DORA is forcing financial institutions to move beyond regulatory compliance and build integrated, enterprise-wide approaches to third-party risk, operational resilience and dependency management, with industry leaders warning that understanding complex su
Operational resilience will depend
less on satisfying regulatory checklists and more on understanding how
increasingly complex technology ecosystems function in practice, according to
risk leaders discussing the industry's implementation of the Digital Operational
Resilience Act (DORA).
As financial institutions move from
regulatory preparation into day-to-day execution, panelists argued that success
will be determined by organizations' ability to identify critical dependencies,
coordinate across business functions and strengthen visibility well beyond
their immediate third-party relationships.
Speaking at CeFPro's Treasury &
ALM Europe conference, a panel comprising the Head of Third-Party Risk
Management at a European bank, the Deputy Director of Cyber Advisory at a
global cybersecurity consultancy and the Chief Risk Officer of an international
securities firm agreed that many of DORA's underlying concepts are not new.
What has changed, they said, is the
expectation that firms connect operational resilience, outsourcing,
cybersecurity, governance and incident management into a single, defensible
operating model.
The Head of Third-Party Risk
Management argued that organizations have largely completed the initial
contractual remediation phase and are now confronting the more difficult task
of mapping complex supply chains.
Rather than focusing solely on
contracts, institutions must understand how critical business functions depend
upon interconnected services and the subcontractors supporting them.
"I love the holistic
approach," the executive said. "We move away from checklist
compliance... into just really trying to understand end-to-end processes,
operational resilience, how does it work in the whole chain?"
She explained that firms are
increasingly assessing not only service availability but also data
confidentiality and integrity while tracing dependencies through multiple
layers of suppliers.
That process, however, remains far
from straightforward.
The panel described how institutions
are validating supplier disclosures against independent evidence, including
security reports and operational assessments, while working closely with
technology, information security and procurement teams to identify missing
subcontractors and hidden dependencies.
The Chief Risk Officer cautioned that
translating regulatory intent into operational reality remains one of the
greatest challenges facing the industry.
"I think the largest gap... is
trying to find a way to get there," he said, noting that firms often do
not discover operational weaknesses until they experience them firsthand.
Recalling a major office relocation,
he described how an overlooked fiber-optic cable requirement only became
apparent immediately before the move, illustrating how practical operational
risks frequently emerge despite careful planning.
From a cybersecurity perspective, the
Deputy Director of Cyber Advisory highlighted the growing importance of
understanding interconnected supply chains rather than relying on static vendor
inventories.
Traditional procurement records and
asset registers rarely capture the full complexity of modern technology
environments, particularly where cloud providers, shared infrastructure and
subcontractors create multiple layers of operational dependency.
