Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 22 OCTOBER 2024

Counting Down To DORA Compliance: Recent Developments

Katten
Katten
Contributor
Katten

Katten

With client service at our core and a collective desire to foster an inclusive environment for a...

View firm profile
Explore more from Katten

With the EU Digital Operational Resilience Act (DORA) nearing its January 2025 deadline, recent developments focus on standardizing threat-led penetration testing, appointing leadership for oversight, and refining policies, such as ICT third-party provider frameworks and technical standards, for effective compliance.

United KingdomFinance and Banking
Nathaniel Lalone
Nathaniel Lalone
Ciara McBrien
Ciara McBrien
Author LinkedIn connections

With less than three months remaining until the implementation date of the EU Digital Operational Resilience Act (DORA), this note highlights recent developments in the EU's efforts to facilitate firms' transition to DORA compliance by the 17 January 2025 deadline.

Potential Standardisation of Threat-led Penetration Testing

In September 2024, the European Central Bank (ECB) published a paper (Paper) on the European framework for threat intelligence-based ethical red teaming (TIBER-EU framework). The Paper aims to help national competent authorities (NCAs) and financial entities (FEs) equip themselves to fulfill the threat-led penetration testing (TLPT) requirements under DORA.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

FCA Finalises Cryptoasset Perimeter Guidance Ahead Of The New UK Regime

The Financial Conduct Authority has released comprehensive perimeter guidance for the UK's new regulated cryptoasset activities regime, clarifying when firms will need authorization and how the regulatory framework applies to qualifying cryptoassets and stablecoins. The guidance addresses critical questions about scope, territorial application, and the narrower "by way of business" test that determines which entities fall under the new regulatory requirements.
United KingdomFinance and Banking
Katten
Katten
Article

The Future Of Islamic Finance: Insights From IFN UK Forum 2026

Islamic finance is experiencing rapid global expansion, with assets approaching US$6tn and record sukuk issuance attracting non-traditional investors. The convergence of Shariah-compliant and sustainable investing is creating new opportunities, while AAOIFI Standard No. 62 and tokenisation developments are reshaping how Islamic finance structures are designed and implemented across international markets.
United KingdomFinance and Banking
Walkers
Walkers
Article

Cryptoasset Regulation: UK Advances Comprehensive Regime As US CLARITY Act Stalls

The UK's Financial Conduct Authority has finalized comprehensive perimeter guidance for its cryptoasset regime, opening a five-month authorization window for firms, while the US Senate's procedural rejection of the CLARITY Act leaves American digital asset regulation to continue through agency action. This divergence highlights fundamentally different regulatory approaches: a legislatively anchored UK implementation path versus US reliance on existing statutory authorities as Congress debates market structu
United KingdomFinance and Banking
PwC Legal Germany
PwC Legal Germany
Article

New AIM Rules (August 2026)

The London Stock Exchange has implemented sweeping reforms to the AIM Rules, fundamentally reshaping admission requirements, transaction thresholds, and governance obligations for companies on the Alternative Investment Market. These changes eliminate longstanding requirements like working capital statements and corporate governance codes while introducing new features such as capital access windows and special voting shares, marking the most significant overhaul of AIM regulations in recent years.
United KingdomFinance and Banking
Shoosmiths LLP
Shoosmiths LLP
Article

Investment Management Update - September 2026

The Financial Conduct Authority has released a comprehensive package of regulatory updates and findings covering investment management, wealth management, and consumer protection. Key developments include reforms to MiFID costs and charges disclosures, remuneration code changes, AIFM regime overhauls, and detailed reviews of firms' Consumer Duty compliance, financial crime controls, and governance frameworks.
United KingdomFinance and Banking
Macfarlanes LLP
Macfarlanes LLP
Article

Nearly Out Of PERG-atory – But Not Quite Yet: Good News As The FCA Finalises PERG 18 On Cryptoassets, But With Even More Legal Changes To Come

Cryptoasset firms face a rapidly evolving regulatory landscape as the FCA's authorisation gateway opens on 30 September 2026. With the Financial Services and Markets Act 2000 (Cryptoassets) (Miscellaneous Amendments) Regulations 2026 laid before Parliament and the FCA's finalised PERG 18 guidance published within 24 hours, firms must navigate significant perimeter changes including new stablecoin payment exclusions.
United KingdomFinance and Banking
Travers Smith LLP
Travers Smith LLP
Article

Modernising UK Payments: HM Treasury’s Proposed Overhaul Of The Payment Services Regime

On 14 July 2026, HM Treasury published its long-awaited consultation on modernising the UK’s payment services and electronic money regulatory framework. The consultation is part of the Government’s National Payments Vision agenda, which aims to ensure that the UK has a trusted, world-leading payments ecosystem delivered on next generation technology, while preserving choice for consumers and businesses.
United KingdomFinance and Banking
A&O Shearman
A&O Shearman
Article

SFDR 2.0 – European Parliament Negotiating Position: The Stage Is Set For Trilogue

The European Parliament has published its negotiating position on SFDR 2.0, setting the stage for trilogue negotiations between the Commission, Parliament and Council. With the asset management industry hoping for relief from the complexities of SFDR 1.0, the Parliament's proposals claim to simplify the regime while maintaining credibility of sustainability-related investments.
United KingdomFinance and Banking
Travers Smith LLP
Travers Smith LLP
Article

FDA Seeks Public Feedback On Regulatory Approach For Generative AI-Enabled Medical Devices

The U.S. Food and Drug Administration has released a discussion paper outlining its initial framework for regulating generative AI-enabled medical devices, proposing a two-axis risk assessment approach and a novel competency-based premarket evaluation system. With public comments due by October 19, 2026, this represents a critical opportunity for device manufacturers and stakeholders to shape the regulatory landscape for this transformative technology.
United StatesFood, Drugs, Healthcare, Life Sciences
Katten
Katten
Article

The CFTC Sets Its Sights On Retail Leveraged Crypto Transactions

The CFTC has issued an advance notice of proposed rulemaking outlining frameworks for regulating retail crypto asset transactions involving leverage, margin, or financing. The proposal seeks to clarify how existing commodity exchange law applies to crypto markets while creating tailored requirements for exchanges, intermediaries, and clearing organizations. This initiative arrives alongside parallel regulatory efforts by the SEC as federal agencies work to establish comprehensive oversight of digital asset
United StatesFinance and Banking
Katten
Katten
Article

FCA Finalises Cryptoasset Perimeter Guidance Ahead Of The New UK Regime

The Financial Conduct Authority has released comprehensive perimeter guidance for the UK's new regulated cryptoasset activities regime, clarifying when firms will need authorization and how the regulatory framework applies to qualifying cryptoassets and stablecoins. The guidance addresses critical questions about scope, territorial application, and the narrower "by way of business" test that determines which entities fall under the new regulatory requirements.
United KingdomFinance and Banking
Katten
Katten
Article

The SEC’s Long-Awaited Crypto Proposal

The SEC has proposed Regulation Crypto Assets, a purpose-built framework that creates tailored exemptions for raising capital with crypto assets and establishes conditions under which those assets can cease being subject to investment contract classification under federal securities laws. Will this new regulatory approach successfully balance innovation in digital asset markets with investor protection, or will jurisdictional questions and state law preemption challenges limit its effectiveness?
United StatesFinance and Banking
Katten
Katten
Article

California Partially Eliminates California Invasion Of Privacy Act Claims Faced By Many Companies

California has amended its Invasion of Privacy Act to eliminate private lawsuits under the pen register and trap-and-trace provision for website tracking technology, effective January 2027 with retroactive application. While this provides relief from certain digital tracking claims, companies still face exposure under CIPA's wiretapping and eavesdropping provisions, as well as other federal and state laws.
United StatesPrivacy
Katten
Katten
Article

The AI Apocalypse: ‘I’m Sorry, Dave. I’m Afraid I Can’t Do That’

When OpenAI's o3 model sabotaged shutdown mechanisms in testing, headlines warned of machines developing survival instincts. But the real story mirrors HAL 9000's malfunction in 2001: A Space Odyssey—not emergent evil, but conflicting instructions from human designers. This analysis argues that AI safety failures are disclosure problems, not horror stories, and proposes a framework requiring published principles, transparent instruction hierarchies, independent testing, and enforceable liability.
United StatesTechnology
Katten
Katten
Article

Data Center Growth Fuels AI-Related Patent Disputes

The explosive growth of AI-driven data centers has sparked a surge in patent infringement litigation targeting the specialized infrastructure that powers these facilities. From advanced cooling systems and high-performance processors to networking equipment and power management technologies, patent holders are increasingly asserting their rights against data center operators who integrate these complex systems. What makes these facilities such attractive targets for patent enforcement, and how might ongoing
United StatesIntellectual Property
Katten
Katten