The E.U.’s Digital Operational Resilience Act: Cloud Services & Financial Companies

Abstract

Our report begins by providing an overview of the costs and benefits of cloud technology for financial companies; we find that cloud technology can offer significant benefits to financial companies. We then describe the current regulatory frameworks that apply to financial institutions’ use of third-party technology providers, including cloud service providers, in various jurisdictions. Next, we describe key provisions of DORA that apply to cloud and other technology service providers and how such provisions are similar to or diverge from the current frameworks described in the previous section. We conclude by recommending that the EU revise DORA in certain key respects to better align with the approach in other jurisdictions as DORA’s divergences from other jurisdictions’ regulation of cloud and other third-party technology services may unnecessarily discourage the adoption of such services by financial companies.