FinSec Leadership Forum: January 2025 Roundtable

DORA is here, and it’s not waiting for anyone. Yesterday, at the FinSec Leadership Forum, we got straight to work—cutting through complexity, challenging assumptions, and unpacking what firms actually need to do this year.

The takeaway? Understanding regulation is one thing, implementing it is another. And DORA’s reach extends far beyond ciompliance checklists. It’s reshaping governance, third-party risk, and operational resilience at every level.

Key Themes from the Discussion:

• Accountability starts at the top. Without clear governance structures and leadership buy-in, firms will struggle to meet the regulation’s demands. This isn’t just a compliance issue—it’s a business resilience issue.
• One-size compliance doesn’t fit all. The proportionality principle is crucial, and firms need to assess what’s genuinely critical for them instead of applying generic frameworks.
• Data before tech. Jumping to tooling before getting data structures right is a mistake. Data preparation, classification, and minimisation need to come first to ensure tech solutions can be effectively leveraged.
• A disconnect between risk and reality. Too often, risk management frameworks exist in theory but struggle in execution. Fragmented internal structures, inconsistent reporting, and siloed oversight make it harder to apply DORA’s requirements in a way that’s both practical and effective. Breaking down these barriers is just as critical as compliance itself.
• RegTech’s role is growing, but gaps remain. There’s no shortage of solutions, but the market is fragmented. Firms need more collaborative composable approaches that prioritise real-world implementation over theoretical compliance.

But here’s the real question: How do we move beyond theory and into action?

DORA is an opportunity to rethink how financial services approach security, resilience, and collaboration.

A huge thanks to Scott Moncur (Vialex) and Simon Rycroft (Cyber Risk Management Group) for bringing their insights to the table.

More to come—because this is just the beginning.