Why ‘DORA the Enforcer’ could prove costly for UK firms
As acronyms go, it’s cute and memorable. But for financial institutions in the UK and across Europe, the consequences of ignoring DORA are anything but friendly.
The Digital Operational Resilience Act (DORA) is a European Union regulation which came into force in January 2023 but became applicable last month. It didn’t receive the fanfare of GDPR – think of it as a younger, slightly less obnoxious cousin – as it applies only to financial entities with EU clients or operations. But it’s still a potential headache for a growing number of UK firms – among them banks, insurers, investment firms and ICT service providers.
While GDPR focuses on data protection and privacy rights, DORA’s scope is digital resilience, cybersecurity and operational risk management. Firms are required to implement robust ICT risk management frameworks to ensure the security of their digital operations. Regular resilience testing is compulsory, while there are new requirements for monitoring and managing risks associated with third party ICT service providers.
As with GDPR, procedures must be in place for reporting incidents to the relevant authorities – with heavy penalties for non-compliance. Institutions in breach of DORA may be fined up to 2% of their total annual worldwide turnover or 1% of their average daily worldwide turnover. No wonder it’s causing discomfort in certain UK boardrooms.
No one (in their right minds) enjoys being in the thick of a major crisis. And very few think one will happen to them – until it does. The UK’s Cyber Security Breaches Survey estimates that more than one in five businesses experienced cyber crimes in 2024 – nearly eight million in total. The National Cyber Security Centre says the number of ‘highly severe’ cases tripled from the previous year.
The threat is clear. But there are easy and cost-effective ways to plan ahead and mitigate the risks. Indeed, we’re seeing an increasing number of clients limbering up for the day when (not if) a crisis unfolds. The price of not doing so is costly – not just financially but reputationally too. We recently started offering Reputation Threats Audits and have been surprised by the uptake. At a time when firms of all sizes are under ever more intense scrutiny from stakeholders, the public and the media, being prepared is simply a boring but essential part of business.
It has other benefits too. ‘Resilience isn’t just a choice, it’s a competitive advantage,’ says Sandip Patel KC, who specialises in regulatory proceedings, cross border civil and commercial dispute resolution, fraud and white collar crime. ‘In the case of DORA, staying compliant and safeguarding their financial future is vital for financial services companies of all sizes. In a digital world, only the secure and prepared thrive.’
While DORA originates from the EU, some of the UK’s own financial regulatory authorities, such as the Bank of England and Financial Conduct Authority, are also developing their own operational resilience frameworks. So even companies without EU clients will have to ensure their houses are in order.
In the meantime, according to some reports, nearly half of UK financial firms missed last month’s DORA compliance deadline. A decision that could cost them dear when the next crisis strikes.
George Thwaites, Head of Corporate, Maltin PR