Finanstilsynet expects banks to operationalise DORA controls in 2027

Banks operating in Norway face a high digital threat levelFinanstilsynet, reinforced by geopolitical tensions, where incidents can have systemic consequences. Preparedness in the financial industry is good but must be developed continuously against new threats. Supplier and value-chain risk counts among the most critical vulnerabilities in the sectorFinanstilsynet, and rapid technological development brings both new risks and new opportunities.

For 2027 Finanstilsynet prioritises monitoring and analysing risk and vulnerabilities in markets and individual firmsFinanstilsynet, supervision of actors in payment, trading and settlement systems and other financial infrastructureFinanstilsynet, preparedness, and regulatory development and EEA work.

After one year of supervision under the DORA framework most firms have carried out gap analyses, updated governing documents, established an ICT risk-management framework, completed business impact analyses and worked systematically on adaptation. Governing documents are often extensive, but operationalisation inside the firm remains unfinishedFinanstilsynet. Many supervisory remarks concern governance and control of the ICT business. ICT third-party risk is an area still maturing, with complex supply chains and follow-up challenges toward ICT suppliers, and register-of-information reviews have shown gaps in supplier follow-upFinanstilsynet. Preparedness work must cover both the firm's own ICT services and outsourced services, with more extensive scenario-based testing than before.

Financial entities must maintain a sound, comprehensive and well-documented framework for ICT risk managementFinanstilsynet. The board must define, approve, oversee and be responsible for implementing every arrangement under that framework, and governance, control and risk assessment must be an integrated part of daily operations. Firms must run holistic routines for following up suppliers and sub-suppliers, know the supply chain, and follow up the risk of buying ICT services from third parties.

Rapid artificial-intelligence development brings benefits alongside new technological and commercial risks, and ownership of AI use must be clearly defined and anchored in the organisation. Quantum technology brings opportunities and a serious long-term risk: Finans Norge's roadmap for a quantum-safe financial industry points to international recommendations that critical data be quantum-secured by 2030Finanstilsynet and all data by 2035Finanstilsynet, and mapping of vulnerable cryptography should start quickly, including in the supply chain. The security-policy situation sets new preparedness demands; payment-preparedness work is to lift resilience through independent fallback solutions that preserve minimum functionality in a crisisFinanstilsynet, with testing of relevant scenarios including worst-case scenarios.

Nordic supervisory directors have issued a joint statement on using Nordic cooperation more systematically for effective supervision and integrated Nordic financial markets, aiming at a more holistic Nordic approach where markets, firms and risks are already largely cross-border.

Banks and other financial entities should embed DORA controls in daily operationsFinanstilsynet, tighten control of critical dependenciesFinanstilsynet, direct measures at AI and quantum risks, and implement and test the ability to sustain critical services when assumptions failFinanstilsynet.

Legal basis: DORA-forordningen (EU) 2022/2554, kapittel II om IKT-risikostyring og kapittel IV-V om testing og IKT-tredjepartsrisiko, applied through Finanstilsynets 2027 supervisory prioritiesFinanstilsynet.