DORA update: the sector is making progress, but some areas require attention

RegCanary interpretation

This is RegCanary analysis, not source text. Check material statements against the original publication.

AFM's latest DORA update acknowledges meaningful progress across the financial sector but signals that supervisory scrutiny has uncovered areas where firms are falling short. For compliance teams, this is a clear prompt to benchmark their own ICT risk management, incident reporting, and third-party risk frameworks against AFM's expectations. The update does not introduce new rules, but it functions as a supervisory signal: firms that fail to address these gaps may face heightened engagement or enforcement as DORA supervision matures. Action is needed now to review the update, map its findings to existing DORA implementations, and remediate weaknesses—particularly in areas where AFM has explicitly noted insufficient attention. Boards and risk committees should treat this as a strategic checkpoint rather than a routine communication, as it highlights how regulators are operationalising DORA in day-to-day supervision. Proactive firms can use this update to strengthen their resilience posture, improve reporting accuracy, and demonstrate supervisory alignment ahead of any future inspections.

RegCanary impact assessment

RegCanary impact score: 7/10