Tough new EU cyber rules require banks to ramp up security — but many aren’t ready
Traffic_analyzer | Digitalvision Vectors | Getty Images
Tough new European Union regulations requiring banks to bolster their cybersecurity systems officially come into effect Friday — but many of the bloc’s financial services firms aren’t yet in full compliance with the rules.
The EU’s Digital Operational Resilience Act, or DORA, requires both financial services firms and their technology suppliers to strengthen their IT systems to ensure the industry is resilient in the event of a cyberattack or any other forms of disruption. It entered into effect on Jan. 17.
The penalties for breaches of the new legislation can be substantial. Financial services firms that fall foul of the new rules can face fines of up to 2% of annual global revenue. Individual managers could also be held liable for breaches and face sanctions of as much as 1 million euros ($1 million).
So far, the rate of compliance among financial services firms with the new rules has been mixed, according to Harvey Jang, chief privacy officer and deputy general counsel at IT giant Cisco.
“I think we’ve seen a mixed bag,” Jang told CNBC in an interview. “Of course, the more mature-stage companies are further along looking at this for at least a year — if not longer.”
“We’re really trying to build this compliance program, but it’s so complex. I think that’s the challenge. We saw this too with GDPR and other broad legislation that is subject to interpretation — what does it actually mean to comply? It means different things to different people,” he said.
This lack of a common understanding of what qualifies as robust compliance with DORA has in turn led many institutions to ramp up security standards to the level that they’re actually surpassing the “baseline” of what’s expected of most firms, Jang added.
Are financial institutions ready?
Under DORA, financial firms will be required to undertake rigorous IT risk and incident management, classification and reporting, operational resilience testing, intelligence sharing on cyber threats and vulnerabilities, and measures to manage third-party risks.
Firms will be also be required to conduct assessments of “concentration risk” related to the outsourcing of critical or important operational functions to external companies.
A Censuswide survey of 200 U.K. chief information security officers commissioned by Orange Cyberdefense, the cybersecurity division of French telecoms firm Orange, showed that 43% of financial institutions in Britain aren’t yet in full compliance with DORA.
That’s a concern because, even though the U.K. falls outside the European Union now, DORA applies to all financial entities operating within EU jurisdictions — even if they’re based outside the bloc.
“Whilst it is clear that DORA has no legal reach in the U.K., entities based here and operating or providing services to entities in the EU will be subject to the regulation,” Richard Lindsay, principal advisory consultant at Orange Cyberdefense, told CNBC.
He added that the main challenge for many financial institutions when it comes to achieving DORA compliance has been managing their critical third-party IT providers.
“Financial institutions operate within a multi-layered and hugely complex digital ecosystem,” Lindsay said. “Tracking and ensuring that all parts of this system evidentially comply with the relevant elements of DORA will require a new mindset, solutions and resources.”
Banks are also adding higher levels of scrutiny in their contract negotiations with tech suppliers due to DORA’s strict requirements, Jang said.
The Cisco chief privacy officer told CNBC that he thinks there is alignment when it comes to the principles and the spirit of the law. However, he added, “any legislation is a product of compromise and so, as they get more prescriptive, then it becomes challenging.”
“The principles we agree with, but any legislation is a product of compromise, and so as as they get more prescriptive, then it becomes challenging.”
Still, despite the challenges, the broad expectation among experts is that it won’t be long until banks and other financial institutions achieve compliance.
“Banks in Europe already comply with significant regulations which cover the majority of the areas that fall under DORA,” Fabio Colombo, EMEA financial services security lead at Accenture, told CNBC.
“As a result, financial services institutions already have mature governance and compliance capabilities in place, with existing incident reporting processes and solid ICT risk frameworks.”
Risks for IT suppliers
IT providers can also be fined under DORA. The rules threaten levies of as much as 1% of average daily worldwide revenue for up to six months.
“These sanctions are necessary,” Brian Fox, chief technology officer of software supply chain management firm Sonatype, told CNBC. “They are a powerful motivator, pushing leaders to take compliance and operational resilience more seriously than ever.”
Orange Cyberdefense’s Lindsay said there’s a risk longer term that financial services firms end up moving their critical security functions and services in-house.
“Advances in technology may allow financial institutions to move services back in-house, simplifying this aspect and reducing the risk of non-compliance,” he said.
“Either way, existing contracts will need to be updated to ensure compliance is contractually mandated and monitored between entity and provider,” Lindsay added.
Meanwhile, there are several other cybersecurity-focused regulations that organizations will have to come to terms, such as the Network and Information Security Directive 2, or NIS 2, and the Cyber Resilient Act. The former entered into force in October.
“As with any new regulation, there will certainly be a transitionary period as organisations adjust to new requirements and standards,” Sonatype’s Fox told CNBC. “This is the start of a long journey toward improving software security and resilience.”
Jaap Arriens | Nurphoto | Getty Images
The Supreme Court on Friday upheld the law requiring China-based ByteDance to divest its ownership of TikTok by Sunday or face an effective ban of the popular social video app in the U.S.
ByteDance has so far refused to sell TikTok, meaning many U.S. users could lose access to the app this weekend. The app may still work for those who already have TikTok on their phones, although ByteDance has also threatened to shut the app down.
In a unanimous decision, the Supreme Court sided with the Biden administration, upholding the Protecting Americans from Foreign Adversary Controlled Applications Act, which President Joe Biden signed in April.
“There is no doubt that, for more than 170 million Americans, TikTok offers a distinctive and expansive outlet for expression, means of engagement, and source of community,” the Supreme Court’s opinion said. “But Congress has determined that divestiture is necessary to address its well-supported national security concerns regarding TikTok’s data collection practices and relationship with a foreign adversary.”
Supreme Court Justices Sonia Sotomayor and Neil Gorsuch wrote concurrences.
TikTok’s fate in the U.S. now lies in the hands of President-elect Donald Trump, who originally favored a TikTok ban during his first administration, but has since flip-flopped on the matter. In December, Trump asked the Supreme Court to pause the law’s implementation and allow his administration “the opportunity to pursue a political resolution of the questions at issue in the case.”
In a post on his social media app Truth Social, Trump wrote that the decision was expected “and everyone must respect it.”
“My decision on TikTok will be made in the not too distant future, but I must have time to review the situation. Stay tuned!” Trump wrote.
Trump began to speak more favorably of TikTok after he met in February with billionaire Republican megadonor Jeff Yass. Yass is a major ByteDance investor who also owns a stake in the owner of Truth Social.
Trump will be inaugurated Monday, one day after the TikTok deadline for a sale. TikTok CEO Shou Chew is one of several tech leaders expected to be in attendance, seated on the dais.
In a video posted on TikTok, Chew thanked Trump “for his commitment to work with us to find a solution that keeps TikTok available” in the U.S. He said use of TikTok is a First Amendment right, adding that over 7 million American businesses use it to make money and find customers.
“Rest assured, we will do everything in our power to ensure our platform thrives as your online home for limitless creativity and discovery as well as a source of inspiration and joy for years to come,” he said.
The nation’s highest court said in the opinion that while “data collection and analysis is a common practice in this digital age,” the sheer size of TikTok and its “susceptibility to foreign adversary control, together with the vast swaths of sensitive data the platform collects” poses a national security concern.
Under the terms of the law, third-party internet service providers such as Apple and Google will be penalized for supporting a ByteDance-owned TikTok after the Jan. 19 deadline.
If service providers and app store owners comply, consumers will be unable to install the necessary updates that make the app functional.
Representatives of TikTok did not immediately respond to requests for comment.
Users look for alternatives
White House press secretary Karine Jean-Pierre reiterated Biden’s support for the law in a statement, saying “TikTok should remain available to Americans, but simply under American ownership or other ownership that addresses the national security concerns identified by Congress in developing this law.”
“Given the sheer fact of timing, this Administration recognizes that actions to implement the law simply must fall to the next Administration, which takes office on Monday,” Pierre said.
Attorney General Merrick Garland and Lisa Monaco, his deputy, said in a release that the decision “enables the Justice Department to prevent the Chinese government from weaponizing TikTok to undermine America’s national security.”
Kate Ruane, the director of the Center for Democracy and Technology nonprofit, criticized the ruling, saying in a statement that it “harms the free expression of hundreds of millions of TikTok users in this country and around the world.”
In December, members of the House Select Committee on the Chinese Communist Party sent letters to Apple CEO Tim Cook and Google CEO Sundar Pichai, urging the executives to begin preparing to comply with the law.
Shou Zi Chew, CEO of TikTok, speaks to reporters outside the office of Sen. John Fetterman (D-PA) at the Russell Senate Office Building on March 14, 2024 in Washington, DC.
Anna Moneymaker | Getty Images
On Jan. 10, the Supreme Court heard oral arguments from lawyers representing TikTok, content creators and the U.S. government. TikTok’s lead lawyer, Noel Francisco, argued that the law violates the First Amendment rights of the app’s 170 million American users. U.S. Solicitor General Elizabeth Prelogar argued that the app’s alleged ties to the Chinese government pose a national security threat.
Many TikTok creators have been telling their fans to find them on competing social platforms such as Google’s YouTube and Meta’s Facebook and Instagram, CNBC reported. Additionally, Instagram leaders scheduled meetings after the Jan. 10 Supreme Court hearing to direct workers to prepare for a wave of users if the court upholds the law.
Chinese social media app and TikTok look-alike RedNote rose to the top of Apple’s app store Monday, indicating that TikTok’s millions of users were seeking alternatives.
The Chinese government also weighed a contingency plan that would have X owner Elon Musk acquire TikTok’s U.S. operations as part of several options intended to keep the app from its effective ban in the U.S., Bloomberg News reported Monday.
Should ByteDance decide to sell TikTok to a U.S. company or group of investors, potential buyers may have to pay between $40 billion and $50 billion, according to an estimate by CFRA Research Senior Vice President Angelo Zino.
WATCH: SCOTUS hears TikTok ban case
Jakub Porzycki | Nurphoto | Getty Images
Bitcoin rejoined the crypto rally on Friday amid reports that President-elect Donald Trump could release an executive order making crypto a national priority as soon as day 1 of his new term.
The price of the flagship cryptocurrency was last higher by more than 2% at $103,174.90, according to Coin Metrics. The broader crypto market, as measured by the CoinDesk 20 index, was up another 1%, after a 4% increase Thursday.
Shares of exchange operators Coinbase and Robinhood advanced about 5% each. Trading activity in small cap cryptocurrencies benefits trading platforms. Appetite for smaller cap, higher risk coins has grown ahead of Trump’s inauguration, with litecoin surging 26% in the past two days.
The moves follow a Bloomberg report late Thursday that Trump could create the crypto advisory council he previously promised, giving the industry a voice within his administration. A bitcoin stockpile is part of discussions about a possible executive order that would cover several areas of crypto policy, the New York Times reported the same day.
Bitcoin trades above $100,000 ahead of Trump’s inauguration
Coins and crypto projects outside of bitcoin arguably stand to gain more from clear and supportive policy and regulation as they’ve been more of a target of SEC lawsuits and alleged banking discrimination under the Biden administration. Some investors say bitcoin could see a rocket ship rally, however, if a national stockpile or reserve is established.
Bitcoin has been trading closely with stocks so far this year. It’s been in consolidation mode since late December, when Federal Reserve chair Jerome Powell sounded an inflation alarm that subsided this week after two cool December inflation reports. Bitcoin ETFs have seen more than $1 billion in inflows in the past two days.
Investors expect any announcements from the incoming administration next week to send bitcoin higher – potentially to a new record. Heightened expectations come after warnings from Wall Street this month that although having a pro-crypto Congress and White House in 2025 is sure to be supportive for innovation in the industry and asset class, it could take a while before the market feels the impact.
“The new administration and a new SEC chairman opens the door for new opportunity in cryptocurrency innovation,” JPMorgan analyst Kenneth Worthington said in a note this week. However, he added, “we don’t see a next wave of cryptocurrency [exchange-traded product] launches as being meaningful for the crypto ecosystem given much smaller market capitalization of other tokens and far lower investor interest.”
Bitcoin’s record is $108,327.01, from Dec. 17. It’s up 9% in 2025.
-
Sports2 years ago‘Storybook stuff’: Inside the night Bryce Harper sent the Phillies to the World Series
-
Sports10 months agoStory injured on diving stop, exits Red Sox game
-
Sports1 year agoGame 1 of WS least-watched in recorded history
-
Sports2 years agoMLB Rank 2023: Ranking baseball’s top 100 players
-
Sports3 years ago
Team Europe easily wins 4th straight Laver Cup
-
Environment2 years agoJapan and South Korea have a lot at stake in a free and open South China Sea
-
Environment2 years agoGame-changing Lectric XPedition launched as affordable electric cargo bike
-
Business2 years agoBank of England’s extraordinary response to government policy is almost unthinkable | Ed Conway