The Operational Resilience Imperative: Why DORA Is Just the Beginning

A Year of Proof

Fourteen months ago, on January 17, 2025, the Digital Operational Resilience Act became applicable across the European Union. At the time, skeptics questioned whether the regulation was necessary. Financial institutions had survived without a dedicated operational resilience regulation for decades. Was DORA a regulatory overreach — an expensive compliance exercise that would consume budgets without materially improving resilience?

The events of 2025 answered that question definitively.

On April 28, 2025, a cascading power failure knocked out 15 GW across Spain and Portugal in five seconds. Sixty million people lost electricity. Card payment spending dropped 41-42% in affected areas according to the ECB's June 2025 Economic Bulletin. National e-commerce collapsed by approximately 54%. The ECB described physical currency as "a spare tire for the payment system." GDP losses were estimated at EUR 400 million to EUR 1.6 billion for the direct impact period, with broader estimates reaching EUR 2-3 billion.

On October 20, 2025, a malfunctioning internal monitoring subsystem in AWS's US-East-1 region triggered a cascading failure across 60+ countries, generating 17 million user reports. Coinbase suspended all crypto trading. Robinhood users could not execute equity trades. Lloyds Banking Group and Bank of Scotland locked customers out of online and mobile banking. The outage lasted approximately 15 hours.

Between these headline events, the steady drumbeat of disruption continued. UK banking customers experienced 158 IT outages in 2024 alone, according to Financial Conduct Authority data — an average of more than three per week. The SecurityScorecard Global Third-Party Breach Report found that 96% of the top 100 global banks had experienced at least one third-party breach. Financial services recorded 739 data compromises, making it the most targeted industry for the second consecutive year per ITRC data. Supply chain attacks across the technology ecosystem doubled between 2021 and 2025 according to ENISA's Threat Landscape Report.

Every one of these events validated a specific DORA requirement. The Iberian blackout validated Art. 8's demand for dependency mapping — including physical infrastructure dependencies that most institutions had not classified as ICT assets. The AWS outage validated Art. 29's concentration risk mandate. The UK outage statistics validated Art. 24's testing programme requirements. The third-party breach rate validated Pillar IV's entire structure. DORA was not regulatory overreach. It was regulatory foresight.

The Five Dimensions of the Imperative

1. The Threat Landscape Has Permanently Shifted

The threat environment that financial institutions face in 2026 is structurally different from a decade ago. Three forces have converged:

Concentration creates correlated failure. The financial sector's ICT infrastructure is concentrated on a small number of providers. SecurityScorecard's research found that 15 technology companies represent approximately 62% of the global technology products and services surface area. When these providers fail — as AWS, Azure, and CrowdStrike demonstrated in 2025 — the failures are not isolated. They cascade across institutions, markets, and jurisdictions simultaneously.

Complexity defeats prediction. Modern financial infrastructure is a system of systems: cloud layers, API integrations, third-party data feeds, managed security services, sub-outsourced processing chains. No single institution can map the full dependency graph. The CrowdStrike incident of July 2024, which affected 8.5 million Windows devices globally, demonstrated that a single configuration change in a single third-party product can cascade through infrastructure that the affected organizations did not even know was dependent.

Adversaries are patient and strategic. The NoName057(16) hacktivist group conducted over 1,500 DDoS attacks against European targets — including Italian banks like Intesa San Paolo — between March 2022 and July 2025 before Europol's takedown. State-sponsored and criminal actors increasingly target financial services not for immediate financial gain but for systemic disruption. The Deutsche Bank deepfake incident demonstrated that AI-powered social engineering has reached a level where human verification alone is insufficient.

2. Regulation Is Converging Globally

DORA is not an isolated European initiative. It is the leading edge of a global regulatory convergence toward mandatory operational resilience requirements for financial services.

The convergence is directional but not uniform. The UK's framework, which predates DORA, focuses on impact tolerances for important business services. DORA's scope is broader, encompassing ICT risk management, incident reporting, testing, third-party oversight, and information sharing in a single regulation. The EBA, ESMA, and EIOPA serve as the supervisory backbone for DORA implementation across the EU.

For institutions operating across jurisdictions, the practical implication is clear: building to the highest standard — currently DORA — creates a compliance platform that addresses most requirements in other jurisdictions. The alternative — building siloed compliance programmes per jurisdiction — is more expensive, less effective, and structurally fragile.

3. The CTPP Regime Changes the Game

On November 18, 2025, the European Supervisory Authorities designated the first 19 Critical Third-Party Providers (CTPPs) under DORA Articles 31-44. The designated entities include AWS, Google Cloud, Microsoft, Oracle, SAP, Bloomberg, and FIS — the infrastructure backbone of European financial services.

This designation is unprecedented. For the first time, EU financial regulators have direct oversight powers over technology providers. The Lead Overseer regime grants the authority to conduct inspections, request information, issue recommendations, and — if recommendations are not followed — require financial entities to suspend or terminate arrangements with non-compliant CTPPs.

The implications extend beyond the EU. Non-EU CTPPs must establish an EU subsidiary within 12 months of designation. This creates an extraterritorial reach that affects global cloud and technology providers regardless of their headquarters location.

For financial institutions, the CTPP designations trigger immediate obligations under Art. 29: reassess concentration risk, update exit strategies, verify Art. 30 contractual provisions, and map sub-outsourcing arrangements for designated providers. Institutions that have not yet completed these assessments are already behind.

4. The Evidence Economy Is Real

The shift from "comply" to "prove you comply" is the most consequential practical change that DORA introduces. Previous regulatory frameworks allowed institutions to assert compliance through policy documentation. DORA demands evidence.

Art. 24 requires a testing programme — with execution evidence. Art. 19 requires incident reporting — with timeline evidence. Art. 28(3) requires a Register of Information — with completeness evidence. Art. 5(2) requires management body oversight — with governance evidence (board minutes, decisions, challenge records).

The ECB's stress test findings confirmed that the supervisory approach is evidence-first. Banks were not asked whether they had recovery capabilities. They were asked to demonstrate them — and the results showed significant room for improvement.

This evidence economy rewards institutions that invest in integrated compliance platforms over those that manage evidence in spreadsheets and shared drives. An evidence chain — from risk assessment to control to test to finding to remediation — that can be produced in minutes under examination conditions is a competitive advantage. The same chain assembled manually from disconnected systems over days or weeks is a liability.

5. Resilience Is Becoming a Board-Level Discipline

DORA Art. 5(2) states that the management body shall "define, approve, oversee and be responsible for the implementation of all arrangements related to the ICT risk management framework." This is not delegation language. It is personal accountability language.

The consequences are becoming tangible. ENISA's NIS2 and DORA convergence analysis highlights that management body liability extends to personal fines in several Member States. Art. 50-52 empower competent authorities to impose administrative penalties, including individual liability for members of the management body who fail to fulfil their oversight obligations.

Board directors who treated operational resilience as an IT concern in 2024 must treat it as a governance discipline in 2026. This requires:

• Competence: Board members must have sufficient ICT risk knowledge to exercise effective oversight. Art. 5(4) requires that they "follow specific training" to understand ICT risk.
• Challenge: Passive receipt of CISO reports is not oversight. Documented challenge — "Why is our recovery achievement rate below target? What is the remediation plan? When will it be resolved?" — is what examiners look for in board minutes.
• Accountability: Decisions must be recorded, with clear ownership and follow-up. A board that approves an ICT risk framework without reviewing it, or that accepts testing gaps without remediation timelines, is not governing — it is rubber-stamping.

What Comes Next: 2027 and Beyond

DORA is not static. Article 58 mandates that the European Commission review the regulation's scope and effectiveness, including the question of whether statutory auditors should be brought within scope. The ESAs' 2026 Work Programme signals deepening oversight of CTPPs and enhanced coordination of incident reporting across jurisdictions.

Several evolutionary pressures are building:

AI resilience. AI systems in financial services — credit scoring, fraud detection, AML, robo-advisory — run on ICT infrastructure governed by DORA. An AI model failure is an ICT system failure under Art. 7. With the EU AI Act now in force since August 2024, financial institutions face triple compliance: DORA, AI Act, and GDPR. The intersection has not yet been fully addressed by regulators, but it will be by 2027.

NIS2 convergence. Directive (EU) 2022/2555 (NIS2) applies to essential and important entities across all sectors. Financial entities benefit from DORA's lex specialis status, but the overlap — particularly in incident reporting and supply chain security — will drive convergence over time. A single operational resilience framework that satisfies both DORA and NIS2 is the efficient target architecture.

Quantum preparedness. Cryptographic agility — the ability to migrate from current cryptographic standards to quantum-resistant algorithms — will become a supervisory expectation as NIST post-quantum standards mature. DORA's Art. 9 (protection and prevention) provides the regulatory hook, even though the regulation does not specifically reference quantum computing.

Cross-border enforcement coordination. The Lead Overseer regime established by DORA creates a precedent for cross-border supervisory coordination. As CTPPs operate globally, oversight coordination between EU, UK, US, and GCC regulators will deepen. The first cross-border CTPP inspection — inevitable by 2027 — will test the practical limits of regulatory cooperation.

The Strategic Choice

Financial institutions face a strategic choice. They can treat operational resilience as a compliance cost — a tax on doing business that must be minimized. Or they can treat it as a capability — a structural advantage that improves governance, reduces loss, accelerates recovery, and earns supervisory trust.

The evidence from 2025 makes the case. Institutions with mature resilience capabilities recovered faster from the AWS outage. Institutions with complete ICT asset registers responded more effectively to the Iberian blackout. Institutions with tested incident response processes classified and reported incidents within mandated timelines. Institutions with concentration risk analyses had already identified their AWS exposure before the October outage demonstrated it.

The cost of compliance — estimated at EUR 2-5 million for mid-size institutions, up to EUR 100 million for large cross-border groups per Deloitte's DORA Impact Assessment — is significant. The cost of non-compliance is larger: up to 2% of global annual turnover in penalties, plus incident losses, remediation costs, supervisory restrictions, reputational damage, and the operational disruption of emergency remediation under regulatory pressure.

The cost of a major operational failure is larger still. The Iberian blackout's estimated EUR 2-3 billion economic impact. The 2025 cloud outages' cumulative financial services impact measured in billions. The ongoing hemorrhage of customer trust from the UK's three outages per week.

The Operational Resilience Thesis

DORA articulates a thesis that the events of 2025 have proven correct: the digital operational resilience of the financial system is a public good that requires regulatory governance.

The financial system's dependency on a small number of technology providers creates systemic concentration risk that no individual institution can manage alone. The complexity of modern ICT infrastructure creates emergent failure modes that no risk assessment can fully anticipate. The velocity of cyber threats creates an adversarial environment that requires continuous adaptation, not annual compliance cycles.

DORA addresses these realities through five interlocking pillars: know your infrastructure (Pillar I), manage your incidents (Pillar II), test your resilience (Pillar III), govern your dependencies (Pillar IV), and share your intelligence (Pillar V). The UK, GCC, and APAC are building toward the same model. The convergence is not optional — it is driven by the same systemic forces that drove DORA's creation.

The institutions that recognized this early — that invested in integrated resilience platforms, in tested recovery capabilities, in evidence-based compliance, and in board-level governance — are the institutions that survived 2025 with their operations, their reputations, and their regulatory relationships intact.

The institutions that treated DORA as a checkbox exercise — that built minimum viable compliance on spreadsheets and shared drives, that tested recovery plans on paper but not in practice, that classified operational resilience as an IT problem rather than a governance discipline — are the institutions that struggled through 2025 and will face pointed supervisory questions in 2026.

DORA is not the end. It is the beginning of a permanent, global, evidence-based operational resilience discipline for financial services. The question is not whether to invest. The question is whether to invest now, from a position of strategic choice, or later, from a position of regulatory compulsion.

The operational resilience imperative is here. DORA is just the starting gun.

Key Takeaways

• The events of 2025 validated every major DORA requirement: from Art. 8 (asset dependencies) to Art. 29 (concentration risk) to Art. 24 (testing programmes). The regulation was not overreach — it was foresight.
• Regulation is converging globally. The EU (DORA), UK (PS 16/24), US (OCC/FFIEC), Singapore (MAS), Hong Kong (HKMA), UAE (CBUAE), and Saudi Arabia (SAMA) are all building toward mandatory operational resilience frameworks.
• 19 CTPPs under direct EU supervision create an unprecedented regulatory reach over global technology providers, with extraterritorial implications.
• The evidence economy rewards integrated platforms over manual processes. Examination readiness is a function of evidence architecture, not policy volume.
• Board-level governance is personal. Art. 5(2) makes management body members individually accountable. Training, challenge, and documented decisions are supervisory expectations.
• 2027 will bring AI resilience obligations, NIS2 convergence, and quantum preparedness as the next evolutionary pressures on the operational resilience framework.
• The strategic choice is invest now or remediate later. The cost of proactive compliance is a fraction of the cost of regulatory-compelled remediation after a finding or an incident.
• The DORA self-assessment provides a starting point. The article-by-article analysis provides the regulatory detail. The case studies provide the evidence. The imperative is clear.