Digital Operational Resilience Act (DORA)

The DORA aims to establish a comprehensive digital operational resilience framework with rules for regulated financial service providers in the EU. Banks, investment firms, clearing houses, insurers, fintechs and other companies in the financial sector (‘financial entities’) in the EU will have to apply strict standards to prevent and limit the impact of ICT-related risks. ICT providers in Switzerland and globally that offer their services to financial entities in the EU will likely be impacted, whether they are unaffiliated third parties or group companies affiliated to an EU financial entity.

In September 2020, the European Commission published the draft Digital Operational Resilience Act (DORA) as part of its larger digital finance package. The legislative proposal largely builds on initiatives introduced by various European regulators and combines them in one regulation. DORA shifts the focus from only guaranteeing the financial entity’s financial resilience to also ensuring they can maintain resilient operations through an incident of severe operational disruption.

The need for legislative action follows from the ever-increasing dependency of the financial sector on software and digital processes which was recently further intensified by the Covid-19 crisis, starting with remote access from the home office to payment services and all sorts of complex financial services. This also means that ICT risks are inherent in finance.