ESAs Respond to EC Proposal on DORA, Suggest Improvements
ESAs addressed a letter to certain relevant EU entities expressing views on the EC proposal on the Digital Operational Resilience Act, also called DORA. In the letter, ESAs highlight their agreement with the main principles of DORA, which EC proposed in September 2020, and express support for the establishment of an oversight framework to cover the technology (ICT) services that critical third-party providers offer to the financial sector. ESAs also suggest ways to most efficiently take forward important aspects of the governance and operational processes of the oversight framework for critical third-party providers and the application of the proportionality principle in DORA.
In their letter, ESAs highlight that the proposed oversight framework is the first concrete initiative to address the complex issue of the dependencies on critical third-party providers in the financial sector, including monitoring third-party concentration risks. ESAs also emphasize the necessity of clearly communicating that the scope of this framework is limited to the provider activities in relation to financial entities. In this context, ESAs discuss the challenges for the governance and operation of the proposed sectoral oversight framework and suggest the following ways to address these challenges:
- Need for more streamlined and effective governance. ESAs propose that co-legislators should consider a model that permits stronger ESA cooperation through the creation of a joint-ESAs executive body, which would integrate the role of the Oversight Forum and be responsible for the overall oversight work for cross-sectoral critical third-party providers. Necessary powers could be allocated to this executive body by the legislation to enhance its decision-making role and to ensure a unified and harmonized approach across the ESAs. In addition, the legislation could clarify the potential designation of entities providing such services to financial entities across the remit of a single ESA, along with the governance model to be applied in these cases. ESAs also propose that the co-legislators consider establishing a cross-ESAs team to work on the oversight of critical third-party providers.
- Need for coherence between oversight recommendations and follow-up. The letter proposes far greater involvement for the ESAs in the follow-up process and the introduction of effective enforcement measures at EU level that can be applied directly to the critical third-party providers. Enforcement actions against a third-party provider could be endorsed by competent authorities through the Board of Supervisors of one or more of the ESAs. Moreover, DORA could allow for market transparency tools to strengthen the oversight framework and to encourage these providers to adhere to recommendations.
- Need for adequate resources. DORA envisages significant new ongoing work. For instance, it proposes ongoing policy-related work in the form of regular reporting and several tasks relating to ICT-related incident reporting, cooperation with structures and authorities established by the NIS Directive, financial cross-sector exercises, communication, and cooperation. Thus, ESAs strongly recommend a significant increase to the allocation of new resources, including more senior roles, for the new ongoing tasks proposed under DORA.
- Need for a more proportionate DORA. The current DORA proposal excludes only micro-enterprises from the application of certain requirements and does not make any reference to sectoral legislation when defining the financial entities in scope. Given this, ESAs suggested a more comprehensive inclusion of the principle of proportionality in a more flexible way across the legal act.
Related Link: ESAs Letter (PDF)
Keywords: Europe, EU, Banking, Insurance, Securities, DORA, Digital Operational Resilience Act, Third Party Providers, Cyber Risk, Fintech, Operational Risk, Regtech, Cloud Computing, ESAs
Previous Article
EIOPA Dashboard Examines Risks in Insurance SectorRelated Articles
ECB Finds Banks Unprepared for Pillar 3 Climate Risk Disclosures
The European Central Bank (ECB) published results of the 2022 supervisory assessment of climate-related and environmental risk disclosures among significant institutions (103) and a selected number of less significant institutions (28).
NCUA Assesses Credit Union Exposure to Climate-Related Physical Risks
The National Credit Union Administration (NCUA) released a Research Note that examines the exposure of credit unions to climate-related physical risks. In a related development
EBA Issues Multiple Regulatory and Reporting Updates for Banks
The European Banking Authority (EBA) is seeking comments, until July 31, 2023, on the draft Guidelines on the proposed common approach to the resubmission of historical data under the EBA reporting framework.
EC Adopts Regulation on Own Funds, Issues Other Updates
The European Commission adopted Delegated Regulations on own funds and eligible liabilities, on requirements for the internal methodology under the internal default risk model
CDP Platform to Report Plastic-Related Impact, Issues Other Updates
The Carbon Disclosure Project (CDP) announced that its global environmental disclosure platform has enabled reporting on plastic-related impact for nearly 7,000 companies worldwide
IASB to Enhance Reporting of Climate Risks, Proposes IFRS 9 Amendments
The International Accounting Standards Board (IASB) updated its work plan to enhance the reporting of climate-related risks in the financial statements,
BIS Addresses Data Gaps and Macro-Prudential Policy for Climate Risks
The Financial Stability Institute (FSI) of the Bank for International Settlements (BIS) published a brief paper that examines challenges associated with the use of macro-prudential policies to address climate-related financial risks.
FCA Sets Out Business Plan, Launches TechSprint on Greenwashing
The Financial Conduct Authority (FCA) published its business plan for 2023-24. The plan sets out details of the work planned for the next 12 months to achieve better outcomes for consumers and markets
UK Committee Sets Out Recommendations for Next Phase of Open Banking
The Joint Regulatory Oversight Committee (JROC), comprising the Financial Conduct Authority (FCA) and the Payment Systems Regulator (PSR) as co-chairs and the HM Treasury and the Competition and Markets Authority (CMA) as members
ECB Publishes Multiple Regulatory Updates for Banking Institutions
The European Central Bank (ECB) published the results of the 2022 climate risk stress test of the Eurosystem balance sheet,