DORA supervision
Since 17 January 2025, our supervisory activities have consisted of conducting investigations, handling ICT incidents, processing the information register, and assessing licence applications.
DORA inspections
To determine whether firms comply with the requirements, both thematic inspections and institution-specific inspections will be carried out.
In a thematic inspection, several firms will be selected, and the focus will be on a specific topic within DORA. This may include, for example, an investigation into business continuity management or a review of contracts with ICT service providers.
During an institution-specific inspection, only one firm will be selected, and documentation relating to a particular DORA component will be requested (for example, ICT risk management or the testing of digital operational resilience). The scope of this type of investigation may vary between institutions. In both cases, the guiding principle remains risk-based and proportionate supervision. This means that the AFM will deploy its supervisory resources where the greatest risks are expected.
Notifications
A second component of our DORA supervision involves handling notifications submitted through the AFM portal. These may include major ICT incidents, cyber threats, and ICT outsourcing arrangements.
When we receive a notification, we assess it and determine the necessary follow-up actions based on the information provided. If the information submitted is insufficient, we will request additional information, and the firm will be required to provide supporting documentation. The information obtained from these notifications will primarily be used to gain insight into developments within the sector.
Licence applications
Since 1 August 2024, the AFM has assessed several DORA requirements as part of the licensing process. The purpose of this is to support firms in achieving timely compliance with DORA requirements.
As part of the licence application, the AFM reviews, among other things, the existence of specific policies and procedures that are mandatory under DORA. To be well prepared for the licensing process, firms may find it helpful to review in advance the DORA requirements with which they are expected to comply.
During the application process, board members are assessed on their level of knowledge and their ability to understand and evaluate ICT risks. DORA requires board members to possess these competencies themselves and to participate regularly in training programmes that enable them to manage ICT risks effectively.
TLPT
Firms selected for Threat-Led Penetration Testing (TLPT) will receive a notification from us once they have been designated, informing them that they are required to conduct a TLPT.
Subsequently, our test managers, in consultation with the firm, will determine the period during which the test must be carried out.
Throughout the preparation and execution phases, the test managers support the firm to ensure that the testing activities comply with the requirements set out in the Regulation and the Delegated Regulation. All reports that must be shared with the test managers as part of the testing process must be submitted through the DORA portal.
Upon successful completion of the test, the firm will receive an attestation demonstrating compliance with the TLPT requirements.