The European Supervisory Authorities (ESAs) have issued a statement urging financial entities and ICT third-party providers to intensify their preparations for the Digital Operational Resilience Act (DORA). The regulation, along with its technical standards and guidelines, will come into effect on 17 January 2025, requiring readiness without any transitional period.
The ESAs emphasise the need for a structured and robust approach to meet DORA’s stringent requirements. Financial entities are expected to address gaps in their operational setups and align them with DORA’s obligations promptly. While many financial institutions may already be familiar with similar requirements under sectoral regulations, those with limited prior exposure to digital resilience mandates may face additional challenges.
Reporting obligations take priority
A significant aspect of DORA’s implementation is the introduction of new reporting obligations. By early 2025, financial entities must have registers of their ICT third-party providers’ contractual arrangements ready for review by national competent authorities. These authorities, in turn, are required to report the collected data to the ESAs by 30 April 2025. Preparations should leverage insights from the 2024 dry-run exercises and align with the Commission’s November-adopted implementing technical standards on reporting.
Third-party ICT providers meeting criticality criteria outlined in May 2024 are also urged to evaluate their operations against DORA’s standards. The first round of critical provider designations is expected in the second half of 2025, adding urgency for providers to ensure compliance.
No time to waste
With no transitional period provided under DORA, the ESAs continue to stress the importance of timely compliance efforts. They remain committed to offering guidance to ensure a smooth implementation process across the sector, but the responsibility lies firmly with financial entities and service providers to act without delay.
