DORA - Digital Operational Resilience Act
How CRYPTAS can help you to
comply with regulation (EU) 2022/2554.
What is DORA?
The Digital Operational Resilience Act (DORA), Regulation (EU) 2022/2554, addresses ICT risk and sets rules on ICT risk-management, incident reporting, operational resilience testing and ICT third-party risk monitoring. This Regulation acknowledges that ICT incidents and a lack of operational resilience have the possibility to jeopardise the soundness of the entire financial system.
Who is affected?
DORA covers a wide array of financial service providers such as banks, credit institutions, payment institutions, e-money institutions, insurance companies, investment firms, and crypto-asset service providers, among others. Significantly, DORA delineates crucial ICT services offered to financial institutions. Should an entity provide critical ICT services to a financial institution, it will fall under direct regulatory supervision as outlined in the DORA framework. This encompasses services like cloud platforms and data analytics.
Entities found to be in violation of the Act's requirements could be subjected to fines up to 2% of their total annual worldwide revenue or, for individuals, a maximum fine of EUR 1,000,000.
How to approach the challenge?
Financial institutions are faced with a host of rules to comply with DORA. Although data security and cryptography related topics are only a small portion of the overall DORA requirements, they are still affecting all processes throughout the entire business.
A holistic approach is advisable, by providing corporate trust services centrally to all organization units and to all business processes.
CRYPTAS provides assistance in designing, implementing and operating such corporate trust services.
Structure of the regulation
As a “Regulation” it is immediately effective to all financial entities with the EU, without the need for an implementing act by the individual member states. On 17 January 2025, DORA will become effective. While the Regulation itself is stating the objectives and requirements on a rather abstract level, certain aspects have been further detailed in a Regulatory Technical Standards (RTS), which is available in its final draft from January 2024.