Skillcast reports financial sectors most prepared for DORA in the UK

The report focuses on UK financial sub-sectors and how they prepare for the DORA regulation, offering insights into the consequences of non-compliance, and steps to achieving it.

Key findings

DORA came into effect in January due to 54% of global financial institutions reporting cyber-attacks that resulted in stolen and destroyed data, representing a 12.5% increase from 2023.

58% of UK small businesses and 70% of medium businesses identified breaches or attacks in the last 12 months, while 21% of businesses overall reported that breaches happen once a month. However, the attacks cost UK businesses close to GBP 44 billion in lost revenue over the past five years.

Most financially regulated sub-sectors in the UK scored highly on key indicators of digital resilience, such as low cybersecurity incident rates and minimal regulatory breaches. Corporate and specialist services are the sub-sector most prepared for DORA, followed by the property and real estate finance sub-sector, and the capital markets and trading sub-sector. All three sub-sectors were found to have a high concentration of businesses with operations in the EU, which is why they are already prepared for DORA.

The pensions and retirement planning and fintech and technology sub-sectors ranked in the mid-range, suggesting a moderate level of preparedness for DORA compliance. However, the banking and lending sub-sector was marked as the least prepared for compliance with DORA, as it received seven fines from FCA, totalling a cost of over GP 96 million between 2023 and 2024, highlighting a pattern of non-compliance.

Steps that UK businesses can take towards compliance with DORA standards include increasing employee awareness with training, optimising incident reporting and monitoring, and taking regular compliance testing and assessments.

Failing to comply with DORA will result in consequences for businesses, with financial penalties reaching up to 1% of a company’s worldwide daily turnover for six months, posing a significant threat to businesses' growth and reputation.