A “compliance-focused effort”, guided by a need for cost efficient implementation across the globe, more than a holistic take on risk management. This was one description of how the EU’s recently implemented ICT risks framwork DORA has come into reality, as the topic was discussed at the Optic conference in Amsterdam on Tuesday. 

As virtually all of today’s business processes run deeply supported by information and communication technology (ICT), where do you draw the line between an ICT incident and any other? With the EU’s Digital Operational Resilience Act (DORA) having gone live at the beginning of 2025, a Tuesday panel at AFME’s Optic conference looked into how it is working. DORA seeks to manage ICT risks in general, one type of such risks being third-party related risks where such services are outsourced.  

The session was titled “Operational Resilience: How is Third Party Risk Management evolving?”. Panellists were … 
Andreas Papaetis, Senior Policy Expert, European Banking Authority, 
Arnav Gupta, Associate, legal firm Ashurst,
Emmanuel Le Marois, Vice President, Northern Trust, 
led by moderator Philip Saunders, Managing Director, Executive Office, Goldman Sachs.

“Now, the test with time will be whether DORA is flexible enough to mitigate those risks,” says Emmanuel Le Marois, who perceives that the implementation of the framework was a big effort for many firms in scope, and that they thus needed to focus on complying rather than minimising the risk from a more holistic viewpoint. 

While DORA aimed to make rule compliance easier by consolidating rules from various regulations into a more consolidated one, some voice suspicion that it could be too specific to today’s current technical concerns. Arnav Gupta described how the UK, instead, has taken a more “principles-based” approach.

The yearly Optic conference, in Amsterdam on 7–8 October 2025, is hosted by the Association for Financial Markets in Europe (AFME). Optic stands for the “Operations, post trade, technology and innovation conference”. PostTrade 360° is there, with our coverage collected here.