For years, how well a bank executed its digital transformation was, functionally, a private matter assessed by the board, reported to shareholders, occasionally mentioned in passing during an examination focused on other things. In Europe, that has changed, and the change is now explicit in how supervisors describe their own priorities.
European banking supervisors have said directly, in their own published risk assessments, that persisting challenges in the design and execution of banks’ digital transformation strategies remain a specific area of supervisory focus not a historical footnote, but an active line of inquiry. Combined with the Digital Operational Resilience Act, in force since January 2025, execution quality in Europe has moved from an internal management concern to something regulators actively examine.
What DORA Actually Requires, and Why It Changes the Execution Calculus
DORA’s core requirement is that financial institutions demonstrate operational resilience across their technology estate, during periods of active change. A transformation program underway is, by definition, a period of elevated technology risk: new systems being integrated, old systems being decommissioned, data migrating between platforms, and third-party vendors introduced into the operational chain. DORA requires banks to show that resilience is maintained, and demonstrable, throughout that process not just verified retroactively once the new system is stable.
This is a meaningfully different bar than most transformation programs were originally designed to meet. A program built around a go-live date and a post-launch stabilization period now also needs continuous, documented evidence of operational control at every stage in between tested rollback capability, third-party risk assessments for every vendor introduced, and incident response procedures that account for the transformation itself as a risk factor, not just the eventual production system.
The Gap This Creates for Programs Already in Flight
Institutions with transformation programs already underway when DORA came into force faced a specific, uncomfortable choice: retrofit governance and resilience documentation onto a program design that did not originally anticipate it, or accept that parts of the program would need to be redesigned to meet the new bar. Neither option is fast, and both illustrate precisely the governance debt pattern showing up across banking transformation more broadly, the cost of governance introduced late is always higher than the cost of governance designed in from the start, and DORA has made that cost explicit and regulatory rather than theoretical.
For programs launching now, the practical implication is straightforward, even if the execution is not: resilience and third-party risk documentation need to be built into the delivery plan from day one, reviewed continuously rather than at a single go-live gate, and owned by a function with the authority to slow the program down if the evidence is not there yet. Institutions treating this as a compliance checkbox appended at the end are, in effect, choosing to discover the gap at the worst possible time, during an examination, rather than during design.
Supervisory Attention Is a Leading Indicator, Not a Lagging One
The most useful way to read the supervisory commentary on persistent execution challenges is as a leading indicator rather than a historical assessment. Regulators do not typically flag a concern publicly unless they intend to examine it more closely going forward. European banks currently running, or planning, significant modernization or AI-driven transformation programs should expect execution quality not just the eventual outcome to be a specific focus of upcoming supervisory engagement, with the same rigor historically reserved for capital adequacy or credit risk.
This has a direct implication for how programs should be governed internally. A steering committee that reviews progress only against internal milestones and budget is no longer assessing the full risk picture. The more defensible governance model tracks the same evidence a supervisor would eventually ask for: documented decision rights, tested resilience at each stage, and a clear audit trail of how risk was assessed and managed throughout delivery, not just at completion.
What This Means Beyond Europe
European banks are, in effect, operating a few steps ahead of where transformation-specific regulatory scrutiny is heading more broadly. The OCC’s more risk-based examination approach for community banks, effective January 1, 2026 eflects a similar underlying logic. Active transformation programs treated as a period of elevated operational risk requiring documented governance, not just an eventual outcome to be judged after the fact. Institutions outside Europe building transformation governance models today have a genuine opportunity to look at what DORA has already required of European peers and build to that standard proactively, rather than waiting for a comparable mandate to arrive in their own jurisdiction and retrofitting under pressure, the way many European institutions were forced to.
The broader pattern holds across every region examined in this research: execution quality is becoming something supervisors actively assess, not something institutions self-report. Governance built to withstand that scrutiny from the start rather than assembled defensively once an examination is announced is no longer just good practice. In Europe, it is now the explicit price of admission for running a transformation program at all.
The UK Runs a Separate Clock, and It Has Already Struck Zero
It is worth being precise here, because the two regimes are often, and incorrectly, treated as interchangeable. DORA is an EU regulation. UK banks, following Brexit, are not in its scope. UK institutions instead answer to the Financial Conduct Authority and Prudential Regulation Authority directly, under a regime that predates DORA and has already passed its hard compliance deadline.
FCA Policy Statement PS21/3 and PRA Supervisory Statement SS1/21 required UK banks and other in-scope firms to identify every important business service, set board-approved impact tolerances for each one, and demonstrate, by 31 March 2025, that they can remain within those tolerances during a severe but plausible disruption. That transition period is over. The FCA has since published its own observations on where firms fell short, including inconsistent identification of important business services and gaps in third-party resilience testing, which gives UK institutions launching a transformation program today a documented benchmark of where peers commonly struggled.
For a UK CIO, the practical takeaway mirrors the European pattern above with one difference worth naming: this is not a future deadline to build toward. It is a live obligation a transformation program has to actively protect, meaning any workstream touching an important business service needs continuous evidence that the transformation itself is not pushing the institution outside its agreed tolerances while the work is underway, not just once the new system goes live.
Related reading:
- Why Most Banking Transformations Fail at Execution (pillar guide)
- Governance Debt: The Silent Killer of Banking Transformation Programs.
- Board-Ready: How to Report Transformation Execution Health to Regulators and the Board
Sources
- EU Digital Operational Resilience Act (DORA), in force since 17 January 2025 – European Commission / EIOPA.
- FCA Policy Statement PS21/3, Building Operational Resilience, and PRA Supervisory Statement SS1/21, compliance deadline 31 March 2025 – Financial Conduct Authority.
- Risk Assessment report 2025
- European banking supervisors have said directly, in their own published risk assessments
- Combined with the Digital Operational Resilience Act, in force since January 2025
- OCC’s more risk-based examination approach for community banks
FAQ
1. Are DORA and the UK’s operational resilience rules the same thing?
No. DORA is an EU regulation that does not apply to UK banks. UK banks answer to a separate regime under FCA Policy Statement PS21/3 and PRA Supervisory Statement SS1/21, which had its own compliance deadline of 31 March 2025, before DORA came into force in January 2025.
2. What does DORA actually require of a bank running a transformation program?
Demonstrable, continuous evidence of operational resilience throughout the transformation, not just verification after the new system is stable. That includes tested rollback capability, third-party risk assessments for every vendor introduced, and incident response procedures that treat the transformation itself as a risk factor.
3. Is UK regulatory scrutiny of transformation execution ahead of or behind the EU’s?
Ahead, in terms of enforcement timeline. UK firms are past their transition period and the FCA has already published findings on common gaps. EU firms are earlier in DORA’s supervisory cycle, though the direction of travel toward examining execution quality directly is the same in both jurisdictions.
