Digital Operational Resilience Act (DORA)

What is DORA?

Starting January 17, 2025, the DORA regulation will be enforced across all EU Member States. This framework addresses the risks from digital transformation, interconnected networks, and sophisticated cyberattacks in the financial sector. It is part of the European Commission’s strategy to promote innovation while ensuring financial stability and consumer protection. DORA provides a harmonized framework for digital operational resilience and establishes oversight for critical ICT service providers at the EU level.

Objective of DORA:

DORA aims to ensure financial entities can withstand, respond to, recover, and learn from significant ICT-related disruptions. It shifts the focus from risk prevention to a proactive approach, assuming incidents will occur and emphasizing preparedness to maintain critical business activities. This approach enhances organizational agility and customer trust. For Euronext, DORA is an opportunity to strengthen operational resilience in IT, cybersecurity, business continuity, and third-party risks.

The 5 Pillars of DORA

ICT Risk management:

Establishing comprehensive frameworks for managing ICT risks.

Incident reporting:

Streamlining the reporting of major ICT-related incidents to competent authorities.

Digital operational resilience testing:

Conducting regular testing to ensure preparedness against cyber threats.

ICT Third-party risk management:

Supervising and managing risks associated with third-party ICT service providers.

Information sharing:

Facilitating the exchange of information on cyber threats and vulnerabilities among financial entities.

DORA Scope & Timeline

DORA applies to a wide range of financial entities, including banks, insurance companies, and investment firms, as well as ICT third-party service providers. The regulation came into force on January 16, 2023, and will be fully applicable from January 17, 2025.

Euronext implementation approach

Euronext has established a robust model to ensure compliance with DORA, leveraging its federal structure and group frameworks for Risk Management, Business Continuity Management (BCM), IT, and Cybersecurity.

Key actions include:

Dedicated program:

A comprehensive program covering all financial entities and intra-group ICT providers to ensure compliance by January 2025.

Strong governance:

Sponsored by senior executives, the program includes representatives from Risk, BCM, Internal Control, Information Security, IT, Finance and Legal departments. Regular committees and updates at both Group and local levels ensure effective governance.

Alignment with Euronext strategy:

The program aligns with Euronext’s goal of building stronger resilience and readiness to respond to evolving threats. From 2025, Euronext will integrate DORA principles into its strategy and daily operations, enhancing its ability to mitigate disruptions from cyber threats and other incidents.

By building on its existing strong foundation, Euronext is well-positioned to meet DORA requirements and enhance its digital operational resilience.

DORA FAQ

DORA aims to develop a European approach that fosters technological development and ensures financial stability and consumer protection across the EU financial sector. The primary subjects of DORA are EU Financials Entities, and EU and Non- EU ICT third-party providers (including Intra-group ICT) that provide services to the EU Financial Entities. Considering this scope, Euronext is prepared for DORA implementation on several entities (financial entities and Euronext ICT services).

Within each DORA pillar, Euronext has made an in-depth gap analysis of the full regulatory framework and carried out multiple actions, updated policies, procedures and systems, reviewed agreements and set new T&C up to ensure full DORA alignment. DORA implementation program has been set under a strong internal governance and with a close discussion and scrutiny from Euronext College of Regulators.

Euronext has set-up a Group-wide program leveraging on strong foundation and adjusting the existing model to ensure DORA implementation across all Euronext entities in scope. This program is composed of experts and key representative for key areas to cover group and all relevant local businesses and companies within Euronext.

Euronext regulated entities will be applying DORA as of the regulatory timeline of 17th of January of 2025.

To support our customers, Euronext is preparing the relevant documentation to be shared upon request.