behind us and eyes fixed firmly on what opportunities 2024 will bring, Gillian Whelan, Country Manager of emagine Ireland, outlines five trends that will affect businesses this year.

Female consultant standing and writing on a desk
Expertise strategy
Risk & Compliance

Steering AML challenges: Embracing technology for a seamless future

Discover how to navigate AML challenges with automated processes and fortify your organization’s integrity and operations.

Bestshoring
Data & Analytics
Expertise strategy

Poland: An AI Centre of Excellence

AI is reshaping industries globally, and Poland’s thriving ecosystem positions it as a leader in AI development. emagine’s Cloud Administrator explores why Poland is a powerhouse in AI.

Business consultants conducting a meeting
Expertise strategy
Managed Teams & Managed Service
Staff augmentation

Managed Resourcing Services vs. Traditional Staff Augmentation

In the ever-evolving landscape of business operations, companies are constantly looking for ways to optimise their workforce strategies. Explore the two popular approaches that have gained prominence: Managed Resourcing Services (MRS) and traditional staff augmentation.

Expertise strategy
Risk & Compliance

Programme Governance: Top tips for success

In this article, we share some tips to navigate the intricate landscape of orchestrating interconnected projects and activities within a strategic framework.

Project manager at a meeting with his team.
Expertise strategy
Projects & Implementation

What has changed in PMBOK 7?

PMBOK is regularly updated to accommodate new trends, best practices, and developments in the field. How much has it changed between editions?

A team leader in front of her team
Expertise strategy
Projects & Implementation

The importance of leadership skills in a Project Manager

Behind every successful project lies a competent and visionary leader. In this article, we delve into the undeniable importance of leadership within project management and explore how effective leadership can be the driving force behind achieving project objectives.

Advisory & Solutions
Expertise strategy
Strategy, change & transformation

Building your PMO – Influence and Position

There are a number of things to consider when introducing a PMO. The Project Management Office fails far too often because of the wrong approach, and it can only be successful in the long term if fundamental questions are considered at an early stage.

Doug Collyer is Country Manager in UK
Expertise strategy
Strategy, change & transformation

The Nordic way of working: how does it help emagine consultants optimise their clients’ operations and boost profits?

emagine’s Nordic way of working embraces different perspectives and approaches to solve challenges and power progress among our consultants. Learn how our experts and Nordic work style can optimise our client’s operations and profitability.

thre people in a amicable meeting
Expertise strategy
Staff augmentation

Good onboarding: Setting your external workforce up for success

Enabling new consultants seamlessly integrate into your organisation is critical to their success. To ensure a smooth onboarding process, it is essential to help them get started immediately. This article will guide you through the most critical aspects of getting a consultant to start delivering from day one.

External consultants at a meeting in the office.
Expertise strategy
Staff augmentation

4 signs you need an IT consultant

Are you wondering if your company could benefit from hiring an IT consultant? This article outlines four common signs that indicate you may need external expertise to manage change, mitigate risk, or meet tight deadlines.

Bestshoring
Expertise strategy
Nearshoring
Publications

The Ultimate Guide to Nearshoring

Get our ultimate guide on how your IT organization can tap into Polish IT talent. Download the e-book and read condensed knowledge, facts and cases about Nearshoring based on our 12 years experience. Download now and get it free.

Expertise strategy
Tech & Development

The Complete Guide to Migrating Monolithic Applications to Microservices on the Cloud

As organizations strive to deliver high-quality software and services at scale, many are turning to a microservices architecture as a way to break down monolithic applications into smaller, more manageable components.

Modern business environment with a man and woman in front of window facing a city
Expertise strategy
Staff augmentation

The Science behind hiring the top 10%

As a business and technology consulting firm, we live of our ability to recruit the very top talent for our business. In this piece, I would like to share our thoughts behind the approach we on emagine UK. We call it: The science behind hiring the top 10%.

Expertise strategy
Strategy, change & transformation

People hate change, so how do you best implement it?

Bringing in new technology, individuals, or new teams to work on a key project can feel like a threat to existing staff – but it doesn’t have to be that way if you manage change positively.

Expertise strategy
Strategy, change & transformation

Key Success And Failure Factors Of The PMO

In this article, we will delve into Project Management Office (PMO) overview, and we will help you decide if it may be convenient for your team to have a PMO.

IT professionals outside engaging in conversation
Bestshoring
Expertise strategy
Nearshoring

Poland, the IT hub of Europe?

Poland has become a European talent hub in technology and engineering, and European companies leverage polish talent coding skills for nearshoring projects. Learn why.

Business woman talking to two colleagues
Expertise strategy
Staff augmentation

Team extension: How to hire external consultants successfully

Hiring external consultants isn’t something you should treat lightly. Learn the most satisfactory way to leverage experts in your organisation. In this article, Senior Account Manager Jytte Raahede shares her tips on onboarding consultants successfully.

Four professionals sitting together in a positive meeting smiling
Bestshoring
Expertise strategy
Nearshoring

A short guide to succeeding with Nearshoring

For many companies, the decision to go nearshore is not an easy one. It’s a decision that requires a great deal of consideration – we know that because several of our current clients were also reluctant to go nearshore at first. Learn our tips on how to get it right.