Tough new EU cyber rules require banks to ramp up security — but many aren’t ready
Traffic_analyzer | Digitalvision Vectors | Getty Images
Tough new European Union regulations requiring banks to bolster their cybersecurity systems officially come into effect Friday — but many of the bloc’s financial services firms aren’t yet in full compliance with the rules.
The EU’s Digital Operational Resilience Act, or DORA, requires both financial services firms and their technology suppliers to strengthen their IT systems to ensure the industry is resilient in the event of a cyberattack or any other forms of disruption. It entered into effect on Jan. 17.
The penalties for breaches of the new legislation can be substantial. Financial services firms that fall foul of the new rules can face fines of up to 2% of annual global revenue. Individual managers could also be held liable for breaches and face sanctions of as much as 1 million euros ($1 million).
So far, the rate of compliance among financial services firms with the new rules has been mixed, according to Harvey Jang, chief privacy officer and deputy general counsel at IT giant Cisco.
“I think we’ve seen a mixed bag,” Jang told CNBC in an interview. “Of course, the more mature-stage companies are further along looking at this for at least a year — if not longer.”
“We’re really trying to build this compliance program, but it’s so complex. I think that’s the challenge. We saw this too with GDPR and other broad legislation that is subject to interpretation — what does it actually mean to comply? It means different things to different people,” he said.
This lack of a common understanding of what qualifies as robust compliance with DORA has in turn led many institutions to ramp up security standards to the level that they’re actually surpassing the “baseline” of what’s expected of most firms, Jang added.
Are financial institutions ready?
Under DORA, financial firms will be required to undertake rigorous IT risk and incident management, classification and reporting, operational resilience testing, intelligence sharing on cyber threats and vulnerabilities, and measures to manage third-party risks.
Firms will be also be required to conduct assessments of “concentration risk” related to the outsourcing of critical or important operational functions to external companies.
A Censuswide survey of 200 U.K. chief information security officers commissioned by Orange Cyberdefense, the cybersecurity division of French telecoms firm Orange, showed that 43% of financial institutions in Britain aren’t yet in full compliance with DORA.
That’s a concern because, even though the U.K. falls outside the European Union now, DORA applies to all financial entities operating within EU jurisdictions — even if they’re based outside the bloc.
“Whilst it is clear that DORA has no legal reach in the U.K., entities based here and operating or providing services to entities in the EU will be subject to the regulation,” Richard Lindsay, principal advisory consultant at Orange Cyberdefense, told CNBC.
He added that the main challenge for many financial institutions when it comes to achieving DORA compliance has been managing their critical third-party IT providers.
“Financial institutions operate within a multi-layered and hugely complex digital ecosystem,” Lindsay said. “Tracking and ensuring that all parts of this system evidentially comply with the relevant elements of DORA will require a new mindset, solutions and resources.”
Banks are also adding higher levels of scrutiny in their contract negotiations with tech suppliers due to DORA’s strict requirements, Jang said.
The Cisco chief privacy officer told CNBC that he thinks there is alignment when it comes to the principles and the spirit of the law. However, he added, “any legislation is a product of compromise and so, as they get more prescriptive, then it becomes challenging.”
“The principles we agree with, but any legislation is a product of compromise, and so as as they get more prescriptive, then it becomes challenging.”
Still, despite the challenges, the broad expectation among experts is that it won’t be long until banks and other financial institutions achieve compliance.
“Banks in Europe already comply with significant regulations which cover the majority of the areas that fall under DORA,” Fabio Colombo, EMEA financial services security lead at Accenture, told CNBC.
“As a result, financial services institutions already have mature governance and compliance capabilities in place, with existing incident reporting processes and solid ICT risk frameworks.”
Risks for IT suppliers
IT providers can also be fined under DORA. The rules threaten levies of as much as 1% of average daily worldwide revenue for up to six months.
“These sanctions are necessary,” Brian Fox, chief technology officer of software supply chain management firm Sonatype, told CNBC. “They are a powerful motivator, pushing leaders to take compliance and operational resilience more seriously than ever.”
Orange Cyberdefense’s Lindsay said there’s a risk longer term that financial services firms end up moving their critical security functions and services in-house.
“Advances in technology may allow financial institutions to move services back in-house, simplifying this aspect and reducing the risk of non-compliance,” he said.
“Either way, existing contracts will need to be updated to ensure compliance is contractually mandated and monitored between entity and provider,” Lindsay added.
Meanwhile, there are several other cybersecurity-focused regulations that organizations will have to come to terms, such as the Network and Information Security Directive 2, or NIS 2, and the Cyber Resilient Act. The former entered into force in October.
“As with any new regulation, there will certainly be a transitionary period as organisations adjust to new requirements and standards,” Sonatype’s Fox told CNBC. “This is the start of a long journey toward improving software security and resilience.”
The Sony Group Corp. logo displayed on a screen at the Combined Exhibition of Advanced Technologies (Ceatec) in Chiba, Japan, on Wednesday, Oct. 16, 2024.
Bloomberg | Bloomberg | Getty Images
Sony Group on Tuesday posted a stronger-than-expected rise in second-quarter operating profit and announced a share buyback of up to 100 billion Japanese yen ($648 million).
Here are Sony’s second-quarter results compared with LSEG SmartEstimates, which are weighted toward forecasts from analysts who are more consistently accurate:
- Revenue: 3.108 trillion Japanese yen ($20.14 billion) vs. 2.985 trillion yen expected
- Operating profit: 429 billion yen vs. 398.44 billion yen expected
Operating profit climbed 10% from a year earlier, while revenues were up 5%. Sony shares jumped more than 6% after the earnings release.
The Japanese technology giant raised its full-year outlook, expecting operating profit to climb by 100 billion yen, or 8% from its previous forecast, led by its imaging and sensing solutions and music segments. The company also lifted its annual revenue projection by 300 billion yen, or 3%, while trimming its estimated losses from U.S. tariffs to 50 billion yen from 70 billion yen.
While Sony has been affected by U.S. President Donald Trump’s global tariff regime launched in April, Tokyo reached a trade deal with Washington in July that lowered duties on Japanese exports to 15% from the 25% initially proposed. The reduced tariffs took effect Aug. 7.
Music and imaging boost
Profit from Sony’s music business increased 27.65% year over year to 115.4 billion yen, while operating profit from its imaging business jumped nearly 50% to 138.3 billion yen, making it the company’s most profitable segment in the quarter.
Sony’s imaging and sensing solutions segment develops and manufactures advanced semiconductor products for a wide range of applications, from smartphones to automotive and industrial systems.
The company also reported strong sales in its game and network services division, which houses its popular PlayStation home console brand. The segment represents Sony’s top revenue driver, but posted a decrease in profits in the September quarter, falling 13.26% to 120.4 billion yen.
Game and network services have performed well in recent quarters thanks to a shift to digital game purchases and the PlayStation Plus subscription service. Growth in hardware shipments has been comparably muted.
KPop Demon Hunters
Despite Sony’s strong earnings showing, profit from its picture business shrank nearly 25% year over year. That was despite Sony Pictures Animation being behind this year’s smash hit production, KPop Demon Hunters, which premiered on June 20.
The film, which was produced by Sony, has reportedly become the most popular Netflix film ever, and continues to break streaming records, even for its original soundtrack.
Despite the success, Sony has missed much of this upside due to selling the film’s exclusive rights to Netflix.
While the exact details of the deal are unknown, it was reported that Sony made an initial $25 million profit from producing the film for Netflix.
Netflix saw K-pop Demon Hunters drive significant viewership and even contributed to its 17% revenue jump in its September quarter.
However, in a bright spot for Sony, a sequel to the movie has already been confirmed, with Netflix reportedly providing the Japanese company a $15 million cash bonus for the first film’s performance.
Elon Musk, CEO of Tesla, speaks during the 2025 Annual Shareholder Meeting on Nov. 6, 2025.
Courtesy: Tesla
Tesla shareholders voted last week to give CEO Elon Musk a record pay package, one that could net him about $1 trillion in company stock over the next decade. But Musk received less support than he did for an earlier pay plan in 2018.
Setting aside holdings owned by board members and executives, about 66.9% of shares tabulated in the vote were in favor of the package, according to a filing on Friday. When shareholders voted on the 2018 plan, that number was 73%, according to an analysis by Andrew Droste, head of corporate governance at investment firm Columbia Threadneedle.
In announcing the preliminary results on Thursday at the company’s annual shareholders meeting, Tesla said the plan received 75% support among voting shares. The company count included insiders like Musk, who held around a 15% stake in Tesla going into the proxy and was allowed to vote his shares.
The decline from the prior vote follows a tumultuous stretch for Musk and Tesla. Sales slumped in the first half of the year, in part because of Musk’s inflammatory political rhetoric and his work for the Trump administration, slashing the size of the federal government. Tesla’s brand value has also deteriorated.
Still, Droste said in an email that even at just under 70%, the vote represents “broad support for Elon among Tesla’s shareholder base.” Most investors recognize that Tesla and Elon Musk are “inextricably linked,” he wrote, and were “unwilling to risk his potential departure by allowing this vote to fail.”
Board members recommended shareholders approve the pay plan, which they introduced in September. Top proxy advisors Glass Lewis and ISS had recommended that investors vote against it.
The pay package for Musk, already the world’s richest person, consists of 12 tranches of shares to be granted if Tesla hits certain milestones over the next decade. The first tranche of stock gets paid out if Tesla hits a market capitalization of $2 trillion, about $500 billion more than the current valuation. Awards tied to market cap gains are paired with operational achievements.
Musk could still collect more than $50 billion by hitting a handful of the more attainable goals laid out for him by the board in the new pay plan. There are also a list of “covered events” in the award terms that would allow him to earn his shares without meeting required operational milestones.
Tesla didn’t immediately respond to a request for comment.
Correction: A prior version of this story had an incorrect figure for the vote in support of the pay package.
Michael Intrator, co-founder and CEO of CoreWeave, speaks at the Semafor World Economy Summit during the International Monetary Fund and World Bank Spring meetings in Washington on April 25, 2025.
Kent Nishimura | Bloomberg | Getty Images
CoreWeave, a provider of infrastructure for artificial intelligence companies, reported better-than-expected third-quarter revenue on Monday, but the company delivered disappointing full-year guidance. The stock dropped 6% in extended trading.
Here’s how the company did in comparison with LSEG consensus:
- Earnings: Loss of 22 cents per share
- Revenue: $1.36 billion vs. $1.29 billion expected
Revenue in the quarter soared 134% from $583.9 million a year ago, according to a statement. The company reported a net loss of $110 million, narrowing from about $360 million in the same quarter last year.
CoreWeave’s growth is tied directly to the AI boom, as the company rents out Nvidia graphics processing units and has won business from leading cloud infrastructure providers, including Google and Microsoft. The company’s backlog now stands at $55.6 billion, with 2.9 gigawatts in contracted power, up from 2.2 gigawatts on June 30, according to the statement.
However, CoreWeave now sees 2025 revenue coming in between $5.05 billion and $5.15 billion, trailing the average analyst estimate of $5.29 billion, according to LSEG.
A third-party data center developer is behind schedule, CEO Mike Intrator said on the company’s earnings call. But he added that the delay won’t affect CoreWeave’s backlog.
“There was a problem at one data center that’s impacting us, but there are 32 data centers in our portfolio,” Intrator said.
During the quarter, CoreWeave announced a $6.5 billion expansion of its business with OpenAI and a six-year deal with Meta worth up to $14.2 billion. CoreWeave also received its sixth contract from “a leading hyperscaler.”
The company remains supply-constrained, Intrator said. The shortage is not in power but instead has to do with the availability of partly completed “powered-shell” data centers in which CoreWeave can set up its own equipment, he said.
Meanwhile, CoreWeave is building its own data center infrastructure from the ground up in Pennsylvania, he said.
“The overwhelming majority of the delay that you’re seeing should be taken care of within Q1 of next year.” Intrator said.
CoreWeave went public on the Nasdaq in March, selling shares at $40 each. On Monday the stock closed at $105.61, representing a 164% return. The Nasdaq has gained 32% over a similar period. CoreWeave shares slipped in extended trading on Monday.
Less than four months after its IPO, CoreWeave announced its intent to acquire data center infrastructure operator Core Scientific for $9 billion, but Core Scientific shareholders voted against the proposed deal.
CoreWeave’s 2026 capital expenditures should be “well in excess of double” the total for 2025, which will end up between $12 billion and $14 billion, said Nitin Agrawal, the company’s finance chief.
WATCH: Cramer’s Mad Dash: CoreWeave
-
Sports2 years agoStory injured on diving stop, exits Red Sox game
-
Sports3 years ago‘Storybook stuff’: Inside the night Bryce Harper sent the Phillies to the World Series
-
Sports2 years agoGame 1 of WS least-watched in recorded history
-
Sports3 years agoButton battles heat exhaustion in NASCAR debut
-
Sports3 years agoMLB Rank 2023: Ranking baseball’s top 100 players
-
Sports4 years ago
Team Europe easily wins 4th straight Laver Cup
-
Environment2 years agoJapan and South Korea have a lot at stake in a free and open South China Sea
-
Environment1 year agoHere are the best electric bikes you can buy at every price level in October 2024