When do Cloud providers need to worry about a banking regulation? When that regulation is so far-reaching that it extends beyond the financial services sector to all the operators that serve it. That’s DORA, the EU’s Digital Operational Resilience Act.
Having entered into force in January 2025, DORA is the new bouncer on the door of the financial services party. Only Information and Communications Technology (ICT) providers that meet a suite of requirements on risk management and response are allowed to join—and DORA has high standards.
The new regulatory burden for providers is certainly significant. For some, it will mean overhauling operations if they want to avoid being locked out of an entire market.
At the same time, though, DORA imposes tougher requirements on hyperscalers and actively encourages diversification in Cloud provision—potentially creating more room for alternative European service providers on the guest list.
What is DORA?
DORA is fundamentally an instrument of standardization. The European Commission wants to ensure that all financial sector businesses in the EU meet the same criteria for ICT risk management. This is a sector facing a threat landscape that includes cyberattack, Cloud outage, ransomware and human error, but also the increase in ICT outsourcing and the possible risks of third-party concentration.
Before now, different jurisdictions in Europe imposed different ICT security requirements. DORA establishes a unified framework which, by being unified, aims to reduce the compliance burden for companies operating across borders, and to improve the overall resilience of the sector.
The regulation applies to all traditional banks and investment firms, but DORA is no snob about crypto, fintech, payment or crowdfunding platforms, either. Everyone must meet the same standards.
Crucially, DORA’s requirements apply not just to European financial institutions but also the ICT providers that serve them. The instructions require financial services businesses to manage their own third-party risk. That means getting out the clipboard and thoroughly auditing their full supply chain.
DORA: the new framework for ICT security
The technical requirements established under DORA for financial entities and their ICT service providers fall into four categories:
- ICT risk management: critical asset mapping, system monitoring, business continuity and disaster recovery planning
- ICT third-party risk management: maintaining a Register of Information, establishing security, audit and exit clauses in contracts, and assessing concentration risk
- Digital operational resilience testing: running assessments including vulnerability tests, gap analyses and source code reviews
- ICT-related incidents: detecting, managing, classifying and reporting major incidents within strict timeframes
DORA also encourages information sharing as a fifth vital, but not compulsory, domain—meaning financial institutions should exchange knowledge on threats, potential compromises and defensive strategies.
An additional stipulation under DORA applies to ICT third-party service providers which are deemed “critical” to the financial services sector. These providers are subject to direct oversight by the European Supervisory Authorities, including on-site inspections, with potential fines up to €5m for non-compliance.
That’s where the hyperscalers are implicated. Late last year, the first 19 Critical ICT Third-Party Provider (CTPPs) were designated, and the list includes Amazon Web Services, Google Cloud, Microsoft and Oracle.
Beyond banking: DORA implications for Cloud providers
DORA closely controls who is invited to the financial services party—and it’s not just those ICT service providers that fall under direct oversight that need to understand the entry requirements.
Any ICT provider that wants to work with financial services clients in the EU must meet DORA’s standards. Contracts must establish a number of clauses laid out in Article 30 of the regulation.
But it’s not all velvet rope red tape for ICT service providers. By putting the spotlight on third-party ICT risk, particularly the risk of relying on a few hyperscalers, DORA calls on financial institutions to diversify their Cloud and other services.
Under the category of ICT third-party risk management, the Commission identifies the risk of overexposure to individual or closely related critical ICT third-party service providers, which could lead to large losses or endanger the financial stability of the Union in the event of a failure.
By forbidding 100% reliance on hyperscalers, and imposing direct oversight on certain companies, DORA could see business flowing towards independent and alternative service providers.
As European fintechs and banks actively seek secondary partners, those that already operate under EU jurisdictions, provide transparent pricing and focus on data sovereignty (remember CADA?) will be primed to step onto the red carpet.
DORA Q&A
Is DORA a banking regulation? DORA’s framework applies to all financial services providers in the EU—including banking and investment institutions, as well as fintechs—and the ICT services they contract.
What are DORA’s requirements? The framework covers four categories: ICT risk management; ICT third-party risk management; digital operational resilience testing and ICT-related incidents. It also encourages information sharing, and implements direct oversight of certain “critical” third-party ICT providers.
What does DORA mean for ICT service providers? DORA imposes strict regulatory requirements for providers contracting with financial services businesses. It also encourages more diversification of third-party service providers within the financial services sector, potentially changing business flows.
Get to grips with the financial services industry opportunity at CloudFest. Registration is open and free to the core Cloud community.
