The AirPlus Global

DORA: What does this mean for the payments industry?

Written by Mary Conner | Feb 28, 2025

With great tech comes great responsibility - especially given the alarming rise of cyber threats.

Imagine waking up one busy morning to find that your banking app isn’t working, your transactions are delayed, and financial chaos is unfolding around the globe.

Sounds like a nightmare, right?

Well, that’s the kind of disruption that cyberattacks and infrastructure failures can cause in the financial sector - and they’re becoming more frequent and sophisticated than ever.

At the same time, the finance sector is increasingly dependent on technology, specifically Information and Communications Technology (ICT) - which powers digital transactions, processes enormous mountains of data, and connects markets globally.

However, with 6 million cyberattacks recorded worldwide in the third quarter of 2024 [1] and cybercrime costs projected to reach $10.5 trillion annually, [2] the sector faces a rapidly evolving security challange.

And if that wasn’t enough to cause concern, IBM found that the average cost of a single data breach in financial services averages at $4.45 million. [3]  Ouch!

We’ve also seen the real-world consequences of vulnerabilities in ICT systems. In 2021, a major European bank authority suffered a cyberattack that caused prolonged downtime, disrupting systems, and rattling consumer trust. [4]

These events prove that financial institutions need robust safeguards as quickly as possible - that’s where DORA comes in.

 

Shifting from reaction to prevention 

 

DORA’s introduction highlights a long-standing issue: why did it take a surge in cyber threats and high-profile financial breaches to drive such necessary regulation?

While financial institutions have long faced cybersecurity risks, the absence of a unified framework left many exposed.

DORA changes this by establishing strict requirements for ICT risk management, incident reporting, resilience testing, and third-party risk oversight. [5]

These measures aim to create a standardized, EU-wide approach to digital resilience - but they also raise an important question: should the industry wait for regulatory pressure to drive security improvements, or should resilience be a proactive, continuous effort?

 

What to expect from your provider under the regulation

 

Starting on January 17th 2025, the Digital Operational Resilience Act (DORA) will be the European Union’s answer to the growing cyber threats in finance.

The regulation aims to ensure that financial institutions can withstand, respond to, and recover from ICT-related disruptions. [6]

In the corporate payments landscape, DORA is a game-changer.

The industry depends on a vast, interconnected network of payment providers, financial partners, vendors, and stakeholders, where a single cyber incident can send a ripple effect throughout the entire ecosystem. [7]

So, what does this regulation actually mean for you and your provider?

 

Here's how DORA will reshape corporate payments:

 

Stronger service reliability: Providers must maintain strict ICT management and operational stability, meaning more dependable services with fewer disruptions for customers.  

Greater trust and transparency: Customers and business partners will have more confidence in their providers, who will be required to follow updated compliance standards.

Enhanced security: Providers will need to adopt advanced cybersecurity measures to improve threat detections, making transaction safer with fewer risks for customers.

Competitive advantage: Providers who implement new measures will stand out as leaders in secure and reliable payments, securing customer loyalty by meeting the highest standards.

 

The future of corporate payments

 

So as cyber threats evolve, DORA is setting a new gold standard for financial operational resilience.

Our dedicated project team has been hard at work, implementing new policies and processes to strengthen our resilience, including improved incident reporting and defining critical business functions.

As we move forward, our commitment remains clear: safeguarding corporate payments against disruptions and staying ahead of regulatory changes.

The future of corporate payments (and the entire financial sector) is about to get a whole lot safer.

 

 

Banner photo by Grecaud Paul on Adobe Stock

[1] European Banks Brace For Heightened Cyber Threat | Global Finance Magazine

[2] Cybercrime To Cost The World $10.5 Trillion Annually By 2025 | Cybersecurity Ventures

[3] Half of Breached Organizations Unwilling to Increase Security Spend Despite Soaring Breach Costs | IBM

[4] European Banking Authority hit by Microsoft Exchange hack | BBC

[5] Digital Operational Resilience Act (DORA) | ESMA

[6] Navigating the New EU Regulation on Digital Operational Resilience (DORA) | Baker McKenzie

[7] Digital Operational Resilience Act (DORA) | EIOPA