In this episode Rachel Wolcott and Lindsey Rogerson discuss the timely arrival of the European Union’s Digital Operational Resilience Act (DORA) and the requirement for UK financial institutions to identify their critical third party suppliers.

The Crowdstrike event last summer highlighted the risk of third party suppliers. The need for such DORA/UK work was furthered underscored in letters sent to the UK parliament’s Treasury Committee in February by the country’s nine largest banks. The breakdown of the cause of every bank outage in the last two year is illuminating – issues at third party suppliers accounted for 24 out of a total 120 outages.

The discussion then turns to what lessons can be learned by compliance and risk teams and also considers how current geopolitical tensions could make things a whole lot worse.

Links:

FCA Crowdstrike lessons learned 

Which? Report on CrowdStrike incident 

Trump’s National Security Firings Come as He Weakens U.S. Cyberdefenses - The New York Times

UK Cyber security and resilience Bill update 

UK’s largest banks paid customers £6.2 million after IT outages

Risk managers under-rate third-party vendors’ GenAI use - Compliance Corylated

EU must exempt firms from DORA’s ICT definitions - Compliance Corylated

Banks need active social media response to viral ‘free money’ posts

https://committees.parliament.uk/committee/158/treasury-committee/publications/3/correspondence/

https://www.iosco.org/library/pubdocs/pdf/IOSCOPD767.pdf