More than a quarter of financial institutions across Europe plan to terminate at least one ICT service provider this year due to non-compliance with the Digital Operational Resilience Act (Dora), according to a new survey by PwC Luxembourg.
The report, Dora: Laying the Groundwork for Digital Resilience and Transformation, shows that 26 percent of financial firms expect to cut ties with at least one vendor in 2025, after 2 percent actually did so last year. An even larger group—68 percent—now require Dora compliance from any provider supporting critical functions. Another 17 percent have made DORA compliance mandatory for all ICT providers, regardless of the service.
“Dora is a catalyst for well-calibrated reinvention,” Olivier Carré, deputy managing partner and technology & transformation leader at PwC Luxembourg, said in a statement.
”We are seeing a growing number of financial institutions moving fast to use AI and risk quantification as tools to reduce costs and build smarter, resilient businesses. Dora is the lynchpin that undergirds this transformation.”
No longer seen as just compliance
The cybersecurity regulation, which became applicable in January, is no longer seen as just a compliance exercise. For many firms, it has become a driver of strategic change, reshaping how they manage vendors, assess risk, and structure ICT systems.
The pressure on ICT providers is mounting. Only 2 percent of firms say their ICT service providers are fully prepared for Dora. A majority of 58 percent said providers are only “somewhat prepared,” and 5 percent consider them unprepared altogether.
Dora’s growing influence is also reshaping vendor selection. Financial institutions expect longer onboarding processes and higher costs. 66 percent of respondents foresee ICT provider expenses rising between 6 and 15 percent over the next three years.
Most firms unprepared for AI
Despite high expectations for AI, most firms remain unprepared at the operational level, the survey also found. While 84 percent believe that failing to adopt AI and digital tools will harm their competitiveness within five years, few have the data management and Dora-aligned core processes in place to support this transformation.
A mere 12 percent reported having a well-designed data strategy, even though nearly half (49 percent) expect AI to reduce costs by at least 10 percent in the coming years. According to PWC, the gap between ambition and readiness highlights the risk of falling behind, not just on compliance but on innovation itself.
The survey was conducted in March of this year among financial firms across the European Economic Area. Some 23 percent of respondents were based in Luxembourg, followed by Ireland (18 percent), France (13 percent), and Germany (6 percent). Four percent of respondents were from the Netherland and 2 percent from Belgium.