The Digital Operational Resilience Act (DORA) is the European regulation that sets rigorous standards for ICT risk management in the financial sector. Designed to ensure business continuity in the event of a cyber-attack, DORA introduces requirements that affect both IT networks and infrastructure, as well as the mobile financial applications that are increasingly being used by users and businesses.
DORA, which will come into force in January 2023, will be fully operational and mandatory from January 2025, imposing advanced security measures on
- Banks
- Insurance companies
- Investment companies
- Third party providers of ICT services critical to the fintech world (cloud, data centres, payment systems)
- Cryptocurrency and crowdfunding service providers
The objectives of the DORA regulation
- Proactive management of ICT risks
DORA requires financial institutions to implement structured strategies to prevent cyber-attacks and ensure operational security. Particular attention must also be paid to mobile applications, which are often exposed to malware, phishing and smishing, reverse engineering, but also to cloning and unauthorised versions in third-party app stores. - Harmonising regulations
DORA harmonises EU legislation, eliminating the fragmentation of national regulations and establishing a common security standard for IT infrastructures and mobile applications across Europe.
The challenges of DORA compliance.
Adapting IT infrastructure and mobile apps
Complying with DORA means updating your cybersecurity frameworks to ensure the protection of critical systems and financial applications. However, mobile apps often do not receive the same attention as IT infrastructure, making them a weak link in the security chain.
Managing and monitoring third parties
Many financial institutions rely on external service providers (cloud, payments, digital platforms). DORA also requires strict control over applications developed or managed by third parties to avoid vulnerabilities that could compromise the security of data and transactions.
Anticipate the evolution of cyber threats
Attacks on the financial and fintech sectors are becoming increasingly sophisticated, and mobile applications are a prime target. The DORA regulation requires organisations to ensure that all IT solutions, including mobile applications, are continuously monitored and updated.
Key fintech security requirements from DORA.
ICT Risk Management
Every organisation needs to adopt a comprehensive ICT risk management framework, with specific controls to protect mobile apps from exploits and attacks.
Incident reporting
All significant incidents, including mobile apps attacks and API compromises, must be reported immediately to the authorities with the countermeasures taken.
Operational resilience testing
Financial institutions should conduct regular security testing, including penetration testing of mobile applications, to identify vulnerabilities before they can be exploited.
Third party supplier risk management
Organisations need to ensure that their vendors are also compliant with the DORA standards. This applies to cloud services as well as fintech mobile application developers.
Knowledge sharing
DORA encourages collaboration to prevent attacks. This means actively monitoring threats, including in the mobile landscape where new fraud and attack techniques are emerging.
The benefits of DORA compliance.
Ensuring the protection of IT infrastructure and mobile applications in the fintech world brings tangible benefits:
- Demonstrate compliance with EU regulations
- Reduce the risk of sanctions
- Be resilient to advanced attacks and threats
- Eliminate vulnerabilities before they are exploited
- Protect data and transactions from unauthorised access
- Avoid downtime and disruption caused by cyber-attacks
DORA effectively brings a preventive approach to security to fintech companies: anticipating attacks and strengthening the security posture of financial applications and digital services.
It is therefore an opportunity to turn security into a strength.
Protecting applications and mobile devices means protecting the business, ensuring business continuity and strengthening the trust of customers and partners.
Mobisec supports fintech companies on this journey with a DORA Compliance Verification package designed to:
- Analyse critical ICT and mobile security issues
- Identify vulnerabilities in financial applications and systems
- Provide concrete solutions for regulatory compliance
Mobisec is the strategic partner to strengthen the application security of your reality.