New EU Regulation on Digital Resilience for Financial Institutions Takes Effect

Prague – The European regulation on Digital Operational Resilience for the financial sector (DORA) comes into effect today, mandating that financial institutions enhance the security of their information and communication systems against cyber threats. This regulation aims to safeguard the financial sector from incidents where sensitive data, stored with major cloud service providers, could be compromised by cyber attacks. Experts believe that Czech banks, insurance companies, and investment firms are well-prepared for these new rules.

DORA establishes guidelines for banks, insurance companies, and investment firms regarding their use of cloud services provided by companies such as Amazon, Google, and Microsoft. Financial entities are now required to demonstrate their preparedness to respond effectively to potential cyber attacks that could impact their data storage capabilities. This regulation was developed during the Czech Republic's presidency of the European Union in 2022.

Czech financial institutions have spent over a year preparing for these regulations, and experts indicate that most are ready to comply. However, representatives from banks and insurance companies have noted that not all regulatory aspects have been fully addressed at the European level. Compliance with all rules will only be possible once these aspects are finalized. Banks estimate that the costs associated with adhering to the new regulations could reach millions of crowns for each institution.

“The regulation consists of four primary requirements that all affected organizations must adhere to: ICT risk management, operational resilience testing, incident reporting, and third-party risk management,” explained Tomáš Kubíček, a partner at consulting firm BDO. He emphasized that compliance is an ongoing process that necessitates vigilance, adaptation, and continuous improvement. Failing to meet these requirements could lead to legal penalties, reputational harm, and increased operational risks that could jeopardize business continuity.