Tough new European Union regulations requiring banks to bolster their cybersecurity systems officially come into effect Friday — but many of the bloc’s financial services firms aren’t yet in full compliance with the rules.
The EU’s Digital Operational Resilience Act, or DORA, requires both financial services firms and their technology suppliers to strengthen their IT systems to ensure the industry is resilient in the event of a cyberattack or any other forms of disruption. It entered into effect on Jan. 17.
The penalties for breaches of the new legislation can be substantial. Financial services firms that fall foul of the new rules can face fines of up to 2% of annual global revenue. Individual managers could also be held liable for breaches and face sanctions of as much as 1 million euros ($1 million).
So far, the rate of compliance among financial services firms with the new rules has been mixed, according to Harvey Jang, chief privacy officer and deputy general counsel at IT giant Cisco.
“I think we’ve seen a mixed bag,” Jang told CNBC in an interview. “Of course, the more mature-stage companies are further along looking at this for at least a year — if not longer.”
“We’re really trying to build this compliance program, but it’s so complex. I think that’s the challenge. We saw this too with GDPR and other broad legislation that is subject to interpretation — what does it actually mean to comply? It means different things to different people,” he said.
This lack of a common understanding of what qualifies as robust compliance with DORA has in turn led many institutions to ramp up security standards to the level that they’re actually surpassing the “baseline” of what’s expected of most firms, Jang added.
Are financial institutions ready?
Under DORA, financial firms will be required to undertake rigorous IT risk and incident management, classification and reporting, operational resilience testing, intelligence sharing on cyber threats and vulnerabilities, and measures to manage third-party risks.
Firms will be also be required to conduct assessments of “concentration risk” related to the outsourcing of critical or important operational functions to external companies.
That’s a concern because, even though the U.K. falls outside the European Union now, DORA applies to all financial entities operating within EU jurisdictions — even if they’re based outside the bloc.
“Whilst it is clear that DORA has no legal reach in the U.K., entities based here and operating or providing services to entities in the EU will be subject to the regulation,” Richard Lindsay, principal advisory consultant at Orange Cyberdefense, told CNBC.
He added that the main challenge for many financial institutions when it comes to achieving DORA compliance has been managing their critical third-party IT providers.
“Financial institutions operate within a multi-layered and hugely complex digital ecosystem,” Lindsay said. “Tracking and ensuring that all parts of this system evidentially comply with the relevant elements of DORA will require a new mindset, solutions and resources.”
Banks are also adding higher levels of scrutiny in their contract negotiations with tech suppliers due to DORA’s strict requirements, Jang said.
The Cisco chief privacy officer told CNBC that he thinks there is alignment when it comes to the principles and the spirit of the law. However, he added, “any legislation is a product of compromise and so, as they get more prescriptive, then it becomes challenging.”
“The principles we agree with, but any legislation is a product of compromise, and so as as they get more prescriptive, then it becomes challenging.”
Still, despite the challenges, the broad expectation among experts is that it won’t be long until banks and other financial institutions achieve compliance.
“Banks in Europe already comply with significant regulations which cover the majority of the areas that fall under DORA,” Fabio Colombo, EMEA financial services security lead at Accenture, told CNBC.
“As a result, financial services institutions already have mature governance and compliance capabilities in place, with existing incident reporting processes and solid ICT risk frameworks.”
Risks for IT suppliers
IT providers can also be fined under DORA. The rules threaten levies of as much as 1% of average daily worldwide revenue for up to six months.
“These sanctions are necessary,” Brian Fox, chief technology officer of software supply chain management firm Sonatype, told CNBC. “They are a powerful motivator, pushing leaders to take compliance and operational resilience more seriously than ever.”
Orange Cyberdefense’s Lindsay said there’s a risk longer term that financial services firms end up moving their critical security functions and services in-house.
“Advances in technology may allow financial institutions to move services back in-house, simplifying this aspect and reducing the risk of non-compliance,” he said.
“Either way, existing contracts will need to be updated to ensure compliance is contractually mandated and monitored between entity and provider,” Lindsay added.
“As with any new regulation, there will certainly be a transitionary period as organisations adjust to new requirements and standards,” Sonatype’s Fox told CNBC. “This is the start of a long journey toward improving software security and resilience.”
Artificial intelligence startup Runway on Monday announced Gen 4.5, a new video model that outperforms similar models from Google and OpenAI in an independent benchmark.
Gen 4.5 allows users to generate high-definition videos based on written prompts that describe the motion and action they want. Runway said the model is good at understanding physics, human motion, camera movements and cause and effect.
The model holds the No. 1 spot on the Video Arena leaderboard, which is maintained by the independent AI benchmarking and analysis company Artificial Analysis. To determine the text-to-video model rankings, people compare two different model outputs and vote for their favorite without knowing which companies are behind them.
Google’s Veo 3 model holds second place on the leaderboard, and OpenAI’s Sora 2 Pro model is in seventh place.
“We managed to out-compete trillion-dollar companies with a team of 100 people,” Runway CEO Cristóbal Valenzuela told CNBC in an interview. “You can get to frontiers just by being extremely focused and diligent.”
Read more CNBC tech news
Runway was founded in 2018 and earned a spot on CNBC’s Disruptor 50 list this year. It conducts AI research and builds video and world models, which are models that are trained on video and observational data to better reflect how the physical world works.
The startup’s customers include media organizations, studios, brands, designers, creatives and students. Its valuation has swelled to $3.55 billion, according to PitchBook.
Valenzuela said Gen 4.5 was codenamed “David” in a nod to the biblical story of David and Goliath. The model was “an overnight success that took like seven years,” he said.
“It does feel like a very interesting moment in time where the era of efficiency and research is upon us,” Valenzuela said. “[We’re] excited to be able to make sure that AI is not monopolized by two or three companies.”
Gen 4.5 is rolling out gradually, but it will be available to all of Runway’s customers by the end of the week. Valenzuela said it’s the first of several major releases that the company has in store.
“It will be available through Runway’s platform, its application programming interface and through some of the company’s partners,” he said.
Nvidia on Monday announced it has purchased $2 billion of Synopsys‘ common stock as part of a strategic partnership to accelerate computing and artificial intelligence engineering solutions.
As part of the multiyear partnership, Nvidia will help Synopsys accelerate its portfolio of compute-intensive applications, advance agentic AI engineering, expand cloud access and develop joint go-to-market initiatives, according to a release. Nvidia said it purchased Synopsys’ stock at $414.79 per share.
“Our partnership with Synopsys harnesses the power of Nvidia accelerated computing and AI to reimagine engineering and design — empowering engineers to invent the extraordinary products that will shape our future,” Nvidia CEO Jensen Huang said in the release.
Synopsys stock climbed 3%. Nvidia shares rose slightly.
Tune in at 9:30 a.m. ET as Nvidia CEO Jensen Huang and Synopsys CEO Sassine Ghazi join CNBC TV to discuss the partnership. Watch in real time on CNBC+ or the CNBC Pro stream.
Nvidia has been one of the biggest beneficiaries of the AI boom because it makes the graphics processing units, or GPUs, that are key to building and training AI models and running large workloads.
Synopsys offers services including silicon design and electronic design automation that help its customers build AI-powered products.
“The complexity and cost of developing next-generation intelligent systems demands engineering solutions with a deeper integration of electronics and physics, accelerated by AI capabilities and compute,” Synopsys CEO Sassine Ghazi said in a statement.
The partnership is not exclusive, which means that Nvidia and Synopsys can still work with other companies in the ecosystem.
Both companies will hold a press conference to discuss the announcement at 10 a.m. ET.
This is CNBC’s Morning Squawk newsletter. Subscribe here to receive future editions in your inbox.
Here are five key things investors need to know to start the trading day:
1. No-tech November
Last week’s recovery rally allowed the Dow Jones Industrial Average and S&P 500 to both finish their seventh straight winning month. But technology stocks weren’t able to regain as much ground, as investors weighed concerns about overspending on artificial intelligence.
Here’s a recap:
The tech-heavy Nasdaq Composite dropped around 1.5% in November, snapping its seven-month win streak.
Palantir was a notable tech loser last month. The defense stock dropping around 16% for its biggest monthly decline in more than two years.
Silver surged back to all-time highs last week and notched its longest streak of positive months since 1983.
Today’s session kicks off the final trading month of 2025, which is poised to cap another year of big wins for stock investors.
Traders are hoping that that market will end the year on a high note. But as CNBC’s Mike Santoli notes, investors have relatively low exposure to U.S. stocks.
An Eli Lilly & Co. Zepbound injection pen, March 28, 2024.
Bloomberg | Bloomberg | Getty Images
Eli Lilly is getting in on the price-cutting action this morning. The pharma company said it’s lowering the cash cost of single-dose vials of weight-loss drug Zepbound on its direct-to-consumer platform.
Beginning today, patients using cash and with a valid prescription can buy the drug for between $299 and $449 a month, depending on the dose, on the LillyDirect platform. That’s down from the prior range of $349 to $499.
Eli Lilly’s move comes weeks after President Donald Trump signed deals with the company and its competitor Novo Nordisk to make their blockbuster weight-loss drugs more accessible and affordable.
3. Turkey with a side of popcorn
Disney’s “Zootopia 2” follows detectives Judy Hopps and Nick Wilde find themselves on the twisting trail of a mysterious reptile who turns the mammal metropolis of Zootopia upside down.
Disney
Hollywood has something to be thankful for. This year’s Thanksgiving box office performance is poised to be one of the best in history.
The holiday weekend brought in around $294 million, though that number won’t be finalized until today to account for all of yesterday’s sales. Still, CNBC’s Sarah Whitten reports that this weekend will likely equate to the third or fourth best Thanksgiving period ever. Disney’s “Zootopia 2” led the way, bringing in an estimated $156 million.
Additionally, IMAX said it saw $40.8 million in global ticket sales over the five-day holiday weekend period. That’s a new all-time high and marks a 70% increase from the record set last year.
Get Morning Squawk directly in your inbox
4. Airbus’ woes
A Latam Airlines Airbus A320 sits on the tarmac at El Dorado airport in Bogota on Nov. 28, 2025.
Sergio Yate | Afp | Getty Images
European-listed shares of Airbus tumbled this morning following reports of an industrial quality issue facing dozens of its A320-family aircraft.
Reuters reported, citing sources, that a flaw is affecting the planes’ fuselage panels, resulting in some some delayed deliveries. However, there are no indications that the issue is affecting planes currently in service.
Airbus did not respond to CNBC’s request for comment. In a Monday statement, the company apologized for a software glitch that grounded about 6,000 of its A320-family planes over the holiday weekend.
5. Existential crisis
ArgentHewitt | iStock | 360 | Getty Images
Family businesses that provide personalized memorial products like gravestones are facing dual challenges. For several years, they’ve been adjusting as the cremation rate grows. More recently, Trump’s tariff increases have added pressure to their bottom lines.
These businesses told CNBC they still import granite despite the levies, due to higher labor costs in the U.S. On top of that, certain types of the stone are only made internationally. As Rome Monument’s John Dioguardi put it, “God gave the different parts of the world certain yummies.”