Our Journey to DORA
Matt Rizzo
CEO at InScope-AML
What's Included
We’re just a month away from the implementation of DORA (Digital Operational Resilience Act), an EU regulatory framework that will come into effect as of January 17th.
This regulation aims to build up digital security systems in financial institutions in order to make sure that firms can stay safe in the face of events that threaten the authenticity, availability, confidentiality or integrity of their data.
However, it also means that DORA-compliant institutions will need to work with DORA-ready suppliers.
In order to ensure we are fully prepared for our clients’ needs, we have built upon our current ISO certification protocols to begin our journey to also become aligned with DORA.
Why it matters
DORA is a regulatory framework introduced by the European Union to ensure that financial institutions and their service providers maintain robust digital security and operational resilience. It is designed to safeguard the financial sector against cyber threats, IT failures, and other operational disruptions that could compromise the confidentiality, availability, and integrity of critical data. For SaaS companies in the AML space, becoming DORA-ready is crucial because of the role we play as third-party providers to financial institutions. Abiding by the same guidelines demonstrates that we meet the same stringent standards for security, resilience, and risk management, enabling us to remain trusted partners in the highly regulated financial industry.
DORA compliance requires firms to assess all risks associated with their suppliers to ensure they are meeting the guidelines for security and resilience measures. This means that we not only have to ensure that we become DORA-ready for our clients, but also that our suppliers need to abide by certain security standards as well.
Financial services is of course a field of extreme importance for InScope-AML, and one we know well. As such, it made perfect sense for us to ensure that when clients choose to work with us, we are entirely compliant with industry regulations.
Our journey
The leap to become DORA-ready was an obvious next step in our company’s journey. We obtained ISO certification last year and many of the guidelines we abide through that framework also apply to DORA:
- Assessing supplier risk: DORA requires due diligence to be enacted on all third-party providers. This includes us, for our clients, and our own suppliers as well.
- Strengthening internal processes: DORA compliance emphasises the importance of robust internal procedures to ensure operational resilience. To meet this requirement, we have thoroughly reviewed and enhanced our internal processes, focusing on identifying vulnerabilities, implementing controls, and preparing for potential disruptions. By refining our workflows and documentation practices, we ensure that our operations remain resilient under any circumstances.
- Employee awareness and training: DORA underscores the critical role of human capital in maintaining digital operational resilience. To this end, we’ve launched targeted training programs which cover incident response protocols and data security practices, thus empowering our team to be proactive in safeguarding both our and our clients’ operations.
- Incident management and testing: A key pillar of DORA is the ability to respond effectively to incidents. We’ve integrated incident management protocols into our operations, focusing on rapid detection, response, and recovery from potential threats. In addition, regular stress testing and simulation exercises ensure that we are fully prepared to handle disruptions without compromising service quality.
- Ongoing monitoring and improvement: DORA is not a one-time achievement but an ongoing commitment. We have implemented continuous monitoring systems to assess our status and identify areas for improvement. This iterative approach allows us to adapt to new threats and regulatory updates while maintaining the highest standards of operational resilience.
Looking ahead
As January 17th approaches, we remain fully committed to completing our journey toward DORA. We understand the responsibility we carry as a trusted partner to financial institutions and are dedicated to exceeding expectations.
By aligning with DORA, we not only strengthen our position as a reliable provider but also contribute to the broader effort of safeguarding the financial sector’s digital infrastructure. Our journey is far from over, but we are confident that the steps we’ve taken so far set the foundation for continued growth and trust with our clients.
Stay tuned as we share more updates on this exciting milestone!
Algeria, Angola, Côte d’Ivoire and Lebanon added to FATF Grey List
Algeria, Angola, Côte d’Ivoire, and Lebanon were added to the Financial Action Task Force’s (FATF) list of Jurisdictions under Increased Monitoring, also known as the FATF grey list. Senegal was taken off the list.
Why your AML Software should be as unique as your business
A Tick-box vs a risk-based approach. While sector-specific AML guidelines provide a general framework for the prevention of money laundering activities, businesses must develop specific policies and internal procedures if they want to ensure compliance in the long-term.
The Balancing Act: Strong AML Compliance Without a Bad Customer Experience
What’s new Compliance and customer experience often get treated as opposites, as if being thorough about AML means being difficult for customers. That trade-off feels
AML Compliance challenges when operating in a multi-jurisdictional environment
Back to Blog What’s Included Affinity Group is a multi-jurisdictional Corporate Service Provider with offices in the Isle of Man, Malta, Cayman Islands, and Florida