DORA implementation shifts focus to operational resilience in banking

Following the implementation of the Digital Operational Resilience Act (DORA) in January 2025, financial institutions are transitioning from establishing regulatory structures to proving their operational effectiveness. A KPMG study involving over 70 companies across 17 countries indicates that while governance frameworks and roles are largely established, many banks struggle to provide robust evidence that these processes function under real-world conditions.

Key areas of focus include ICT risk management, which shows relatively strong operational evidence, and third-party risk management, which requires significant adjustment. Under DORA, financial firms remain responsible for the security of outsourced critical IT tasks. This necessitates rigorous background checks and security standards for external IT service providers that match those of internal staff. Regulatory authorities now expect documented proof of external employee verification rather than simple contractual clauses.