Business
Preparing for DORA compliance

Source: Finance Derivative
Fredrik Forslund, Vice President and General Manager International, Blancco
In January 2025, the Digital Operational Resilience Act (DORA) will come into force. This new European Union (EU) law is aimed at strengthening the cyber resilience of financial services organizations to help prevent any major IT disruptions in the future. Unlike the EU’s GDPR which added new requirements for businesses to ensure sufficient protection of personally identifiable information (PII), DORA focuses on the operational resilience of financial firms specifically, and their ability to withstand, respond to, and recover from cyber-attacks. Additionally, DORA regulates the third-party ICT service providers that financial entities use.
The entire financial services ecosystem will be impacted by DORA. Those that have not implemented the necessary changes to comply with it yet have very little time left to do so and run the risk of being fined up to 2% of their annual revenue. Every new regulation also brings its challenges and considerations for how to manage data and sensitive information. So, what should financial services organizations be paying close attention to both now and in the DORA era?
Straightening up posture
There’s no doubt that the Financial Services industry processes and stores some of the most sensitive information available. As a result, cybersecurity is a huge priority for many in this space. We’ve seen evidence with Mastercard’s acquisition of threat intelligence giant, Recorded Future earlier this year, along with the increasingly complex regulatory environment defining data privacy and security.
Yet one issue that still affects many financial services firms is the amount of data they store. While data is arguably the “lifeblood” of today’s businesses, storing too much of it creates more problems than it solves. It results in a wider attack surface and liability if there is a breach. When we spoke to banking and financial sector organizations around the world, we found that ‘data bloat’ remains a significant problem for the industry and this is only being exacerbated by the growth of the cloud. While starting digital transformation journeys is vital for maintaining a competitive edge, a worrying 67% of financial services professionals see the switch from analog to digital as increasing the amount of redundant, obsolete, or trivial (ROT) data collected.
To address this problem, organizations need to understand and comply with best practices for end-of-life (EOL) data disposal and recognize how this acts a foundational pillar of basic cyber hygiene. For example, it’s crucial organizations classify all data, so they know what data they hold and can determine when it reaches EOL. They also need to ensure this EOL data is properly sanitized and permanently erased – a process that will need to be approached differently in the cloud compared to on-premises. Not following data management best practices will ultimately lead to not only increased cybersecurity risk, but also could jeopardize compliance with GDPR and, in the not-too-distant future, DORA too.
Underlining third party risk
What does this new regulation really mean for organizations struggling with data management? One big focus of DORA is third-party risk and how businesses can control the chain of custody – not simply improving their own resilience but ensuring their supply chain remains secure at all times too.
Whenever a computer, hard-drive, server, or smart phone is changing hands (maybe a company is reselling, donating, or relocating equipment between different people) the chain of custody is not about the value of the asset but the sensitivity of the data that sits on it. In short, DORA will underscore third party risk analysis and interrogate whether financial services organizations are on top of how their IT assets are processed, how this processing is then audited, and who controls it to avoid human error and data loss.
DORA requirements include not just the identification and assessment of critical third-party service providers (assessing their criticality based on their impact on operations and the level of risk they may pose), but also the ongoing monitoring and oversight of these third parties (to ensue they comply with contractual requirements, manage risk and maintain resilience). Part of this will need to involve assessing their data security practices and should also include how they handle the EOL data. This means both erasing data when it reaches EOL, and securely decommissioning old assets that store this data. As part of a “vetting” process, organizations should be checking vendors can:
- Comply with various sanitization standards for EOL processes, including newer standards such as IEEE 2883 and ISO 27040.
- Provide EOL reporting to allow you to understand when and where data is erased.
- Showcase practices are for sending assets outside of the organization for repair, maintenance, and disposition – along with process for how back-ups are maintained and erased.
Auditable and automated
Third-party asset and data management is only one part of the puzzle. DORA also puts extra pressure on financial organizations to audit and automate their own asset management processes as part of the ‘Risk Management’ and ‘Resilience Testing’ regulatory pillars. How they manage assets at EOL needs to be extremely well documented. For example, if an organization has 1,000 laptops that they’re planning to replace, it’s vital to create a detailed report about how and when those devices were properly sanitized. This means there’s no uncertainty on whether there could be a data leak in the case one of those laptops is lost or stolen.
Importantly, this isn’t just a matter for the IT team. Data sanitization is a C-level requirement. While organizations will be utilizing all number of solutions to protect their data, they will need to conclude at some point that this data is beyond retention. There needs to be an understanding around when data reaches end of life, and an automated replacement of assets when this occurs. Technology today allows for financial services firms in London to automate remote sanitization in Singapore, for example. The documents and certificates that make up the supporting audit trail in these situations means the steps taken as part of a firm’s overall cybersecurity policy can never be questioned.
Finally, in the case of resilience testing – a key part of DORA compliance – data sanitization again needs to be considered. Take a test of data-backups as an example. After the exercise, in which data will have travelled from A to B, organizations need to consider their processes for then removing this data. Once again, erasure is vital alongside a verifiable audit trail to prove data management best practice is front of mind.
A lot of companies preparing for DORA haven’t always thought about their data lifecycle. But the reality is that in less than six months, financial services organizations need to be compliant with all five critical pillars of this regulation. Minimizing data bloat internally, along with assessing and interrogating third parties, and relying on automation and auditing will be vital not only for DORA compliance, but also for improving overall security posture in a world defined by data.
You may like
Business
What can the West learn from the Arabian Gulf’s payments revolution?

Hassan Zebdeh, Financial Crime Advisor at Eastnets
A decade ago, paying for coffee at a small café in Riyadh meant fumbling with cash – or, at best, handing over a plastic card. Today, locals casually wave smartphones over terminals, instantly settling the bill, splitting it among friends, and even transferring money abroad before their drink cools.
This seemingly trivial scene illustrates a profound truth: while the West debates incremental upgrades to ageing payment systems, the Arabian Gulf has leapfrogged straight into the future. As of late 2024, Saudi Arabia achieved a remarkable 98% adoption rate for contactless payments in face-to-face transactions, a significant leap from just 4% in 2017.
Align financial transformation with a bold national vision
One milestone that exemplifies the Gulf’s approach is Saudi Arabia’s launch of its first Swift Service Bureau. While not the first SSB worldwide, its presence in the Kingdom underscores a broader theme: rather than rely on piecemeal upgrades to older infrastructure, Saudi Arabia chose a proven yet modern route, aligned to Vision 2030, to unify international payment standards, enhance security, and reduce operational overhead.
And it matters, because in a region heavily reliant on expatriate workers whose steady stream of remittances powers whole economies. The stakes for frictionless cross-border transactions are unusually high. Rather than tinkering around the edges of an ageing system, Saudi Arabia opted for a bold and coherent solution, deliberately aligning national pride and purpose with practical financial innovation. It’s a reminder that infrastructure, at its best, doesn’t merely enable transactions; it reshapes how people imagine the future.
Make regulation a launchpad, not a bottleneck
Regulation often carries the reputation of an overprotective parent – necessary, perhaps, but tiresome, cautious to a fault, and prone to slowing progress rather than enabling it. It’s the bureaucratic equivalent of wrapping every new idea in bubble wrap and paperwork. Yet Bahrain has managed something rare: flipping the narrative entirely. Instead of acting solely as gatekeepers, Bahraini regulators decided to become collaborators. Their fintech sandbox isn’t merely a regulatory innovation; it’s psychological brilliance, transforming a potentially adversarial relationship into a partnership
Within this curated environment, fintech firms have launched practical experiments with striking results. Take Tarabut Gateway, which pioneered open banking APIs, reshaping how banks and customers interact. Rain, a cryptocurrency exchange, tested compliance frameworks safely, quickly becoming one of the Gulf’s trusted crypto players. Elsewhere, startups trialled AI-driven identity verification and seamless cross-border payments, all under the watchful yet adaptive guidance of Bahraini regulators. Successes were rapidly scaled; failures offered immediate lessons, free from damaging legal fallout. Bahrain proves regulation, thoughtfully applied, can genuinely empower innovation rather than restrict it.
Prioritise cross-border interoperability and unified standards
Cross-border payments have long been a maddening puzzle – expensive, sluggish, and unpredictably complicated. Most Western banks seem resigned to this reality, treating the spaghetti-like mess of correspondent banking relationships as a necessary evil. Yet Gulf states looked at this same complexity and saw not just inconvenience, but opportunity. Instead of battling against the tide, they cleverly redirected it, embracing standards like ISO 20022, which neatly streamline data exchange and slash friction from global transactions.
Examples abound: Saudi Arabia’s adoption of ISO 20022 through its Swift Service Bureau will notably accelerated cross-border transactions and improve transparency. The UAE and Saudi Arabia also jointly piloted Project Aber, a digital currency initiative that significantly reduced settlement times for interbank payments. Similarly, Bahrain’s collaboration with fintechs has simplified previously burdensome remittance processes, reducing both cost and complexity.
Target digital ecosystems for financial inclusion
One of the most intriguing elements of the Gulf’s payments transformation is the speed and enthusiasm with which consumers embraced new technologies. In Bahrain, mobile wallet payments surged by 196% in 2021, contributing to a nearly 50% year-over-year increase in digital payment volumes. Similarly, Saudi Arabia experienced a near tripling of mobile payment volumes in the same year, with mobile transactions accounting for 35% of all payments.
The West, by contrast, still struggles with financial inclusion. In the U.S., millions remain unbanked or underbanked, held back by distrust, geographic isolation, and high fees. Digital solutions exist, but widespread adoption has lagged, partly because major institutions view inclusion as a long-term aspiration rather than an immediate priority. The Gulf shows that when digital tools are made integral to daily life, rather than optional extras, the barriers to financial inclusion quickly dissolve.
The road ahead
As the Gulf region continues to refine its payment systems experimenting with digital currencies, advanced data protection laws, and AI-driven compliance the ripple effects will be felt far beyond the GCC. Western players can treat these developments as an external threat or as a chance to rejuvenate their own approaches.
Ultimately, if you want a glimpse of where financial services may be headed towards integrated platforms, real-time international transactions, and widespread digital inclusion – the Gulf experience is a prime example of what’s possible. The question is whether other markets will step up, follow suit, and even surpass these achievements. With global financial landscapes evolving at record speed, hesitation carries its own risks. The Arabian Gulf has shown that bold bets can pay off; perhaps that’s the most enduring lesson for the West.
Business
Unlocking business growth with efficient finance operations

Rob Israch, President at Tipalti
The UK economy has faced a turbulent couple of years, meaning now more than ever, businesses need to stay agile. With Reeves’s national insurance hikes now fully in play and global trade tensions casting a shadow over the landscape, the coming months will present a crucial opportunity for businesses to decide how to best move forward.
That said, it’s not all doom and gloom. The latest official figures show that the UK’s economy unexpectedly grew at a rate of 0.5% in February – a welcome sign of resilience. But turning this momentum into sustainable growth will hinge on effective financial management – essential for long term success.
Although many are currently prioritising stability, sustainable growth is still within reach with the right approach. By making use of data and insights from the finance team, companies can pinpoint efficient paths to expansion. However, this relies on having real-time information at their fingertips to support agile, well-timed decisions.
While achieving growth may be tough to come by this year, businesses can stay on track by adopting a few essential strategies.
Improving efficiency by eliminating finance bottlenecks
Growth is the ultimate goal for any business, but it must be managed carefully to ensure long-term sustainability. Uncertain times present an opportunity to eliminate inefficiencies and build a strong foundation for future success.
A significant bottleneck for many businesses is the finance function’s reliance on manual processes for invoice processing, reporting and reconciliation. These tasks are not only time-consuming but also introduce errors, delays and inefficiencies. As a result, finance teams become stretched thin. Our recent survey found that, on average, over half (51%) of accounts payable time is spent on manual tasks – severely limiting finance leaders’ ability to drive strategic growth.
Repetitive tasks such as data entry, reconciliation, and approvals require considerable time and effort, slowing down decision-making and increasing the risk of inaccuracies. Given the critical role that finance plays in guiding business strategy, these inefficiencies and errors create significant roadblocks to growth.
The pressure on finance leaders is therefore immense and while 71% of UK business leaders believe CFOs should take a central role in corporate growth initiatives, they are simply lost in a sea of manual processes and number crunching. In fact, 82% of finance leaders admit that excessive manual finance processes are hindering their organisation’s growth plans for the year ahead. To remedy this, businesses must embrace automation.
Achieving sustainable growth with automation
By replacing manual spreadsheets with automated solutions, finance teams can eliminate administrative burdens and focus on strategic initiatives. Automation simplifies critical finance tasks like bank feeds, coding bookkeeping transactions and invoice matching. Beyond this, it can also help alleviate the strain of more complex and time-intensive responsibilities, including tax filings, invoices and payroll.
The benefits of automation extend far beyond time saving, to accuracy, improving business visibility and enabling real-time financial insights. With fewer errors and faster-data processing, finance leaders can shift their focus to high-value tasks like driving strategy, identifying risks and opportunities and determining the optimal timing for growth investments.
Attracting investors with operational efficiency
Once businesses have minimised time spent on administrative tasks, they can focus on the bigger picture: growth and securing investment. With access to cheap capital becoming increasingly difficult, businesses must position themselves wisely to attract funding.
Investors favour lean, efficient companies, so demonstrating that a business can achieve more with fewer resources signals a commitment to financial prudence and sustainability. By embracing automation, companies can showcase their ability to manage operations efficiently, instilling confidence that any new investment will be spent and used wisely.
Economic uncertainty provides an opportunity to reassess business foundations and create more agile operations. Refining workflows and eliminating bottlenecks not only improves performance but also strengthens investor confidence by demonstrating a long-term commitment to financial health.
Additionally, strong financial reporting and effective cash flow management are crucial to standing out to investors. Clear, real-time insights into financial health demonstrate resilience and highlight a business’ resilience and readiness for growth.
The growth journey ahead
Though the landscape remains tough for UK businesses, sustainable growth is still achievable with a clear and focused strategy. By empowering finance leaders to step into more strategic and high-level decision making roles, organisations can stay resilient and agile amid ongoing economic headwinds.
UK businesses have fought to stay afloat, so now is the time to rebuild strength. By embracing more strategic financial management to build resilience, they can set the stage for long-term, sustainable growth, whatever the economic climate brings.
Business
The Consortium Conundrum: Debunking Modern Fraud Prevention Myths

By Husnain Bajwa, SVP of Product, Risk Solutions, SEON
As digital threats escalate, businesses are desperately seeking comprehensive solutions to counteract the growing complexity and sophistication of evolving fraud vectors. The latest industry trend – consortium data sharing – promises a revolutionary approach to fraud prevention, where organisations combine their data to strengthen fraud defences.
It’s understandable how the consortium data model presents an appealing narrative of collective intelligence: by pooling fraud insights across multiple organisations, businesses hope to create an omniscient network capable of instantaneously detecting and preventing fraudulent activities.
And this approach seems intuitive – more data should translate to better protection. However, the reality of data sharing is far more complex and fundamentally flawed. Overlooked hurdles reveal significant structural limitations that undermine the effectiveness of consortium strategies, preventing this approach from fulfilling its potential to safeguard against fraud. Here are several key misconceptions about how consortium approaches fail to deliver promised benefits.
Fallacy of Scale Without Quality
One of the most persistent myths in fraud prevention mirrors the trope of enhancing a low-resolution image to reveal more explicit details. There’s a pervasive belief that massive volumes of consortium data can reveal insights not present in any of the original signals. However, this represents a fundamental misunderstanding of information theory and data analysis.
To protect participant privacy, consortium approaches strip away critical information elements relevant to fraud detection. This includes precise identifiers, nuanced temporal sequences and essential contextual metadata. Through the loss of granular signal fidelity required to anonymise information to make data sharing viable, said processes skew data while eroding its quality and reliability. The result is a sanitised dataset that bears little resemblance to the rich, complex information needed for effective fraud prevention. Further, embedded reporting biases from different entities can likewise exacerbate quality issues. Knowing where data comes from is imperative, and consortium data frequently lacks freshness and provenance.
Competitive Distortion is a Problem
Competitive dynamics can impact the efficacy of shared data strategies. Businesses today operate in competitive environments marked by inherent conflicts, where companies have strategic reasons to restrict their information sharing. The selective reporting of fraud cases, intentional delays in sharing emerging fraud patterns and strategic obfuscation of crucial insights can lead to a “tragedy of the commons” situation, where individual organisational interests systematically degrade the potential of consortium information sharing for the collective benefit.
Moreover, when direct competitors share data, organisations often limit their contributions to non-sensitive fraud cases or withhold high-value signals that reduce the effectiveness of the consortium dynamics.
Anonymisation’s Hidden Costs
Consortiums are compelled to aggressively anonymise data to sidestep the legal and ethical concerns of operating akin to de facto credit reporting agencies. This anonymisation process encompasses removing precise identifiers, truncating temporal sequences, coarsening behavioural patterns, eliminating cross-entity relationships and reducing contextual signals. Such extensive modifications limit the data’s utility for fraud detection by obscuring the details necessary for identifying and analysing nuanced fraudulent activities.
These anonymisation efforts, needed to preserve privacy, also mean that vital contextual information is lost, significantly hampering the ability to detect fraud trends over time and diluting the effectiveness of such data. This overall reduction in data utility illustrates the profound trade-offs required to balance privacy concerns with effective fraud detection.
The Problem of Lost Provenance
In the critical frameworks of DIKA (Data, Information, Knowledge, Action) and OODA (Observe, Orient, Decide, Act), data provenance is essential for validating information quality, understanding contextual relevance, assessing temporal applicability, determining confidence levels and guiding action selection. However, once data provenance is lost through consortium sharing, it is irrecoverable, leading to a permanent degradation in decision quality.
This loss of provenance becomes even more critical at the moment of decision-making. Without the ability to verify the freshness of data, assess the reliability of its sources or understand the context in which it was collected, decision-makers are left with limited visibility into preprocessing steps and a reduced confidence in their signal interpretation. These constraints hinder the effectiveness of fraud detection efforts, as the underlying data lacks the necessary clarity for precise and timely decision-making.
The Realities of Fraud Detection Techniques
Modern fraud prevention hinges on well-established analytical techniques such as rule-based pattern matching, supervised classification, anomaly detection, network analysis and temporal sequence modelling. These methods underscore a critical principle in fraud detection: the signal quality far outweighs the data volume. High-quality, context-rich data enhances the effectiveness of these techniques, enabling more accurate and dynamic responses to potential fraud.
Despite the rapid advancements in machine learning (ML) and data science, the fundamental constraints of fraud detection remain unchanged. The effectiveness of advanced ML models is still heavily dependent on the quality of data, the intricacy of feature engineering, the interpretability of models and adherence to regulatory compliance and operational constraints. No degree of algorithmic sophistication can compensate for fundamental data limitations.
As a result, the core of effective fraud detection continues to rely more on the precision and context of data rather than sheer quantity. This reality shapes the strategic focus of fraud prevention efforts, prioritising data integrity and actionable insights over expansive but less actionable data sets.
Evolving Into Trust & Safety: The Imperative for High-Quality Data
As the scope of fraud prevention broadens into the more encompassing field of trust and safety, the requirements for effective management become more complex. New demands, such as end-to-end activity tracking, cross-domain risk assessment, behavioural pattern analysis, intent determination and impact evaluation, all rely heavily on the quality and provenance of data.
In trust and safety operations, maintaining clear audit trails, ensuring source verification, preserving data context, assessing actions’ impact, and justifying decisions become paramount.
However, the nature of consortium data, which is anonymised and decontextualised to protect privacy and meet regulatory standards, cannot fundamentally support clear audit trails, ensure source verification, preserve data context, and readily assess the impact of actions to justify decisions. These limitations showcase the critical need for organisations to develop their own rich, contextually detailed datasets that retain provenance and can be directly applied to operational needs to ensure that trust and safety measures are comprehensive, effectively targeted, and relevant.
Rethinking Data Strategies
While consortium data sharing offers a compelling vision, its execution is fraught with challenges that diminish its practical utility. Fundamental limitations such as data quality concerns, competitive dynamics, privacy requirements and the critical need for provenance preservation undermine the effectiveness of such collaborative efforts. Instead of relying on massive, shared datasets of uncertain quality, organisations should pivot toward cultivating their own high-quality internal datasets.
The future of effective fraud prevention lies not in the quantity of shared data but in the quality of proprietary, context-rich data with clear provenance and direct operational relevance. By building and maintaining high-quality datasets, organisations can create a more resilient and effective fraud prevention framework tailored to their specific operational needs and challenges.

What can the West learn from the Arabian Gulf’s payments revolution?

Unlocking business growth with efficient finance operations

The Consortium Conundrum: Debunking Modern Fraud Prevention Myths

Stealthy Malware: How Does it Work and How Should Enterprises Mitigate It?

Future-proofing the workforce for AI innovations with continuous learning
