Irish central banker acknowledges ‘valid’ criticism of Dora timeline

Some criticism of the European Union’s Digital Operational Resilience Act (Dora) is valid, Gerry Cross, director of financial regulation at the Central Bank of Ireland, said on June 28.

Firms have said there is not enough time to implement the rules, which Cross said was a “valid concern”, before adding that the picture is “nuanced”. There is “merit” in a “committed journey by firms and supervisors from initial implementation and compliance to a richer, more fully achieved implementation over time”, Cross said.

Regulations represent the legal reality as mandated by co-legislative authorities, therefore revising Dora is outside of competent authorities’ remits, he noted.

Moreover, Dora itself has been under development for “quite a while now”.

“Firms can be expected to have already been laying much of the groundwork for implementation over the recent years,” Cross said.

The official said digital resilience requires momentum, pragmatism, quality, proportionality and engagement. These values underlie the EU’s new regulation.

Dora, which will come to force on January 17, 2025, aims to revise the currently fragmented landscape of European digital resilience in the financial markets. To do so, it engages all actors in the financial ecosystem.

It takes into account that a number of actors subcontract certain activities, therefore it requires firms to report on their subcontracting chains to ensure compliance.

Competent authorities continue to conduct “dry-run exercises” to assist financial entities in becoming familiar with Dora’s requirements, Cross said.

“Regulation of digital operational resilience is not a one-and-done exercise” but rather dependent on a “multi-year, multifaceted perspective”, he added.