The Digital Operational Resilience Act (DORA), which went into effect on January 17, 2025, is reshaping the regulatory landscape for financial institutions operating in the European Union. While an EU-specific regulation, its impact extends beyond Europe, particularly for firms also subject to the New York Department of Financial Services (NYDFS) cybersecurity regulations. Given the significant overlap between these frameworks, financial institutions must navigate the challenge of aligning compliance efforts across multiple jurisdictions.
For firms operating in both the U.S. and the EU, this means providing additional documentation to demonstrate compliance with both regulatory regimes. Below, we outline key areas where DORA and NYDFS intersect and diverge, highlighting their implications for financial institutions and the cyber insurance market.
Financial institutions are struggling to harmonize compliance efforts, creating new challenges and opportunities in the cyber insurance space. In response to this shifting regulatory environment, insurers are making adjustments to their underwriting and contemplating coverage restrictions. Large multinational financial institutions that must comply with both DORA and NYDFS, could experience lengthier underwriting cycles and increased due diligence requirements. Underwriters may scrutinize firms’ cybersecurity controls, third-party risk management programs and incident response plans more rigorously before offering coverage.
The cyber risk transfer strategies for financial institutions with global footprints could be impacted in meaningful ways. Firms with robust compliance programs may benefit from smoother renewals and more favorable terms, while those lagging behind could face longer underwriting cycles and higher premiums.
Further, WTW is monitoring whether insurers will soon require proof of DORA compliance before offering policies to financial institutions with European operations. This mirrors existing practices for NYDFS regulated entities, where insurers often demand evidence of cybersecurity preparedness before extending coverage. While this is not yet an industry-wide standard, it could become more prevalent, especially if the cyber insurance market hardens further due to increasing claims and regulatory enforcement actions.
Financial institutions that fail to meet these heightened expectations may find it more difficult to secure comprehensive cyber insurance coverage. Some insurers could impose restrictive terms or higher premiums on firms that lag in regulatory compliance, making it imperative for organizations to invest in robust resilience measures.
As insurers adjust to DORA, financial institutions may also see policy structures evolve with more exclusions or sublimits for regulatory non-compliance, making it even more critical for firms to fully understand their policy terms.
Endorsements explicitly addressing regulatory-related risks could become more common, potentially leading to gaps in coverage. DORA comes with strict requirements, and failing to meet them could lead to hefty fines and penalties.
Just as cyber insurers already exclude coverage for penalties related to GDPR violations, we may start seeing similar exclusions for DORA-related fines. If this happens, financial institutions could find themselves exposed to regulatory risks they previously assumed were covered.
To mitigate these risks, financial institutions should work closely with their brokers to review and negotiate policy terms, ensuring they have adequate protection against evolving regulatory requirements. Firms should also consider enhancing their risk management frameworks to align with both DORA and NYDFS, thereby improving their insurability.
What this means for our clients
For our clients, these regulatory shifts signal an evolving cyber insurance market that requires proactive risk management. Financial institutions with operations in both Europe and the U.S. should take immediate steps to assess their compliance posture and cyber insurance needs. To navigate this evolving landscape, financial institutions should:
By taking proactive steps now, financial institutions can mitigate regulatory risks, secure more comprehensive cyber insurance coverage and position themselves for success in an increasingly complex regulatory environment.
