Duration

1 Days

6 CPD hours

Overview

The course offers the opportunity to:
Acquire a structure understanding of the current EU legislative landscape and priorities in relation to the DORA legislative package.
Become sufficiently conversant in the broad details of the key pieces of current EU FS legislation to engage in a discussion with their professional peers, regulators and apply the knowledge in reviewing the impact on their business models, compliance expectations and obligation More specifically, by the end of the course participants will:Understand the EU Institutional decision-making process from the EC proposal stage on both legislative packages to ratification by the EU Parliament and CouncilIdentify the various key provisions under the DORA legislative text that will have a direct impact on the firm's compliance framework and that of its outsourced ITC providersIdentify the new requirements and challenges under the DORA framework designed to strengthen cross-border monitoring of ITC systems and outsourced structuresBuild an awareness of the modified roles of Pan-EU supervisors in terms of monitoring, requests for information, reporting requirements, on-site inspections, with more assertive powers by the ESAsLearn how the scaled-up harmonisation and coordination of ESAs supervisory practices in the management of the firms ITC operations will affect your businessDevelop awareness of how the EU intends to monitor DORA requirements with third countries considered to be €˜high-risk' jurisdictions.Be capable of anticipating questions and queries via the new ESA's role in monitoring DORA application and compliance

Description

The course aims to provide a deep dive into the critical legislative package associated with the Digital Operational Resilience Act (DORA), which has recently come into force, and is designed to addresses a key risk factor in the EU digital space: cyberattacks and ICT disruptions in the EU financial sector. These risks have been a concern for Europe's bank and securities regulators for many years, notably the ECB, the EBA and ESMA. This long overdue piece of legislation now consolidates a patchwork of existing sectoral rules on ICT risk management, incident handling and resilience testing. Critically, and core to the thrust of DORA, is the explicit recognition on the reliance by financial services entities on third party ICT service providers. Oversight of 3rd party ICT service providers will fall to the ESA's (EBA, ESMA and EIOPA). ESMA is also currently drafting technical standards, following DORA's entry into force on 16 January 2023, with application scheduled for 17th January 2025. An overview of the complex nature of the EU legislative process and the key EU Institutions involved in the development of the DORA regulatory text will be examined during the course, covering:
The shift from operational risk mainly with the allocation of capital to managing all components of operational resilience.
The DORA rules for the protection, detection, containment, recovery and repair capabilities against ICT-related incidents.
Identifying the DORA explicitly referenced ICT risks via new sets rules on ICT risk-management, incident reporting, operational resilience testing and ICT third-party risk monitoring.

Prerequisites

None