The development of the DORA Compliance Level Self-Assessment Survey

We advised payment service providers in:

The development of the DORA Compliance Level Self-Assessment Survey provided by
the Polish Financial Supervision Authority

The Regulation on Operational Digital Resilience for the Financial Sector (DORA) shall apply from 17 January 2025. The new rules will constitute a code of conduct for the broader area of ICT security (Information and Communication Technologies) and the use of ICT by financial entities. On the basis of DORA, regulatory technical standards, implementing technical standards and delegated acts will be issued to supplement the provisions of the described act.

In addition, DORA provides simplifications or exemptions of a different nature for selected categories of entities, e.g. for small payment institutions or financial entities that are micro-enterprises within the meaning of DORA.

Adaptation to these requirements by financial entities will require, among other things:

1. auditing existing ICT procedures and solutions,
2. amending or supplementing existing or preparing new ICT procedures and solutions,
3. a review of contracts with external suppliers to determine whether they are ICT TPSP contracts within the meaning of DORA,
4. align ICT TPSP contracts within the meaning of DORA with the requirements of this regulation,
5. ensure that future contracts with ICT TPSPs comply with DORA.

Separately, the Polish Financial Supervision Authority (PFSA) has developed a DORA Compliance Level Self-Assessment Survey to collect quantitative and qualitative information on the level of compliance with the requirements under the DORA Regulation and to assess the preparedness of financial entities to manage the risks associated with the technologies used.

DLK’s advisory included:

• to determine whether and from which simplifications or exemptions under DORA a financial entity may benefit,
• to identify compliance with each of the DORA requirements taking into account the information received and the financial entity’s internal documentation (strategies, policies, procedures and mechanisms, etc. of the financial entity),
• identification of gaps in compliance with DORA requirements (so-called ‘gap report’) and actions necessary to comply with DORA requirements.