How secure are UK Fintechs from Cyber Crime?

Should the UK adopt DORA?

Alex Speedie

February 10, 2025

In recent years, the European Union has introduced several cybersecurity regulations, including the Cyber Resilience Act, the EU AI Act, the Network and Information Systems Directive 2 (NIS2), and, most recently in 2023, the Digital Operational Resilience Act (DORA). These initiatives aim to enhance cybersecurity and digital resilience across the financial sector.

‍

Recent research from Orange Cyberdefence, surveying 200 UK CISOs and senior security decision-makers, highlights growing concerns about the divergence between UK and EU cybersecurity regulations. Notably, 74% of UK financial services cybersecurity professionals believe that the EU’s security framework is more effective than those of many other economic regions. Additional findings from the study indicate:

77% perceive inconsistencies in regulatory enforcement between the UK and EU.
74% believe confidence in UK regulations is declining.
72% worry that UK cybersecurity regulations are becoming less comprehensive.
76% feel that UK authorities, including government and regulatory bodies, do not provide sufficient guidance and support.

‍

These regulatory concerns are particularly relevant for Fintech firms, as financial institutions increasingly face cybersecurity vulnerabilities within their supply chains. In 2024, 58% of large UK financial services (FS) firms experienced at least one third-party supply chain attack. Despite this growing risk:

44% of FS institutions assess third-party risk only during the initial onboarding process.
41% conduct periodic risk assessments rather than continuous monitoring.
Only 14% adhere to best practices of ongoing third-party risk assessments.

‍

For Fintechs looking to partner with financial institutions, this presents a challenge. If their internal security protocols do not align with evolving FS standards, they risk exclusion from competitive procurement processes as financial institutions raise their security expectations.

‍

Reflecting these concerns, 92% of survey respondents support the adoption of a UK-wide regulation similar to DORA to enhance digital resilience in the financial sector.

‍

Although the UK is no longer part of the EU, the digital operational resilience framework established by DORA remains highly relevant for many UK organisations. Businesses with significant operations in the EU or those serving as critical technology providers to EU financial entities may still need to comply with DORA’s framework.

‍

That said, key distinctions exist between UK and EU regulations. UK cybersecurity regulations, including the NIS regulations and guidelines from the Financial Conduct Authority (FCA) and Prudential Regulation Authority (PRA), aim to maintain high digital security and operational resilience standards. However, DORA introduces a more prescriptive and harmonised framework, particularly in areas such as digital operational resilience testing and third-party oversight, whereas UK regulations tend to take a broader, more localised approach.

‍

Under DORA, financial institutions and service providers must implement a robust ICT risk management framework with continuous assessment and proactive mechanisms for prevention, detection, and mitigation. This is an ongoing requirement rather than a one-time initiative, with clear governance structures assigning responsibility at the senior management level.

‍

A key element of this framework is lifecycle management, ensuring that ICT assets are securely managed from procurement to decommissioning, preventing outdated systems from becoming security risks.

‍

Incident reporting and classification are also crucial. DORA mandates standardised processes for identifying and reporting major ICT incidents. Instead of ad hoc responses, firms must use predefined thresholds to classify incidents and submit reports to national authorities within strict timelines. Post-incident assessments help ensure that lessons learned are integrated into future strategies, mitigating regulatory and reputational risks.

‍

Additionally, financial institutions must conduct regular resilience testing, including threat-led penetration testing (TLPT) and scenario analysis. These tests go beyond standard system checks, simulating real-world cyberattacks to uncover vulnerabilities before they can be exploited. To maintain compliance, organisations must establish a formal testing governance structure, outlining testing frequency, methodologies, and reporting mechanisms.

‍

Third-party risk management is another key pillar of DORA. With financial institutions increasingly outsourcing ICT services, ensuring vendor security is critical. Organisations must assess risks before entering agreements, ensuring vendors meet resilience requirements. Contracts should include explicit clauses outlining service providers’ responsibilities, and ongoing monitoring mechanisms should be in place to track performance and address risks before they escalate.

‍

Finally, DORA promotes cross-border information sharing and crisis coordination. In an era of rapidly evolving cyber threats, access to real-time intelligence can determine whether a firm effectively mitigates an attack or suffers significant disruption. To enhance resilience, financial institutions are encouraged, and in some cases required, to participate in collaborative cybersecurity initiatives, exchanging threat intelligence and coordinating crisis response strategies.

‍

Should the UK choose to fully adopt a DORA-equivalent framework, implementation would likely require expanding cybersecurity teams within financial institutions and service providers. However, even without full adoption, Fintech firms seeking to expand into the EU should proactively align with DORA requirements. As regulatory enforcement increases, firms that fail to prepare risk falling behind in competitive procurement and partnership opportunities.

‍

With financial services increasingly targeted by cyber threats, resilience is no longer optional, it is a strategic necessity. Whether through formal adoption or indirect compliance, UK financial institutions and Fintech firms must recognise that DORA represents the new gold standard for digital operational resilience in the financial sector.

‍

At Rex Machina, we specialise in helping Fintech firms build and scale high-performing teams, ensuring they have the right talent to succeed across markets. Contact us to learn more about how we can support your growth objectives.

‍

Share this to your socials:

How secure are UK Fintechs from Cyber Crime?

sign up to our weekly newsletter