In force since 17 January 2025, the EU's DORA regulation (Digital Operational Resilience Act, Regulation EU 2022/2554) marks a paradigm shift: digital resilience is no longer best practice — it is a legal obligation for the entire European financial sector, including banks, insurers, asset managers, payment providers and their critical technology vendors.
For West African financial institutions, DORA is not just a European matter. Any bank working with European counterparties, parent companies or correspondent banks will see these requirements cascade into contracts and due-diligence questionnaires. Anticipating them turns a constraint into a competitive advantage.
The regulation's five pillars
- ICT risk management: asset mapping, security policies and governance directly involving the management body.
- Major incident reporting to authorities under harmonized thresholds and deadlines.
- Operational resilience testing, up to threat-led penetration testing (TLPT) for systemic players.
- Third-party ICT risk management: contract register, mandatory clauses, exit strategies.
- Voluntary cyber threat-intelligence sharing between institutions.
Where to start?
Our field experience is consistent: the most underestimated workstream is third-party management. Building an exhaustive ICT contract register, rating the criticality of each service and renegotiating contractual clauses takes months. The second hard point is governance: DORA makes the management body explicitly accountable for the resilience strategy — which requires readable reporting and reliable indicators.
A pragmatic four-step approach works: a maturity self-assessment against DORA requirements, a risk-prioritized roadmap, tooled remediation (BCP/DRP, incident management, monitoring), then regular crisis exercises to anchor reflexes.
Resilience is not decreed in a document: it is proven, incident after incident, exercise after exercise.
Optima Advisory supports financial institutions on their DORA journey: gap assessment, third-party register, testing program and crisis-exercise preparation. Let's talk about your exposure.
