With DORA – or, to give the act its full name, the Digital Operational Resilience Act –, the EU has begun to forge an oversight framework for banks’ Information and Communications Technologies (ICT) risks and for critical ICT third-party service providers. DORA introduces stricter regulation of ICT service providers, including cloud providers.
So you could say DORA brings consistent rules and oversight to the seemingly boundless sky beyond the clouds. My speech on DORA today will focus on three questions: First: Why DORA? What’s our take from a supervisory and financial stability perspective? Second: DORA, smaller banks and proportionality: What improvements could DORA deliver?