From regulation to resilience: Why DORA matters for the European asset management industry

DORA is the foundation for transformation and risk management

Michael Horvath, sustainability leader and regulatory advisory services at PwC Luxembourg, explains how this year’s Digital Operational Resilience Act is already changing the finance sector.

At a time when digital technologies are woven into virtually every facet of our daily lives, and with a game-changing wave of artificial intelligence just starting to be felt in the financial sector, resilience, robustness, efficiency and reliability of operations are top of mind for decision makers.

This is the context in which the European Commission passed the Digital Operational Resilience Act (DORA). While cybersecurity is part and parcel of this landmark regulation, it goes far beyond that as it seeks to fortify the European financial sector’s overall resilience, by requiring rigorous IT risk management processes and oversight of third-party service providers.

Applicable from 17th January 2025, DORA is raising the bar for all players and, as with all new regulations, poses challenges with the understanding, interpretation and risk-based implementation of the requirements.

In this context, asset managers should adopt a forward-thinking approach to DORA, where it serves as the foundation for their digital transformation and risk management strategies.

Understanding DORA and its implications

With around 22,000 financial entities and a wide array of IT third-party service providers (IT TPPs) in scope, DORA is the centrepiece of the evolving EU digital resilience and security framework, and it is nothing short of transformative.

In a nutshell, DORA seeks to ensure that financial entities can withstand, respond to and recover from IT-related disruptions, whether caused by cyberattacks, system failures, or outages from IT TPPs. This is particularly critical for asset managers, who rely on a complex web of digital tools and IT TPPs - essential ingredients for success in a competitive landscape - while simultaneously focusing on (cost) efficiency as the IT service price tag continues to climb.

DORA has five main pillars: IT risk management; IT-related incident management; classification and reporting, digital operational resilience testing; IT third party risk; and information-sharing arrangements.

As such, asset managers have been implementing a wide array of prescribed measures to improve their cybersecurity and digital operational resilience, such as establishing a comprehensive IT risk management framework, implementing an IT-related incident management process, conducting regular IT resilience testing and monitoring the potential risks posed by any IT TPPs.

IT TPPs are also at the heart of one of DORA’s most significant features, as it requires financial entities to maintain a comprehensive ‘Register of Information’ (ROI) that documents all contractual arrangements with IT TPPs (e.g., cloud and datacentre services, software vendors etc.). The ROI requirements have drawn the ire of many market participants for the level of complexity and (partially) missing or late guidance from regulatory authorities.

From setting up and regularly updating the register, to establishing comprehensive and cross-functional frameworks for IT risk management and resilience, implementing DORA is far easier said than done. This is particularly the case as in-scope firms should ensure that they can execute all DORA-related requirements at all times, but are assessed with a pure compliance and “ticking the box” approach.

The regulation brings forth significant complexities and cost implications for asset management firms, many of which have had to invest in new technologies, processes and personnel to comply with DORA. But IT TPPs are not off the hook, and they need to keep pace with these new requirements that trigger changes and costs.

Moreover, with DORA compliance coming to be seen as a non-negotiable entry-point going forward, it will likely accelerate market consolidation within the financial sector and among IT TPPs, potentially limiting the choice for asset managers and opportunities for new technology start-ups.

Asset managers are therefore advised to use DORA as a springboard for planning into 2030 and beyond – which includes a reassessment of their IT strategy to elevate the business focusing on processes, the (in-)efficiency of data usage, and their IT TPP landscape. With AI accelerating much faster than expected, this may be a question of a company’s speed over its size.

Lastly, the regulation places a significant burden on top management, which, as outlined in Article 5, shall “bear the ultimate responsibility for managing the financial entity’s IT risk.” This means a lack of commitment from the leadership would put the entire implementation process at risk, while simultaneously reducing the firm’s operational resilience.

To counteract this, DORA includes a clause that says that management will also be required to undergo compulsory training on digital operational resilience. For many entities, that might end up being a simple compliance exercise without grasping the regulation’s inherent value.

Towards a resilient and transformative future

There is no doubt that DORA’s stipulations are very challenging for European asset management firms. Modernising legacy systems while reviewing or overhauling existing risk management processes is a daunting endeavour.

However, DORA’s true value lies in its potential to:

  1. Accelerate the industry’s digital transformation;
  2. Embed resilience into the very fabric of all asset management operations;
  3. Streamline existing operations; and
  4. Encourage the embrace of new technologies and their transformative promises (e.g. Cloud, AI)

All of the above prepare asset managers as competitive and trusted business partners for the future.

For firms willing to look beyond the regulatory checklist, DORA offers a blueprint for building smarter, more secure and more agile organisations. It increases asset managers’ preparedness to minimise, withstand and recover from IT-related threats and disruptions, and still deliver critical services.

In addition, it encourages a more disciplined and transparent approach to outsourcing, which reduces exposure to vendor-related disruptions while strengthening governance and accountability across the digital supply chain.

The C-Suite of the European asset management industry should proactively embrace DORA's principles to future-proof their operations, maintain business continuity and build trust with regulators and clients, while positioning themselves to thrive securely in a financial sector that is more agile and digitally driven than ever.