Executive Summary

The European Securities and Markets Authority (ESMA) has published its first report on major information and communication technology (ICT)-related incidents by financial entities, following the implementation of the Digital Operational Resilience Act (DORA). This report aims to assess the digital resilience of the European financial system and strengthen financial entities' response capabilities to cybersecurity threats. Through this report, ESMA reaffirms the importance of DORA compliance and plans to support financial entities in effectively managing ICT risks in the future.

Background and Context

While digitalization has accelerated and made financial services more convenient, it has also increased exposure to ICT-related risks such as cyberattacks and system failures. To address these threats and ensure the stability of the financial system, the European Union (EU) enacted the Digital Operational Resilience Act (DORA). DORA provides a comprehensive framework for how financial entities identify, manage, and report ICT risks, aiming to enhance their digital operational resilience. ESMA's first DORA incident report is a crucial step to analyze actual ICT incident cases and identify the status of regulatory compliance and areas for improvement. This aligns with ESMA's emphasis on enhanced supervision and innovation in its 2025 annual report, demonstrating regulators' proactive response to the digital transformation of financial markets.

Market Impact Analysis

ESMA's DORA-related report will remind domestic financial institutions and IT service companies operating in the European market or adhering to European regulatory standards of the importance of strengthening cybersecurity and digital resilience. Increased investment for DORA compliance can create new business opportunities for companies providing related solutions and services. For example, IT service companies like 018260:Samsung SDS can benefit by providing security solutions and cloud services tailored to the financial sector's demand for enhanced digital resilience. Conversely, non-compliance can lead to negative impacts such as fines and business restrictions. In the commodities market, strengthening financial system stability can positively influence overall economic sentiment, potentially easing some demand for safe-haven assets like GOLD. In the bond market, enhanced digital resilience in the European financial market can increase regional financial stability, boosting the credibility of European government bonds such as DE10Y and contributing to interest rate stabilization. In the virtual asset market, digital-related regulations like DORA can foster discussions on the security and operational resilience of virtual assets such as BTC and ETH, which could positively impact the institutionalization and trustworthiness of the virtual asset market.

Future Scenarios

ESMA's DORA incident report will prompt European financial entities to focus more on ICT risk management. In the future, ESMA may issue additional guidelines for DORA regulations based on the report's analysis or, if necessary, take measures to strengthen regulations. Korean financial companies and IT firms must closely monitor European DORA regulatory trends and increase investment in strengthening their own digital resilience and cybersecurity capabilities. This is essential for maintaining competitiveness in the global financial market and creating new business opportunities.