European Parliament and Council announce a provisional political agreement on DORA

Article summary

The European Parliament has announced that it has reached a provisional agreement with the Council on the EU Digital Operational Resilience Act (DORA) (2020/0266(COD)) and the Amending EU Directive regarding Digital Operational Resilience Requirements (2020/0268(COD)). These new uniform rules relate, amongst other things, to information and communication technology (ICT) risk management, a reporting regime for major ICT-related incidents, resilience testing, and monitoring of ICT third-party risk in the financial services sector. DORA will apply to EU financial entities, including banks, payment providers, electronic money providers, investment firms, cryptoasset service providers and to ICT third-party service providers. The new rules will apply 24 months after they enter into force. Establishing a single EU Hub for the reporting of major ICT-related incidents will be explored within two years.