DORA requirements will be applied in full in less than a month. If a financial entity does not manage ICT risks as required by DORA its management body members may be subject to administrative sanctions.
Article 5 of DORA states: “The management body of the financial entity shall define, approve, oversee and be responsible for the implementation of all arrangements related to the ICT risk management framework”. This remains true also in the case of delegation.
The law of July 1, 2024, implementing DORA, introduces specific enforcement powers in case of breach and includes fines:
Up to € 5 000 000 for physical persons,
Up to an amount maximum of € 5 000 000 or up to 10% of annual total turnover for legal entities.
What should the executives and supervisory boards do to ensure compliance with DORA?
Double check if your financial entity:
Has a DORA implementation team in-house or an advisory partner with relevant expertise
Conducted a compliance gap analysis of the ICT risk management framework
Reviewed existing contractual arrangements to assess ICT third-party risks
Is ready to maintain the Register of Information on ICT third-party service providers
Updated all the policies and procedures to ensure digital operational resilience as required
In this context, it is important to highlight that the responsibilities of the management body in subsidiaries are fully in charge of mitigating ICT risks and carrying out adequate ICT controls locally. This responsibility cannot be delegated to the parent entity.
How can MAQIT help?
MAQIT S.A. is a Luxembourg-based RegTech solution provider and IT management company. It provides IT regulatory and AML/KYC advisory services, helping businesses become compliant, stay compliant, and turn compliance into a competitive advantage.
We stand ready to assist financial entities in preparing for full compliance with DORA.
 |  |  |
Comments