DORA (Digital Operational Resilience Act) – Strengthening the backbone of modern financial systems

By Finance Monthly

DORA intends to impose higher transparency standards on investment firms, forcing them to provide more detailed and regular disclosures to regulatory agencies and investors. This will need the development of new reporting frameworks capable of capturing a greater range of operational risks and occurrences.

digital-operadora Junaed Kabir, interviewtional-resilience-act-juaned-interview

In a digital age where cybersecurity and operational resilience are paramount, the European framework known as DORA (Digital Operational Resilience Act) has emerged as a significant touchstone for financial markets. This act illuminates the pressing need for financial institutions to bolster their digital defences and streamline operations, particularly against the backdrop of increasing cyber threats and ICT disruptions. As we delve into this intricate framework, we sit down with Junaed Kabir, Partner and Managing Director of Parva Consulting, to uncover its profound implications, specifically for Luxembourg, a notable epicentre in the global funds industry. The insights provided shed light on the challenges ahead and highlight the potential opportunities for those ready to adapt and innovate.

To begin, please clarify the essence of DORA and its significance to the funds industry?

DORA (Digital Operational Resilience Act) is a European framework that aims to establish a robust and resilient approach to delivering digital capabilities in Financial Markets.

The requirement to ensure that organisations can continue resilient operations in the face of significant disruptions caused by cyber-attacks and information and communication technology (ICT) concerns is at the heart of DORA. DORA fosters the convergence of standards for ICT and cyber practises by offering a unified and consistent approach.

DORA covers five major issues: ICT risk management, incident reporting on ICT-related topics, administration and oversight of critical third-party providers, digital operational resilience testing, and information and intelligence exchange.

DORA underlines the significance of financial firms proactively identifying and categorising ICT assets in order to restrict inherent risks to acceptable levels. Financial institutions must develop effective risk management policies to protect themselves from cyber-attacks and disruptions by thoroughly knowing their digital infrastructure.

Luxembourg is a prominent hub in the global funds industry. How do you envision DORA specifically impacting this sector in Luxembourg?

The emphasis placed by DORA on strengthening operational resilience and defending against ICT-related risks will compel Luxembourg’s financial institutions to reconsider their current processes and controls.

DORA will necessitate the implementation of new and more sophisticated rules, information technology controls, and resilience testing procedures. While some businesses, such as credit unions and investment firms, may already be in compliance in some areas, many will need to create totally new frameworks to meet DORA’s criteria.

As the compliance journey evolves, it becomes increasingly crucial to incorporate critical stakeholders in the process. Information Security Officers, IT Officers, Risk Officers, and others must work together and contribute to achieve total compliance.

Can you delve into how the implementation of DORA might affect the daily operations of firms in the funds industry?

As Luxembourg-based financial institutions begin their compliance journey, it is obvious that DORA necessitates a proactive and dynamic approach to operational resilience and risk management.

Given the prominence of Luxembourg in the global funds industry, the country’s financial firms will need to embrace DORA’s criteria in order to maintain their competitiveness and reputation. As the legislative process draws to a close, the Luxembourg financial sector must prepare to detect, monitor, and defend itself against an increasing variety of ICT-related threats. This includes adapting to the Act’s requirements for robust ICT infrastructure, incident reporting systems, and comprehensive testing.

Are there particular challenges that Luxembourg-based funds might face concerning DORA that you don’t foresee in other jurisdictions?

The adoption of DORA is expected to have a significant impact on the financial industry, requiring various reforms to comply with the new regulatory framework. DORA seeks to increase the operational resilience of financial institutions by pushing investment firms to make significant changes to their internal procedures, risk management systems, reporting, and transparency methods.

Many Luxembourg-based financial institutions benefit from the IT infrastructure of a parent firm that is not based in Luxembourg. Control, oversight, and incident reporting are frequently assigned to the parent corporation. This will have to change; under DORA, the Luxembourg organisation must be able to demonstrate complete ownership of the IT infrastructure.

Investment businesses will need to conduct a thorough examination of their internal procedures in order to identify flaws and potential sources of failure. To avoid disruptions caused by cyberattacks or technological failures, comprehensive operational risk management practises, such as the establishment of contingency plans and seamless communication between departments, will be essential.

Investment firms will need to invest in advanced technology and cybersecurity measures to boost operational resilience. Cyber threats constitute a significant threat to operational continuity; therefore, enhancing cyber defences is vital.

DORA is a critical step towards enhancing the financial industry’s technology and cyber risk management and resilience. DORA’s goal is to offer a uniform regulatory framework that improves the industry’s operational resilience across all EU member states by focusing on risk management, incident reporting, and oversight of critical third-party providers. Financial organisations must proactively embrace DORA’s criteria to ensure their ability to withstand, respond to, and recover from ICT-related disruptions and threats, ultimately safeguarding the stability and security of the financial system.

DORA intends to impose higher transparency standards on investment firms, forcing them to provide more detailed and regular disclosures to regulatory agencies and investors.

What opportunities might the introduction of DORA bring for the funds industry, particularly in Luxembourg?

The implementation of DORA in Luxembourg opens several opportunities for the funds business, leading to increased growth, innovation, and competitiveness in the global financial market.

Increasing Investor Confidence: DORA’s focus on improving investor protection and market integrity has the potential to boost investor trust and confidence. This could increase the amount of investment in Luxembourg-based funds by attracting both institutional and retail investors.
DORA compliance is projected to increase demand for professional advising services from financial consulting and law companies, which will help fund management organisations navigate the rule’s complexities.
Investment firms will need to modernise their digital infrastructure to boost operational resilience and cybersecurity, fuelling demand for fund-specific fintech solutions.
DORA can foster innovation in the finance sector, resulting in enhanced productivity and cost-effectiveness.

DORA’s implementation has the potential to improve collaboration and knowledge exchange across the funds industry, resulting in a more unified and forward-thinking financial ecosystem.

How should fund managers prepare for the implementation of DORA? What steps can they take now to ensure a smooth transition and ensure they are ready for January 2025?

Fund managers need to plan ahead of time for the adoption of DORA to ensure a smooth transition and compliance with the new regulatory framework. Early and planned action will help them mitigate hazards, streamline processes, and improve overall resilience. They can take the following critical steps:

Start early: Fund managers should not leave DORA compliance until the last minute. Beginning early allows for a thorough assessment of the impact and the development of a well-structured plan.
Conduct an extensive impact assessment: A detailed impact assessment is required to determine the scope of changes required to comply, determine policy and procedure gaps and opportunities for improvement.
Dedicated Teams: Form a team of professionals from the legal, compliance, risk management, and IT departments to handle the implementation process efficiently.
External experts: Bring in external specialists with regulatory compliance skills if necessary to gain a complete understanding of DORA’s standards.
Develop a Comprehensive Action Plan: The plan should include specific tasks, deadlines, responsible parties, and significant milestones to address the changes required for compliance.
Participate in Regulatory Bodies and Industry Associations: Attend workshops and conferences to stay current on DORA compliance advancements and best practises.
Make training and awareness a top priority: Inform staff from all departments about the significance of DORA and their role in compliance. Regular training sessions help to foster a compliance culture.
Simulate disruptive events to assess the firm’s ability to respond and recover, emphasising areas for operational resilience enhancement.

How does Parva Consulting support clients in preparing for and navigating regulatory changes like DORA?

Parva Consulting assists customers in preparing for regulatory developments like DORA, achieving compliance and improving operational resilience through professional consulting services.

Impact Evaluations:Parva Consulting will undertake a complete impact analysis, examining companies’ operations, risk management systems, and procedures to discover DORA compliance changes.
Application of regulatory rules and best practices:Navigating complex regulatory changes requires experience and understanding. Parva Consulting provides guidance on DORA’s requirements, as well as the interpretation of rules and best practice insights.
Creating an Action Plan:We support clients in developing and implementing strong action plans that outline activities, timelines, and milestones for DORA compliance.
Employee Education:Parva Consulting provides training programmes to guarantee that staff are well-informed and capable of contributing to compliance activities.
Technological Solutions:We aid in the identification and implementation of technological solutions for streamlined compliance processes, such as risk management and cybersecurity.
Ongoing Support:Parva Consulting provides clients in the funds industry with ongoing support and monitoring, keeping them informed of DORA-related changes, assisting them in adapting their compliance plans, and ensuring a smooth transition through the regulatory reforms to improve operational resilience and achieving a robust compliance framework.

Original post: Finance-monthly.com/

Case Study – Digital transformation project for an international Loan & Leasing company

March 18, 2024

An international Loan & Leasing company selected Parva Consulting to oversee a digital transformation initiative that would enable all its business divisions to function under a unified framework, while being locally compliant.

DORA and contractual arrangements

February 26, 2024

Tight deadline, big challenges: DORA's contractual requirements put pressure on financial entities and providers. Uncertainties and timelines raise industry concerns. Explore the key issues and emphasizes early action for a smooth DORA compliance journey.

RAIF and Luxembourg market

February 19, 2024

Approximately seven years after the introduction of RAIF funds into the Luxembourg fund market, we aim to explore their distinct features, amendments, updates, and evaluate their entry within the Luxembourg fund market.

Travel Rule Guidelines: EBA’s Blueprint to Combat the Abuse of Crypto-Assets Transfers for Money Laundering

February 9, 2024

The EBA published draft Guidelines on preventing the abuse of funds and certain crypto-assets transfers for money laundering and terrorist financing purposes under Regulation (EU) 2023/1113 (‘The Travel Rule Guidelines’).