What is DORA?
The Digital Operational Resilience Act (Regulation (EU) 2022/2554) ('DORA') is a regulatory framework established by the European Union (‘EU’) that became effective on 17 January 2025. DORA is aimed at fortifying the operational resilience of the financial services sector amidst the rapidly evolving landscape of Information and Communication Technology (‘ICT’) risks.
Financial Entities are increasingly dependent on ICT services for their functioning. DORA prescribes ways in which EU-regulated Financial Entities (‘Financial Entities’) are required to test their operational resilience, cyber resilience, and manage ICT risks, including certain third-party risks. It also outlines the mechanisms by which regulators, including the European Supervisory Authorities (‘ESA’) and national competent authorities, will monitor Financial Entities.
DORA aims to provide a harmonized approach to achieving “a high level of digital operational resilience” of the financial services industry by ensuring that Financial Entities can withstand and adapt to a wide range of threats and disruptions, including cyber-attacks, IT failures, and other operational risks.
Key topics
Key topics of DORA
DORA requires Financial Entities to have in place a robust and comprehensive ICT risk management, governance, and control framework to mitigate their exposure to ICT risks and cyber incidents.
Financial Entities are required to put in place comprehensive digital operational resilience testing programmes according to the requirements set out under DORA. This includes joint threat lead penetration testing (‘TLPT’) with ICT service providers, pooled testing, and mutual recognition of testing results, allowing firms to further streamline their resilience tests and ensure that the ICT services supporting their functions are resilient to risks and cyber incidents.
DORA defines and strengthens ICT third-party risk management, building on existing outsourcing guidelines by the ESA. This supports Financial Entities in enhancing their management of third-party risks and standardises expectations of ICT third-party providers.
DORA harmonises incident reporting requirements for Financial Entities. This allows them to adopt standardised processes across EU geographies to classify, communicate (to regulators and clients), and report upon potential ICT risks and cyber incidents, as part of a holistic incident management capability.
DORA provides an option to Financial Entities to exchange information about cyber threats, including indicators of compromise, techniques, procedures, configuration tools, cyber security alerts, etc., with their peers. This helps improve risk readiness and operational response capability across the EU financial sector.
Scope and Approach
DORA Scope
The scope of DORA is very broad as it applies:
- DORA applies to a wide range of Financial Entities involved in the EU’s financial system. Article 2(1) of DORA lists entities to which DORA applies, including but not limited to banks, payment and credit institutions, financial data providers, investment financial entities, crypto asset service providers and more. All such entities have been collectively referred to as Financial Entities under DORA; and
- by way of extension beyond Financial Entities to ICT third-party service providers providing ICT services (including ICT services supporting critical or important functions). If an ICT third-party service provider is designated as critical under DORA Article 31, the ESA will appoint a Lead Overseer who will perform regular reviews and assessments of the third-party’s digital operational resilience capabilities and risks.
LSEG’s approach as an ICT service provider
LSEG complies with all laws and regulations applicable to it in the provision of its services and is committed to assisting its clients with their DORA compliance obligations for the ICT services provided by LSEG. Please contact your account representative for more information in this regard. Where LSEG is an ICT service provider, we have built and deployed or adapted existing client portals as follows:
- LSEG Data & Analytics, LSEG Risk Intelligence and FX services: The LSEG Operational Resilience Portal can be accessed at the following link - https://resiliencehub.lseg.com/
- London Stock Exchange plc services: Please visit the DORA webpage for the relevant service or contact your account representative
- LSEG Regulatory Reporting services: The Regulatory Reporting Customer Portal can be accessed at the following link - Login | Regulatory Reporting Support Portal (lseg.com)
- TradeAgent and SwapAgent services: The Knowledge Centre can be accessed at the following link -https://clearingservices.lch.com
- Acadia services: Acadia’s Documentation Portal can be accessed at the following link -https://portal.acadiasoft.com
We have also prepared contractual terms between our clients and the relevant LSEG business as follows:
- LSEG Data & Analytics, LSEG Risk Intelligence and FX services: LSEG Operational Resilience Annex (‘LSEG Annex’)
- London Stock Exchange plc services (Corporate Actions, SEDOL, and TRADEcho's Quoting Service): LSE Operational Resilience Annex (‘LSE Annex’)
- LSEG Regulatory Reporting services: LSEG PTRR Operational Resilience Annex (‘PTRR Annex’)
- TradeAgent services: the new Regulation 17 and associated definitions included from Version 2.0 of the TradeAgent General Regulations
- SwapAgent services: SwapAgent Rulebook Annex “Operational Resilience”
- Acadia service: the existing Master Services Agreement (MSA) between Acadia and the client.
In the current context, ‘Annex’ refers to the applicable operational resilience contractual terms for the relevant LSEG business as specified above.
Each Annex, Rulebook update (or, in the case of Acadia, the existing MSA) is written in a manner that allows our clients to comply with the contractual requirements set out in Articles 28 and 30 of DORA.
How does LSEG’s approach to DORA help clients?
The client portals (as applicable) contain or direct clients to relevant information and documents as set out in the respective Annex, Rulebook or MSA. This includes service descriptions, service levels, and information relating to incident management, sub-contractors, and service locations, as may be applicable to the provision of the ICT service(s) availed by the client.
The client portal for Data & Analytics, Risk Intelligence and FX enables clients receiving those services to:
- request the LSEG Annex. We will require a few data points from our clients to initiate the LSEG Annex request process. Such data points will have to be provided to us by the client at the time of requesting the LSEG Annex on the client portal;
- submit requests and access the client portal on a self-service basis for applicable documents such as service descriptions, register of information data, Service Level Agreements (‘SLA’) performance information (as applicable), incident information, and requests relating to TLPT and audit; and
- engage with LSEG’s Customer Assurance team for questions which go beyond the above-mentioned self-service documentation.
FAQs
Clarificatory Statement in relation to ICT Services vs Regulated Financial Services and ancillary services
In the recent guidance 2999-DORA 030 issued by European Insurance and Occupational Pensions Authority, the European Commission clarified that (i) where a service constitutes an ICT service under DORA, and (ii) the service provider and the financial service it provides are regulated under Union law, or any national legislation of a Member State or of a third country, the related ICT service should be considered to be predominantly a financial service and should not be treated as an ICT service within the meaning of DORA Article 3(21).
The European Commission further clarified that ancillary services that are inseparable from, indivisible from, preparatory for or necessary for the provision of a regulated financial service, and are not provided in a standalone manner, should not be treated as an ICT service under DORA. In line with such clarification, LSEG considers its regulated financial services and certain services provided by regulated LSEG businesses to be financial services, or services ancillary to financial services, and not ICT services under DORA. To find out which LSEG services are ICT services, please reach out to your account manager for the relevant LSEG business.
Disclaimer:
Any information set out herein is provided for general purposes only and LSEG does not intend to provide this as financial, tax and accounting, legal or other professional advice. Some information may contain opinions, including those of third parties, and LSEG is not responsible for such opinions. LSEG is not responsible for any damages resulting from decisions made by any person in reliance of any information stated above. Anyone accessing, using, or otherwise relying on any information in any respect agrees that they access, use, or otherwise rely on the information at their own risk in all respects.