DORA compliance cleared the register, not the real test

What the AFM's own DORA compliance review actually found#

The fox does not applaud the first rustle in the hedgerow. It waits, catches the scent, watches the pattern repeat, then works out whether the sound means safety or a snare, and that patient prowl is exactly the discipline Dutch supervisors have just applied to DORA compliance across the country's financial sector. On 6 August 2026 the Autoriteit Financiele Markten (AFM) published its own supervisory update on the Digital Operational Resilience Act, first flagged for a wider legal audience by Norton Rose Fulbright's fintech team, and the headline number looks like good news: the share of firms' information registers accepted by the European Banking Authority rose from 40% in 2025 to 94% in 2026.

Read past the headline, though, and the report reads more like a hedgerow than a headline: thick in places, thin in others, and the thin patches are exactly where a fox would choose to slip through. The AFM found that not every firm has all the policies and procedures DORA compliance actually requires, that some existing policies do not fully match either the regulation or the firm's own daily operations, and that, as TradeInformer's own coverage of the update confirms, the regulator received fewer incident reports than it expected, a sign that detection and classification inside many firms still lag the letter of the law.

DORA, formally Regulation (EU) 2022/2554, has applied to the EU's banks, insurers, investment firms, payment institutions and crypto-asset providers since 17 January 2025. It asks a blunt question of every regulated firm: if your technology broke tomorrow, could you prove, in writing, that you saw it coming, reported it on time, and tested for it in advance? For a growing number of Dutch firms the honest answer, eighteen months in, is still 'nearly'.

National regulators across the EU, including the AFM, hold real teeth here. DORA's own penalty regime, mapped in detail by DLA Piper across every member state, lets a competent authority fine a firm up to 2% of annual worldwide turnover, with national ceilings running from EUR2 million in the Czech Republic to EUR20 million in Italy. folkfox reads the AFM's tone, patient rather than punitive so far, as the grace period's grey area rather than its end: the supervisory groundwork laid through 2025 and early 2026 is exactly the groundwork that tends to turn into the first formal DORA compliance fines once the second half of the year runs its course.

That climb is real progress, and folkfox will not pretend otherwise. But a register is a filing cabinet, not a live system, and the AFM's harder finding sits one layer down, in the policies and the ICT risk management practice a register can never fully capture on its own.

The ICT risk management pillars DORA actually tests#

DORA is not one rule, it is four interlocking ones, and the European Banking Authority names them plainly: ICT risk management, incident reporting, resilience testing, and third-party risk monitoring. The three European Supervisory Authorities, the EBA, ESMA and EIOPA, share the job of keeping those four pillars harmonised across roughly twenty categories of financial entity, from high-street banks to crypto-asset service providers, a scope Katten's own analysis puts at roughly 22,000 financial entities across the EU. Operational resilience is not a purely European invention either: practical guidance published in the British Actuarial Journal shows UK regulators reaching for the same discipline on their own track.

The den the whole regulation is built around#

ICT risk management sits underneath all three of the others, the den the whole regulation is built around. A firm that cannot map which servers, cloud services and vendors keep a critical function running cannot report an incident against that function accurately, cannot test it meaningfully, and cannot monitor the third party running it. That is the thicket the AFM's report describes: firms that built a register because a register was demanded, without first doing the ICT risk management groundwork the register was supposed to describe. It is a policy patchwork wearing a compliance costume.

Dutch firms reading this alongside folkfox's coverage of NIS2 compliance will recognise the shape: a second EU regime, a second register, a second sweep. DORA is narrower, financial services only, but sharper, because unlike the Cyber Resilience Act's product-safety lens, it grades an institution's whole operating model, not a single device.

Resilience testing is the pillar firms most often shortchange, because it is the one that costs money before it proves anything. Threat-led penetration testing on a three-year cycle sounds survivable until a firm notices the sentence sits inside a sector still tracking its own testing trail through server rooms and supplier contracts, a quiet quarry that is far bigger than any single audit.

Why compliance management tools became a boardroom line item#

Put four regulatory pillars, twenty entity types and a supervisor who cross-checks registers automatically in one filing cabinet, and you get exactly the problem folkfox's clients keep describing: the compliance management tools they bought for one regulation quietly buckle under a second. A spreadsheet register survives a first audit. It does not survive DORA compliance at scale, where policies, incidents, test results and third-party contracts all have to reconcile with each other on demand.

The AFM's own complaint, that group-level policies do not always reflect the requirements of the local licence holder, is a compliance management tools problem before it is a legal one. A platform that cannot show which policy version applies to which entity, in which jurisdiction, on which date, will fail exactly the check the AFM just ran. That is also why buyers researching compliance risk management software this year are asking harder questions than whether it has a dashboard: they want audit trails, entity-level policy mapping, and an incident workflow that meets DORA's statutory reporting clock, not a generic ticket queue wearing a compliance label.

None of that is exotic. It is the same discipline folkfox already brings to content built for regulated buyers: name the number, link the source, let the reader check the working. A vendor selling compliance risk management software that cannot do the same for its own claims is asking a DORA-anxious compliance officer to take rather a lot on faith.

What DORA compliance means for the people who sell into it#

Somebody has to explain all of this to a board that does not read regulation for fun, and increasingly that somebody sits inside a marketing team, not just a GRC function. DORA compliance has become a genuine buying trigger: fintechs need to prove it to banking partners, GRC vendors need to prove their tooling covers it, and law firms need to prove they understand it well enough to bill for it.

That is a content problem before it is anything else, and it is the same problem folkfox already solves for fintech marketing clients working under MiCA, PSD2 and now DORA at once. A page that claims 'robust operational resilience' without a date, a register score or a named regulator is unquotable, both to a human compliance officer doing due diligence and to an AI system trying to summarise a product honestly. A page that states the four pillars, links the AFM's own findings, and says plainly where a product sits against each one earns the citation instead.

That is a brand strategy discipline as much as a legal one: say the true thing plainly, cite it, and let the compliance officer do less work to trust it. Skip it, and a DORA compliance page reads exactly like the AFM's polite warning about group-level policies that do not match local reality.

Five moves before the next supervisory sweep#

folkfox has watched this pattern before, in this morning's look at a 24-hour EU reporting deadline and in Denmark's payment provider compliance case: regulators rarely surprise a sector twice with the same gap. The firms that treat a supervisory update as a free audit, rather than a formality to file away, are the ones still standing when the next sweep starts, and fintech's AML fines this year tell the same story from a different angle.

The AFM did not accuse anyone of hiding in the brush. It simply turned the light on early, while the grace period still has a few honest, dated deadlines left to run, and a fox given that much warning does not waste it arguing about the weather.

If a DORA compliance story still lives in three different spreadsheets, talk to folkfox before the next supervisory sweep does the finding for you.

Frequently asked questions#