KPMG Finds DORA Evidence Gaps in ECB Banks

ECB banks are under pressure to move beyond DORA compliance on paper and produce regulator-ready evidence that resilience controls actually work.

Updated

What is this trend?

KPMG’s review shows ECB banks are still struggling to prove DORA compliance with evidence, especially in risk appetite, exit planning, third-party oversight, and resilience testing.

  • Less than half of banks had a senior-approved ICT risk appetite statement.
  • Exit strategies and third-party concentration risk are still weak in many banks.
  • Regular resilience testing exists, but advanced scenario testing remains limited.
  • The challenge has shifted from adopting DORA to proving controls work end to end.

What’s the latest?

KPMG’s review of 23 ECB-related banks shows the next hurdle is not policy adoption but proving that DORA works in practice.

Always-On Risk Scoring, Embedded Cyber Operations, and Analyst Actionability

How it developed

  1. Board-Level Cyber Governance, Live Node Dependency Triage, and Real-Time Continuity Planning

  2. Always-On Risk Operations, Harder Verification Gates, and Faster Provenance Checks

  3. Continuous Assurance, AI Stage Gates, Sanctions Screening, and DORA Evidence Gaps

Go deeper

Curated long-form picks on this trend — podcasts, videos, and analysis, by seniority.

Stay ahead in Risk Management

Get the weekly Risk Management brief in your inbox — the developments, what they mean by seniority, and what to do next.