While Ukraine's financial sector is fending off thousands of Kremlin cyberattacks every month, Europe has decided that the best defense is a new regulation. Meet DORA (Regulation (EU) 2022/2554), which since January 2025 has become an ironclad rule for EU financial institutions.
As our favorite saying goes, "not all sons are equal." Cybersecurity is no different: pre-war paper instructions from the NBU and ISO certificates are no longer enough. DORA represents an evolutionary shift in regulatory philosophy. Europeans are no longer interested in how much capital you have in the vault — they want to know whether your app will survive a destructive wiper attack like NotPetya or HermeticWiper hitting your server.
DORA operates as lex specialis, striking at five pillars of resilience: from ICT risk management to stringent incident reporting requirements (sometimes within 24 hours — not "sometime after victory"). The regulation has a particular fondness for your third-party providers. If you are a bank or payment institution using cloud services or IT outsourcing, prepare for fourth-party mapping. That means you must know even your subcontractor's subcontractor by name. Fail to do so — and face fines of up to 2% of annual turnover or personal warnings issued to management.
For Ukrainian banks already operating in conditions of real cyberwarfare, DORA is both a challenge and a jackpot. On one hand, our defense teams are trained daily against state-level attacks, giving them a head start over their European counterparts. On the other hand, our legislation remains decentralized, and without adapting contracts and integrating intelligence from the SSU or NBU, breaking into the EU single market will not be possible.
One option, of course, is to operate on the "we know better" principle and wait until foreign partners simply walk away due to compliance toxicity. The other is to conduct a professional audit of ICT processes.
So don't try to navigate the intricacies of Brussels' RTS and ITS technical standards on your own. Leave that work to the professionals at Dynasty Law & Investment. We will help you build an impenetrable financial fortress — so you can invest your time celebrating business victories rather than paying million-dollar fines.
