European banks are being compelled to enhance their cybersecurity systems to comply with stringent regulations aimed at safeguarding critical infrastructure against cyber threats. The rise of digital tools in the financial sector has brought with it an urgent need for robust data protection systems and comprehensive cybersecurity measures.

Cyber risks remain a persistent challenge in the banking industry, with no signs of abatement. According to industry projections by Cybersecurity Ventures, global cybercrime costs are expected to escalate to a staggering $10.5 trillion annually by 2025. While these figures highlight the gravity of the issue, financial institutions have an opportunity to protect themselves from financial and reputational harm through the strategic implementation of dependable cybersecurity frameworks.

The Digital Operational Resilience Act (DORA)

On January 17, after a two-year implementation period, the Digital Operational Resilience Act (DORA) was signed into law. This legislation mandates financial services firms and their technology providers to enhance their resilience against cyberattacks and operational disruptions.

Under the new rules, financial institutions must:

• Implement proactive risk management systems to identify and mitigate operational disruptions.
• Establish rapid-response protocols to address technological challenges.
• Conduct regular resilience tests to strengthen their digital defenses.
• Continuously monitor and assess third-party IT risks across the supply chain.

The act affects over 22,000 institutions, including banks, digital banks, and cryptocurrency service providers. Non-compliance can result in fines of up to 2% of annual global revenue, with managers personally liable for breaches, facing penalties of up to €1 million.

Compliance with European cybersecurity regulations remains complex. Harvey Jang, Chief Privacy Officer and Deputy General Counsel at Cisco, notes that the financial sector operates under multiple overlapping regulations. These include the Network and Information Systems Directive (NIS), which focuses on critical infrastructure security, and the General Data Protection Regulation (GDPR), which standardizes data protection across the EU.

Each regulation introduces unique requirements, and national implementation adds further fragmentation. For instance:

• The NIS Directive mandates member states to ensure high-security standards for critical infrastructure.
• The GDPR emphasizes privacy, security, and breach management, significantly impacting financial institutions that control and process vast amounts of data.

DORA and NIS2: Strengthening EU Cybersecurity

DORA complements the updated NIS2 Directive, introduced in 2023 to address evolving cyber threats. Together, these regulations aim to bolster resilience across EU member states, ensuring financial institutions are prepared for the complexities of modern cyber threats.

However, a survey by Orange Cyberdefense revealed that 43% of UK financial institutions are still not fully compliant with DORA. Despite the UK’s departure from the EU, DORA applies to any financial institution operating within the EU, including those without an EU office.

Rising Awareness and Proactive Measures

Recent incidents, such as the 2024 Microsoft/CrowdStrike outage, have underscored the importance of proactive cybersecurity measures. These events have prompted organizations to allocate larger budgets to risk management teams and adopt a crisis-preparedness mindset.

"Forward-thinking organizations understand that it’s better to be prepared for crises when they occur, rather than if they occur," states the Boyle report. This shift in mindset has empowered companies to focus on readiness in an increasingly complex threat landscape.

The Role of High-Security Solutions

Companies like Salt, a Belfast-based cybersecurity firm, are addressing the growing need for high-security solutions. Salt serves industries such as finance, defense, and law enforcement in over 50 countries, including clients like BAE Systems and Mishcon de Reya.

Salt’s approach prioritizes customized, high-security communication systems that offer clients absolute control and exclusivity. “Our high-security clients demand systems that are independent and inaccessible once deployed — even to us,” explains Boyle. This assurance gives clients confidence and peace of mind in today’s complex threat environment.

As the financial sector navigates an increasingly digital and interconnected world, the importance of robust and proactive cybersecurity strategies cannot be overstated. Compliance with evolving regulations like DORA and NIS2 is critical to safeguarding financial institutions and maintaining trust in the industry.