Digital Finance Summit 2022 https://www.digitalfinancesummit.com/

1. Digital
Operational
Resilience
Act
Thomas Meyer – Director Cyber and Privacy
—
October 2022

2. 2
Document Classification: KPMG Public
© 2022 KPMG Advisory, a Belgian BV/SRL and a member firm of the KPMG global organization of independent member firms affiliated
with KPMG International Limited, a private English company limited by guarantee. All rights reserved.
What is DORA?
What is DORA?
European Union (EU)
Commission drafted the
Digital Operational Resilience
Act (DORA) which will have
far-reaching impacts on EU
financial institutions. Ratified
in coming months, and rolled
out over the following 2024
with enforcement from late
2023
What does it aim to do?
DORA aims to provide
a single set of rules to
strengthen all financial
institutions to withstand all
types of information and
telecommunications
technology (ICT) disruptions
and threats, including cyber.
Why is it important?
DORA widens the regulatory
regime to include the risk from
increasing interconnectedness,
the shift to digital financial
services and reliance on third
party services. It also provides a
consistent supervisory approach
across a single market.
What to keep in mind?
The Basel Principles for the
Sound Management of
Operational Risk have also
been revised. The principles
on which operating models
should be based are clearly
defined. The NIS2 Directive
will overlap with DORA.

3. 3
Document Classification: KPMG Public
© 2022 KPMG Advisory, a Belgian BV/SRL and a member firm of the KPMG global organization of independent member firms affiliated
with KPMG International Limited, a private English company limited by guarantee. All rights reserved.
To whom might DORA apply?
Credit
institutions
Payment
institutions
Crypto-asset service
providers and issuers of:
crypto-assets,
asset-referenced tokens,
significant
asset-referenced tokens
Electronic
money
institutions
Investment
firms
Institutions for
occupational
retirement pensions
Trade
repositories
Credit rating
agencies
Trading
venues
ICT third party
service providers
Managers of
alternative
investment funds
Data reporting
service providers
Insurance and
reinsurance
undertakings
Management
companies
Crowdfunding
service providers
Administrators of
critical benchmarks
Insurance intermediaries,
reinsurance intermediaries
and ancillary insurance
intermediaries
Securitisation
repositories
Statutory auditors
and audit firms
Central
counterparties
Central securities
depositories
DORA will apply to the entire financial sector, including critical third party providers (CTPPs), such as cloud
computing, data analytics or software companies.

4. 4
Document Classification: KPMG Public
© 2022 KPMG Advisory, a Belgian BV/SRL and a member firm of the KPMG global organization of independent member firms affiliated
with KPMG International Limited, a private English company limited by guarantee. All rights reserved.
What does it mean for you?
Enforced regulation
DORA is a new significant set of
regulations that must be met. It
will be backed up by an
enforcement regime — for
example, external review or fines
equalling “1% of the average
daily worldwide turnover of the
critical ICT third party service
provider in the preceding
business year”.
Current model may not
be fit for purpose
Although not as significant as
GDPR, institutions will still need to
comply and their current resiliency
model may not be fit for purpose.
Engage your legal team to support
review of legislation specific
requirements.
Impacts all parts of
the sector
The scope of who is
impacted is very wide.
Transformation may
be required
As the regulatory
environment is significantly
changing and the
supervisory regime is
hardening, even mature
organizations need to
recognize that transformation
to achieve compliance may
be required.
Cyber resilience
arrangements may still
not be suitable if DORA
is met
While DORA is a trigger for the
transformation discussion, if
there’s no interest, it’s worth
noting that even with DORA
compliance, cyber resilience
arrangements may still not be
suitable to meet the most difficult
cyber challenges e.g.
ransomware.

5. 5
Document Classification: KPMG Public
© 2022 KPMG Advisory, a Belgian BV/SRL and a member firm of the KPMG global organization of independent member firms affiliated
with KPMG International Limited, a private English company limited by guarantee. All rights reserved.
Key areas of DORA
DORA
key areas
Governance requirements
Internal controls and governance
structure
Information sharing
Exchange of cyber threat
information and intelligence
Third party risk
Risk systems and tools to cover
third parties risk and supervision
ICT risk management
ICT risk system and tools,
including business continuity and
disaster recovery
Incident reporting
Reporting thresholds and systems
to communicate to regulators and
users
Operational resilience testing
Testing for preparedness and
weakness identification
Today, DORA covers six key areas (contained in over 40 articles).
Governance
requirements
Information
sharing
ICT risk
management
Incident
reporting
Operational
resilience
testing
Third party
risk

6. 6
Document Classification: KPMG Public
© 2022 KPMG Advisory, a Belgian BV/SRL and a member firm of the KPMG global organization of independent member firms affiliated
with KPMG International Limited, a private English company limited by guarantee. All rights reserved.
Next steps to get started
Establish a DORA programme for 2024 and appoint a
programme director and sponsor
0
1. Develop a DORA board positioning paper
0
2. Define a Terms of Reference and build a business case to
mobilise the DORA programme
0
3. Establish a governance forum and understanding where the
DORA programme interacts with broader firm initiatives
0
4. Mobilisation of the design and delivery phases of the DORA
programme
0
5.

7. Some or all of the services described herein may not be permissible for KPMG audit clients and their affiliates or related
entities.
The information contained herein is of a general nature and is not intended to address the circumstances of any
particular individual or entity. Although we endeavor to provide accurate and timely information, there can be no
guarantee that such information is accurate as of the date it is received or that it will continue to be accurate in the
future. No one should act on such information without appropriate professional advice after a thorough examination of
the particular situation.
The KPMG name and logo are trademarks used under license by the independent member firms of the KPMG global
organization.
Document Classification: KPMG Public
© 2022 KPMG Advisory, a Belgian BV/SRL and a member firm of the KPMG global organization of independent member firms affiliated
with KPMG International Limited, a private English company limited by guarantee. All rights reserved.
Thomas Meyer
Director – Cyber and Privacy
thomasmeyer@kpmg.com
+32 471 67 51 57