Information on Digital Operational Resilience Act (DORA)

Financial entities (including banks, insurance companies, investment firms and payment service providers) and their third-party ICT providers must have a valid and active LEI if they are legal entities.

• The Digital Operational Reselience Act affects the following sectors:
• Credit & payment institutions
• Investment firms
• Electronic money institutions
• central securities depositories
• central counterparties
• trading venues
• trade repositories
• Crypto asset markets: providers of crypto services, issuers of crypto assets, of asset-linked tokens and of significant asset-linked tokens
  Management companies
• Alternative investment fund managers
• Services for the provision of data
• Rating agencies
• Auditors and audit firms
• Insurance and reinsurance companies
• Insurance brokers, reinsurance brokers and insurance brokers in secondary employment
• Institutions for occupational retirement provision
• Administrators of critical benchmarks
• Service providers in the area of crowdfunding
• Securitization registers
• Third-party providers of information and communication technologies (ICT) 

DORA is intended to strengthen confidence in the digital infrastructure of the financial sector through strict regulations for risk management, security requirements and the monitoring of third-party providers.

The regulation focuses on five “pillars of operational resilience”, which entail the following requirements for companies:

1. ICT risk management:
Companies have the task of continuously monitoring ICT risks. Accordingly, they must implement suitable measures to detect cyber attacks or technical faults at an early stage. Risk assessments must be repeated regularly in order to ensure preventative security. Finally, risk management must be anchored in the company in a structured manner, which also implies the definition of roles and responsibilities.

2. ICT-related incident reporting:
If serious ICT-related incidents occur, companies have a duty to report them promptly to the relevant authorities. This standardized reporting obligation improves cooperation with supervisory authorities and helps to combat threats effectively. Companies must set up clear protocols and systems for both ICT risk management and incident reporting. This enables a quick and coordinated response.

3. operational resilience testing:
DORA requires companies to subject the resilience of their systems to ICT-related threats to regular testing. Simulated crisis scenarios are used to check whether the company remains functional in an emergency. If not, appropriate measures must be taken and structures adapted.

4. ICT third-party provider risk:
Companies have a duty to ensure that their ICT service providers (for example cloud providers) comply with the required security standards. This is done by comprehensively checking the contractual obligations and security precautions of third-party providers.

5. exchange of information:
Sharing information about potential ICT threats and vulnerabilities helps all stakeholders to adapt quickly to new threats. For this reason, the sharing of information between companies and authorities is actively encouraged.
The German Federal Financial Supervisory Authority (BaFin) actively supports the implementation of DORA in Germany and sees it as a key to strengthening financial market stability.

Where can you find further information on DORA?

You can find further information on the official BaFin website on the subject of DORA.

Further information can be found on the official BaFin website on the subject of DORA.