Dora delay leaves EU banks fighting for their audit rights

Regulation requires firms to expand scrutiny of critical vendors that haven’t yet been identified

Well before the European Union’s Digital Operational Resilience Act entered into force at the start of this year, financial institutions knew it would profoundly change their relationship with third-party vendors. What they didn’t know for sure was how – and they still don’t.

“Dora was slightly too early for its time,” says a head of cyber and technology risk at a global bank. “A coherent approach