Banking News

The Digital Operational Resilience Act (DORA) is an EU regulation that came into force In January 2023 and will apply from 17 January 2025.

DORA is part of the EU Commission's digital financial package with the aim of increasing the digital resilience of the European financial market. The aim is to ensure that financial market participants can continue to operate reliably even in the event of incidents concerning ICT (information and communications technology) or key suppliers.

There is a considerable amount of overlap between DORA and existing regulations that are currently in place. However, DORA sets out specific and technical requirements across key obligations, proportionate to a firm’s size, business and risk profile.

While the scope of the CBI Guidance on Operational Resilience applies to all regulated financial service providers, the scope of DORA is much broader and as such, a vast range of entities from large and complex organisations to small and simple businesses may be required to comply with this regulation. 

Many of these entities are not traditionally regulated financial service providers such as central counterparties, crypto-asset and crowd funding service providers, management companies, audit firms and ICT third party service providers.

The key challenges to compliance are explained below:

• ICT Risk Management: DORA requires the adoption of an ICT governance and control framework, including an ICT risk management framework to be documented and reviewed at least yearly.
• ICT Incident Reporting: DORA requires the streamlining of ICT incident reporting through the logging and classification of ICT incidents and reporting of major incidents to competent authorities using common templates and procedures.
• Digital Operational Resilience Testing: DORA requires the performance of basic digital operational resilience testing at least annually for all financial entities, and advanced threat-led penetration testing at least every 3 years for significant entities.
• Management of ICT Third-Party Risk: DORA requires that firms monitor third-party contractual arrangements at all stages and enable European Supervisory Authorities (ESAs) oversight of ICT third-party service providers deemed ‘critical’.
• Information-Sharing Arrangements: DORA establishes voluntary participation in intelligence sharing through the exchange of cyber threat information among financial entities, including tactics, procedures and signs of compromise.

The introduction of the DORA Regulation may pose several challenges for firms, as they may not be adequately prepared to implement the new requirements.

In addition, the European Supervisory Authorities (ESAs) including the European Banking Authority (EBA), the European Securities and Markets Authority (ESMA) and the European Insurance and Occupation Pension Authority (EIOPA) are in the process of developing additional regulatory technical standards, with a second batch due in November 2023.

Whilst working with firms on DORA assessment and implementation, KPMG supports firms in overcoming challenges relating to DORA governance, bringing ICT systems and processes up to date, aligning ICT suppliers to DORA, and conducting testing. 

• KPMG have deep experience of all phases of DORA, from assessments through to implementation across local and European clients.
• KPMG has a comprehensive professional repertoire regarding all relevant disciplines in the area of DORA regulation, including Cyber, Regulatory, Risk, Technology and Management Consulting areas. 
• We have a deep understanding of processes, risks and controls as well as governance structures relevant to DORA. 
• We specialize in advising and supporting our clients in all aspects of these disciplines.

End of an era: Central Bank sells remaining IBRC-linked bonds: The Central Bank has sold the remaining €500m of bonds linked to the restructuring a decade ago of the taxpayer bailout of Anglo Irish Bank and Irish Nationwide Building Society (INBS). The Central Bank has sold down of the floating rate bonds since 2024 to the NTMA, which has immediately cancelled the notes. Minister for Finance Michael McGrath welcomed this news and added that “the substantial regulatory reforms put in place … since the crisis mean that the Irish banking system is much better placed to face any future challenges, should they arise.” (The Irish Times, 7th September 2023).

Central Bank governor calls for ‘much faster’ pass-through of rate hikes to borrowers and savers: Central Bank of Ireland governor Gabriel Makhlouf has called on commercial banks to play their part in the fight against inflation with a faster transmission of central bank rate increases to Irish borrowers and savers. The ECB has raised its main lending rate to 4.5%, marking the tenth increase it has imposed since July 2022. Irish banks have lagged their eurozone peers in passing on these aggressive rate hikes to households with overnight or on-demand deposit accounts. Whilst closely monitoring this transmission, the Central Bank is not seeking to intervene in commercial banks’ rate decisions. (The Irish Times, 20th September 2023).

Central Bank extends knowledge and competence standards for credit unions: The Central Bank of Ireland has extended minimum competency requirements for credit unions. Credit union staff providing services in scope – including lending and term deposits – will be required to meet minimum knowledge and competence standards. Credit union members will now be provided the same protection as consumers using similar services offered by alternative financial providers. Transitional arrangements are available to credit union staff to obtain relevant qualifications in line with these Standards. (Central Bank of Ireland, 28th September 2023).