Financial services companies and their digital technology suppliers are under intense pressure to achieve compliance with strict new rules from the EU that require them to boost their cyber resilience.
By the start of next year, financial services firms and their technology suppliers will have to make sure that they’re in compliance with a new incoming law from the European Union known as DORA, or the Digital Operational Resilience Act.
CNBC runs through what you need to know about DORA — including what it is, why it matters, and what banks are doing to make sure they’re prepared for it.
What is DORA?
DORA requires banks, insurance companies and investment to strengthen their IT security. The EU regulation also seeks to ensure the financial services industry is resilient in the event of a severe disruption to operations.
Such disruptions could include a ransomware attack that causes a financial company’s computers to shut down, or a DDOS (distributed denial of service) attack that forces a firm’s website to go offline.
Multiple banks, payment firms and investment companies — from JPMorgan Chase and Santander, to Visa and Charles Schwab — were unable to provide service due to the outage. It took these firms several hours to restore service to consumers.
In the future, such an event would fall under the type of service disruption that would face scrutiny under the EU’s incoming rules.
Mike Sleightholme, president of fintech firm Broadridge International, notes that a standout factor of DORA is that it doesn’t just focus on what banks do to ensure resiliency — it also takes a close look at firms’ tech suppliers.
Under DORA, banks will be required to undertake rigorous IT risk management, incident management, classification and reporting, digital operational resilience testing, information and intelligence sharing in relation to cyber threats and vulnerabilities, and measures to manage third-party risks.
Firms will be required to conduct assessments of “concentration risk” related to the outsourcing of critical or important operational functions to external companies.
These IT providers often deliver “critical digital services to customers,” said Joe Vaccaro, general manager of Cisco-owned internet quality monitoring firm ThousandEyes.
“These third-party providers must now be part of the testing and reporting process, meaning financial services companies need to adopt solutions that help them uncover and map these sometimes hidden dependencies with providers,” he told CNBC.
Banks will also have to “expand their ability to assure the delivery and performance of digital experiences across not just the infrastructure they own, but also the one they don’t,” Vaccaro added.
When does the law apply?
DORA entered into force on Jan. 16, 2023, but the rules won’t be enforced by EU member states until Jan. 17, 2025.
The EU has prioritised these reforms because of how the financial sector is increasingly dependent on technology and tech companies to deliver vital services. This has made banks and other financial services providers more vulnerable to cyberattacks and other incidents.
“There’s a lot of focus on third-party risk management” now, Sleightholme told CNBC. “Banks use third-party service providers for important parts of their technology infrastructure.”
“Enhanced recovery time objectives is an important part of it. It really is about security around technology, with a particular focus on cybersecurity recoveries from cyber events,” he added.
Many EU digital policy reforms from the last few years tend to focus on the obligations of companies themselves to make sure their systems and frameworks are robust enough to protect against damaging events like the loss of data to hackers or unauthorized individuals and entities.
The EU’s General Data Protection Regulation, or GDPR, for example, requires companies to ensure the way they process personally identifiable information is done with consent, and that it’s handled with sufficient protections to minimize the potential of such data being exposed in a breach or leak.
DORA will focus more on banks’ digital supply chain — which represents a new, potentially less comfortable legal dynamic for financial firms.
What if a firm fails to comply?
For financial firms that fall foul of the new rules, EU authorities will have the power to levy fines of up to 2% of their annual global revenues.
Individual managers can also be held responsible for breaches. Sanctions on individuals within financial entities could come in as high a 1 million euros ($1.1 million).
For IT providers, regulators can levy fines of as high as 1% of average daily global revenues in the previous business year. Firms can also be fined every day for up to six months until they achieve compliance.
Third-party IT firms deemed “critical” by EU regulators could face fines of up to 5 million euros — or, in the case of an individual manager, a maximum of 500,000 euros.
That’s slightly less severe than a law such as GDPR, under which firms can be fined up to 10 million euros ($10.9 million), or 4% of their annual global revenues — whichever is the higher amount.
Carl Leonard, EMEA cybersecurity strategist at security software firm Proofpoint, stresses that criminal sanctions may vary from member state to member state depending on how each EU country applies the rules in their respective markets.
DORA also calls for a “principle of proportionality” when it comes to penalties in response to breaches of the legislation, Leonard added.
That means any response to legal failings would have to balance the time, effort and money firms spend on enhancing their internal processes and security technologies against how critical the service they’re offering is and what data they’re trying to protect.
Are banks and their suppliers ready?
Stephen McDermid, EMEA chief security officer for cybersecurity firm Okta, told CNBC that many financial services firms have prioritized using existing internal operational resilience and third-party risk programs to get into compliance with DORA and “identify any gaps they may have.”
“This is the intention of DORA, to create alignment of many existing governance programs under a single supervisory authority and harmonise them across the EU,” he added.
Fredrik Forslund vice president and general manager of international at data sanitization firm Blancco, warned that though banks and tech vendors have been making progress toward compliance with DORA, there’s still “work to be done.”
On a scale from one to 10 — with a value of one representing noncompliance and 10 representing full compliance — Forslund said, “We’re at 6 and we’re scrambling to get to 7.”
“We know that we have to be at a 10 by January,” he said, adding that “not everyone will be there by January.”
Warren Buffett walks the floor ahead of the Berkshire Hathaway Annual Shareholders Meeting in Omaha, Nebraska on May 3, 2024.
David A. Grogen | CNBC
Berkshire Hathaway shares got a boost after Warren Buffett’s conglomerate reported a surge in operating earnings, but shareholders who were waiting for news of what will happen to its enormous pile of cash might be disappointed.
Class A shares of the Omaha-based parent of Geico and BNSF Railway rose 1.2% premarket Monday following Berkshire’s earnings report over the weekend. Berkshire’s operating profit — earnings from the company’s wholly owned businesses — skyrocketed 71% to $14.5 billion in the fourth quarter, aided by insurance underwriting, where profits jumped 302% from the year-earlier period, to $3.4 billion.
Berkshire’s investment gains from its portfolio holdings slowed sharply, however, in the fourth quarter, to $5.2 billion from $29.1 billion in the year-earlier period. Berkshire sold more equities than it bought for a ninth consecutive quarter in the three months of last year, bringing total sale of equities to more than $134 billion in 2024. Notably, the 94-year-old investor has been aggressively shrinking Berkshire’s two largest equity holdings — Apple and Bank of America.
As a result of the selling spree, Berkshire’s gigantic cash pile grew to another record of $334.2 billion, up from $325.2 billion at the end of the third quarter.
In Buffett’s annual letter, the “Oracle of Omaha” said that raising a record amount of cash didn’t reflect a dimming of his love for buying stocks and businesses.
“Despite what some commentators currently view as an extraordinary cash position at Berkshire, the great majority of your money remains in equities,” Buffett wrote. “That preference won’t change.”
He hinted that high valuations were the reason for sitting on his hands amid a raging bull market, saying “often, nothing looks compelling.” Buffett also endorsed the ability of Greg Abek, his chosen successor, to pick equity opportunities, even comparing him to the late Charlie Munger.
Meanwhile, Berkshire’s buyback halt is still in place as the conglomerate repurchased zero shares in the fourth quarter and in the first quarter of this year, through Feb. 10.
Some investors and analysts expressed impatience with the lack of action and continued to wait for an explanation, while others have faith that Buffett’s conservative stance will pave the way for big opportunities in the next downturn.
“Shareholders should take comfort in knowing that the firm continues to be managed to survive and emerge stronger from any economic or market downturn by being in a financial position to take advantage of opportunities during a crisis,” said Bill Stone, chief investment officer at Glenview Trust Company and a Berkshire shareholder.
Berkshire is coming off a strong year, when it rallied 25.5% in 2024, outperforming the S&P 500 — its best since 2021. The stock is up more than 5% so far in 2025.
Check out the companies making headlines before the bell. Domino’s Pizza — Shares fell more than 3% after the pizza chain reported fourth-quarter numbers that missed expectations. The company earned $4.89 per share on revenue of $1.44 billion. Analysts polled by FactSet expected a profit of $4.90 per share on revenue of $1.48 billion. U.S. same-store, a key metric for the company, increased by 0.4%. That was also below a consensus forecast calling for a 1.1% advance. Nike — Shares popped 2% on the back of Jefferies’ upgrade to buy from hold. Jefferies said the athletic apparel maker is turning “back on its innovation engine.” Palantir Technologies — The stock dropped more than 3%, adding to its steep declines from last week amid concern that retail investors may be dumping the AI play. Palantir dropped 14.9% last week, its biggest weekly drop since January. Alibaba — The Chinese e-commerce giant slipped 3%, reversing some of its 15% rally last week on the back of its latest strong earnings report. Monday’s premarket slide came despite an upgrade to overweight from equal weight at Morgan Stanley. Analyst Gary Yu said that Alibaba was poised for continued leadership in the artificial intelligence cloud market. Berkshire Hathaway — Class B shares of Warren Buffett’s conglomerate rose more than 1% in premarket after the firm said its operating profit skyrocketed 71% to $14.5 billion during the final three months of 2024. That was led by a 302% jump in insurance underwriting. Robinhood — The retail trading platform added around 2% after Robinhood said the U.S. Securities and Exchange Commission dismissed its investigation of the company’s cryptocurrency segment. Energy companies — Select power company stocks slipped on Monday morning, extending their Friday declines, following the release of a TD Cowen report last week on data centers and Microsoft. In the note, analyst Michael Elias said that MSFT had “cancelled leases in the U.S. totaling ‘a couple of hundred MWs’ with at least two private data center operators.” Shares of Vistra , Talen Energy and GE Vernova all shed less than 1%. Rivian — The electric vehicle stock shed 3% following a downgrade to underperform from neutral at Bank of America. Analyst John Murphy said that the company remains “one of the most viable” EV startups, but a softer-than-expected 2025 outlook, mounting competition, and slowing EV demand combined with a potential pullback in U.S. EV incentives pose headwinds for shares. Freshpet — Shares popped 4% after Jefferies upgraded the pet food retailer to buy from hold, saying the stock is “worth 50% above” where it’s currently trading. The firm expects that Freshpet can compound sales 23% by 2027. The stock is down 32% this year. — CNBC’s Sean Conlon, Brian Evans, Alex Harring, Fred Imbert, Sarah Min and Yun Li contributed reporting.
Tensions between the world’s two largest economies have escalated over the last several years.
Florence Lo | Reuters
BEIJING — China is trying yet again to boost foreign investment, amid geopolitical tensions and businesses’ calls for more concrete actions.
On Feb. 19, authorities published a “2025 action plan for stabilizing foreign investment” to make it easier for foreign capital to invest in domestic telecommunication and biotechnology industries, according to a CNBC translation of the Chinese.
The document called for clearer standards in government procurement — a major issue for foreign businesses in China — and for the development of a plan to gradually allow foreign investment in the education and culture sectors.
“We are looking forward to see this implemented in a manner that delivers tangible benefits for our members,” Jens Eskelund, president of the European Union Chamber of Commerce in China, said in a statement Thursday.
The chamber pointed out that China has already mentioned plans to open up telecommunications, health care, education and culture to foreign investment. Greater clarity on public procurement requirements is a “notable positive,” the chamber said, noting that “if fully implemented,” it could benefit foreign companies that have invested heavily to localize their production in China.
China’s latest action plan was released around the same time the Commerce Ministry disclosed that foreign direct investment in January fell by 13.4% to 97.59 billion yuan ($13.46 billion). That was after FDI plunged by 27.1% in 2024 and dropped by 8% in 2023, after at least eight straight years of annual growth, according to official data available through Wind Information.
All regions should “ensure that all the measures are implemented in 2025, and effectively boost foreign investment confidence,” the plan said. The Ministry of Commerce and National Development and Reform Commission — the economic planning agency — jointly released the action plan through the government’s executive body, the State Council.
Officials from the Commerce Ministry emphasized in a press conference Thursday that the action plan would be implemented by the end of 2025, and that details on subsequent supportive measures would come soon.
“We appreciate the Chinese government’s recognition of the vital role foreign companies play in the economy,” Michael Hart, president of the American Chamber of Commerce in China, said in a statement. “We look forward to further discussions on the key challenges our members face and the steps needed to ensure a more level playing field for market access.”
AmCham China’s latest survey of members, released last month, found that a record share are considering or have started diversifying manufacturing or sourcing away from China. The prior year’s survey had found members were finding it harder to make money in China than before the Covid-19 pandemic.
Consumer spending in China has remained lackluster since the pandemic, with retail sales only growing by the low single digits in recent months. Tensions with the U.S. have meanwhile escalated as the White House has restricted Chinese access to advanced technology and levied tariffs on Chinese goods.
‘A very strong signal’
While many aspects of the action plan were publicly mentioned last year, some points — such as allowing foreign companies to buy local equity stakes using domestic loans — are relatively new, said Xiaojia Sun, Beijing-based partner at JunHe Law.
She also highlighted the plan’s call to support foreign investors’ ability to participate in mergers and acquisitions in China, and noted it potentially benefits overseas listings. Sun’s practice covers corporates, mergers and acquisitions and capital markets.
The bigger question remains China’s resolve to act on the plan.
“This action plan is a very strong signal,” Sun said in Mandarin, translated by CNBC. She said she expects Beijing to follow through with implementation, and noted that its release was similar to a rare, high-profile meeting earlier in the week of Chinese President Xi Jinping and entrepreneurs.
That gathering on Feb. 17 included Alibaba founder Jack Ma and DeepSeek’s Liang Wenfeng. In recent years, regulatory crackdowns and uncertainty about future growth had dampened business confidence and foreign investor sentiment.
China needs to strike a balance between tariff retaliation and stabilizing FDI, Citi analysts pointed out earlier this month.
“We believe China policymakers are likely cautious about targeting U.S. [multinationals] as a form of retaliation against U.S. tariffs,” the analysts said. “FDI comes into China, bringing technology and know-how, creating jobs, revenue and profit, and contributing to tax revenue.”
In a relatively rare acknowledgement, Chinese Commerce Ministry officials on Thursday noted the impact of geopolitical tensions on foreign investment, including some companies’ decision to diversify away from China. They also pointed out that foreign-invested firms contribute to nearly 7% of employment and around 14% of taxes in the country.
Previously, official commentary from the Commerce Ministry about any drop in FDI tended to focus only on how most foreign businesses remained optimistic about long-term prospects in China.