The ABBL responded to ESAs consultation on the DORA second batch of policy mandates

The ABBL is continuing its advocacy work on EU Regulation 2022/2554 on the Digital Operational Resilience of the Financial Sector (DORA).

Following a series of workshops with its members, the ABBL has submitted its response to the European Supervisory Authorities (ESAs). These include the European Banking Authority (EBA), the European Securities and Markets Authority (ESMA) and the European Insurance and Occupational Pensions Authority (EIOPA).

The Regulation

The Regulation establishes uniform requirements for the security of networks and information systems that support the business processes of financial entities in order to achieve a common high level of digital operational resilience.

The Regulation entered into force on 16 January 2023 and will apply from 17 January 2025. In 2023-2024, the ESAs held two consultations on the first and second batches of policy products such as draft regulatory technical standards (RTS), implementing technical standards (ITS) and guidelines.

ABBL’s advocacy work

Following the ABBL’s contribution to the consultation on the first batch of DORA political mandates in September 2023, the association has continued its active advocacy on the second batch. This culminated in the recent submission of the ABBL’s responses to the consultation documents:

RTS to specify the elements that a financial entity must determine and assess when outsourcing ICT services supporting critical or important functions.

In its response, the ABBL emphasises the need for a proportionate and risk-based approach to the application of the RTS, arguing that not all ICT services supporting critical or important functions have the same level of risk. In addition, the ABBL proposes to allow entities to leverage group-level oversight mechanisms to meet DORA standards without redundant assessments, in the interests of efficiency while maintaining operational resilience.

RTS on the content of notification and reporting for major incidents and significant cyber threats and the determination of timeframes for the notification of major incidents; and ITS on standard forms, templates and procedures for financial entities to report a major incident and notify a significant cyber threat.

The ABBL is concerned about the practicality of the proposed timeframes, particularly when taking into account operational capabilities, weekends, public holidays and time zone differences. The ABBL response highlights the risk of over-reporting and the significant operational burden placed on financial entities, particularly in relation to recurring incidents and the detailed nature of the reporting fields required.

Guidelines on estimating aggregate annual costs and losses caused by major ICT incidents

The ABBL highlights the need for clarity in defining costs, concerns about the practicality of tracking and attributing costs, and the risk of duplication of costs within groups. It argues for a simplified approach to the criteria, allowing institutions to be flexible in identifying relevant costs and losses.

RTS specifying elements for Threat Based Penetration Testing (TLPT)

The ABBL supports the intention to align TLPT with the TIBER-EU framework, but requests further guidance on its operationalisation, particularly in relation to third party or group testing. The ABBL asks for more clarity on the criteria for identifying entities subject to TLPT and stresses the importance of proportionality, suggesting flexibility in the frequency and scope of testing.

RTS on harmonised conditions for conducting surveillance activities

The ABBL advocates provisions in the RTS that allow entities to use group-level surveillance mechanisms to effectively meet DORA standards, avoiding redundant assessments.

ABBL response to the ESA consultation on the 2nd series of DORA policy mandates

Next steps

The ESAs will consider all the responses received in the consultation round on the second batch of DORA policy mandates and plan to submit the final drafts by 17 July 2024 to the European Commission for adoption. Once the second batch of policy mandates is finalised, the ABBL will organise an information session for its members.

We thank ABBL members for their active participation in this important advocacy issue. Member feedback has been essential, and we look forward to continuing this journey together, ensuring a strong and resilient digital future for all.