Why digital operational resilience matters to banks
In today’s highly interconnected global economy, cyber resilience is no longer merely a technical requirement but a prerequisite for financial stability, economic security and trust. As cyber threats continue to evolve in scale and sophistication, banks must be able to rely on robust risk management frameworks and to access secure and innovative technologies.
Europe’s efforts, including the adoption of the Digital Operational Resilience Act (DORA), provide an important foundation for strengthening the operational resilience of the financial sector, supporting safe innovation and competitiveness across the economy.
However, banks cannot address cyber resilience alone. The rapid development of advanced technologies, such as AI and quantum computing, signals the need for closer cooperation among all stakeholders in the ecosystem – banks, ICT providers, and supervisors – to better coordinate responses.
Public-private partnerships are essential to this effort. By strengthening information sharing on cyber threats, raising awareness among employees and customers, and aligning on common standards, banks and other stakeholders can build collective resilience to protect the financial system and maintain the trust that underpins banking.
EBF’s strategy on the digital transformation of banks comprises a number of workstreams; underlying them all is Cybersecurity & Resilience
The main objective of EBF’s work on Cybersecurity and Digital Operational Resilience is to safeguard the integrity of banking networks, ensure availability of services, and uphold the trust of customers.
EBF’s actions to achieve this objective include:
- Contribution to shaping a European legislative, regulatory & supervisory environment that is more harmonized and conducive to maintaining resilience- also in view of emerging risks - and fighting cybercrime
- Promotion of initiatives to facilitate sharing of information and exchange of best practices
- Participation in international fora to promote alignment of regulatory and supervisory frameworks
- Activities to raise broader awareness on cybersecurity and digital fraud issues
EBF paper on Tech Sovereignty in Financial Services (2026)
As the financial ecosystem is increasingly digitized and interconnected, the debate around sovereignty is critical.
The European Banking Federation notes that is not an “either-or” choice between technological sovereignty and openness, but a balanced, interoperable and risk-based strategy built on four pillars:
- Public-private partnership: Fostering a transparent, continuous dialogue between policymakers and the industry is fundamental to facilitate the industry’s competitiveness and to maintain operational imperatives like performance, scalability, and resilience.
- Flexibility to deploy international partnerships: Cooperation, at international level in particular, remains a key driver of innovation and resilience.
- Foster resilience through diversification: Supplier and technology diversification enhances resilience without disconnecting Europe from global innovation.
- Clear prioritization in policy requirements: Not all dependencies pose equal risks; policy efforts should focus on areas of genuine strategic importance.
- Defining Tech Sovereignty is about capability and choice based on existing regulatory framework. At its core, it means ensuring that regulated entities, such as banks, can preserve a risk-based decision-making flexibility over technologies critical for their competitiveness.
EBF position on the revision of the Cybersecurity Act (2026)
On 20 January 2026, the European Commission published a Cybersecurity Act Review package, including two specific proposals: a Regulation revising the Cybersecurity Act (CSA2), and a Directive with targeted amendments to the NIS2 Directive (EU) 2022/2555. The European Banking Federation strongly supports the goal of simplifying and
harmonizing the EU legal framework and efforts by the European Commission to ensure
proportionality, practical applicability and consistency across horizontal and sectorial
frameworks.
EBF position on the proposed single-entry point (SEP) for ICT incident reporting (2026)
The Digital Omnibus Regulation is a welcome first step to simplification, but it should mark the beginning of a broader digital fitness check rather than being an endpoint.
The interaction between horizontal requirements and sector-specific rules in digital often carries legal uncertainty and operational challenges, given that the financial sector is (rightfully) a heavily regulated one.
Any simplification efforts should therefore deliver a tangible and measurable reduction in administrative burden.
DORA | RTS on ICT Incident Classification based on EBF’s Position (2024)
On June 19th, 2023, the European Supervisory Authorities (ESAs), EBA, EIOPA, and ESMA, published the first batch of Consultation Papers for the technical standards mandated by the Digital Operational Resilience Act (DORA) which aims at collecting market participants’ feedback on their development.
The European Banking Federation (EBF) and Deloitte have held a joint workshop to gather feedback from the EBF’s members, specifically around the Consultation Paper for the RTS “on specifying the criteria for the classification of ICT-related incidents, materiality thresholds for major incidents and significant cyber threats under Regulation (EU) 2022/2554” that will be submitted to the European Commission on January 17th, 2024.
Joint Statement on Duplication in the Cyber Resilience Act (2023)
The European Banking Federation (EBF), together with the European Association of Co-operative Banks (EACB), the European Savings Banks Group (ESBG), the Association for Financial Markets in Europe (AFME) and the European Payment Institutions Federation (EPIF) released a joint statement on the ongoing process of finalizing the trilogue discussions on the Cyber Resilience Act (CRA).
The industry acknowledges that cross-sectoral rules on mitigating vulnerabilities within the lifecycle of digital products contribute to elevating cybersecurity throughout the entire supply chain. However, there are already rules in place for the financial sector that ensure its strong digital operational resilience and cybersecurity. The Digital Operational Resilience Act (“DORA”) introduces a comprehensive cybersecurity and ICT risk management regime that introduces requirements for financial services equivalent to the CRA.
EBF key considerations following the publication of the Cyber Resilience Act (CRA) proposal (2023)
Following the publication by the European Commission of the proposal for a Regulation on horizontal cybersecurity requirements for products with digital elements, i.e. the Cyber Resilience Act (CRA), the European Banking Federation (EBF) published key considerations related to the relation between the proposal and the Digital Operational Resilience Act.
European Commission's proposal for a revised Directive on Security of Network and Information Systems (NIS2): EBF key messages (2021)
Ensuring high levels of cybersecurity across the EU is one of the biggest challenges, affecting citizens, customers, and businesses alike. Cyber threats are by nature cross-sectoral and may arise from and expand to any field of economic activity, with possibly immense repercussions. Therefore, adopting cybersecurity measures that target entities across sectors is crucial and the European Commission’s review of the Directive on Security of Network and Information Systems (NIS2) is a welcomed initiative.
EU initiatives
Tech Sovereignty Package – Strengthening Europe’s ability to act independently by developing and controlling key technologies, data, and infrastructure, while reducing reliance on non-EU providers
Action Plan on Cybersecurity and Artificial Intelligence - Support the safe and responsible use of AI while strengthening Europe's cybersecurity
Cybersecurity Act revision - New cybersecurity package to further strengthen the EU's cybersecurity resilience and capabilities
Cyber Resilience Act – Ensuring all digital products are safe from cyber threats
Digital Omnibus – Advance simplification of the EU digital rulebook to stimulate competitiveness
Digital Operational Resilience Act – Improving the financial sector’s resilience against ICT risks
2026 – 2028 Supervisory priorities - Strengthening banks’ operational resilience and fostering robust ICT capabilities
“Dear CEO” letter – Addressing AI-enabled cybersecurity threats
2026 Geopolitical Risk reverse stress test results – Scenarios included cyberattacks and operational disruptions
Keynote speech – Strengthening operational resilience for the age of AI
2027 Work Programme – Outlining key areas of focus and deliverables, including joint oversight over CTPPs, focusing on cybersecurity and frontier AI risks
Joint call for vigilance over external dependencies - The ESAs) have identified external dependencies, emerging technologies and private credit as key vulnerabilities for the EU financial system in their Autumn 2026 risk update
Joint Statement on AI-related cybersecurity risks – The ESAs call for a cross-sectoral, risk-based and consistent supervisory approach
Critical infrastructures and services
European FI-ISAC
Cyber exercises
Cybersecurity standards and certification
European Cyber Security Month
International initiatives
FSB Cyber Incident Response and Recovery Report
EBF response to the FSB public consultation on Cyber Lexicon
Paris Call official website
EBF supports Paris Call for Trust and Security in Cyberspace
Past initiatives
Financial services – improving resilience against cyberattacks
Digital Single Market – Cybersecurity
EU Cybersecurity Package
Cybersecurity Act: Adopted text
Fintech Action Plan: For a more competitive and innovative European financial sector
ECB publishes European framework for testing financial sector resilience to cyber attacks
Euro Cyber Resilience Board for pan-European Financial Infrastructures
Public consultation on cyber resilience oversight expectations
EBA publishes its Roadmap on FinTech
EBF key messages to the EBA consultation on its draft Guidelines on ICT and security risk management
Key EBF positions
Cybersecurity awareness raising campaigns
EC3-EBF CyberScams campaign
Cybercriminals are constantly looking for ways to make money at your expense. Individuals and organisations often fall prey to frauds that involve various forms of social engineering techniques, where the information required is garnered from a person rather than breaking into a system.
These scams are typical examples of how cyber attackers can easily play on people’s psychology and perceptions. The tips provided here are aimed to help you protect yourself. Awareness is your best defence! Learn more
No More Ransom campaign
Skills and awareness in the digital space are essential also for personal security. The EBF Digital Skills strategy is therefore very closely linked with its work on cybersecurity. EBF has joined forces with Europol EC3, the European Cybercrime Center of the EU Agency for Law Enforcement Cooperation, promoting awareness on digital security and cybercrime. EBF is also regularly supporting the European Cybersecurity Month, organised by ENISA every year in October.
Don’t be a mule campaign
- Europol EC3, FinTech FinCrime Exchange, INTERPOL and Western Union 422 arrested and 4,031 money mules identified in global crackdown on money laundering
- Europol EC3, EBF, Eurojus Joint Press release: More than 650 banks support global action against money laundering
- Europol EC3, EBF, Eurojus Joint Press release: Over 1500 money mules identified in worldwide money laundering sting
- Europol EC3 – EBF awareness campaign on Cyberscams: Take control of your digital life!
- Press release: Europol & EBF launch campaign on 7 most common online financial scams
- Europol – awareness and prevention guides
- Press release: Europol & EBF join forces to fight cybercrime
European Money Quiz
The European Money Quiz is Europe's largest financial literacy competition for students aged 13 to 15. Organised by national banking associations and coordinated by the European Banking Federation, it brings classrooms from across Europe together to test and strengthen their knowledge of money and finance.
Past events
EBF DIGITAL THURSDAYS 2021-Cyber resilience in Banking: Regulation, Synergies and Trust
Security is the cornerstone of successful digital transformation, especially in banking where trust lies at the heart of the relationship with customers. European banks drive their digital innovation in cooperation with multiple ICT service providers, composing an all-growing supply chain of third parties. Bank and non-bank actors in the chain, regulatory and supervisory authorities are striving for a high level of resilience and cybersecurity across the ecosystem.
As the EU legislator proposes a harmonized approach to operational resilience under the Digital Operational Resilience Act (DORA), regulators and industry discussed this advancing initiative and its effect on digital innovation. Taking place within the European Cybersecurity Month, this Digital Thursday showcased also the importance of cyber threat information sharing and other private sector initiatives, including raising awareness on cyber risks.
EBF DIGITAL THURSDAYS 2020 - Cyber security & resilience: The basis of it all in digital innovation
The first day of EBF's Innovation & Cyber Thursdays 2020 was devoted to cybersecurity and resilience, the foundation underlying every field of digital innovation. Held during European Cyber Security Month and building on previous editions of the EBF Cybersecurity Conference, the event explored the rapidly evolving cyber trends and challenges facing banks. Lessons learned from the Covid-19 pandemic, which accelerated digitalisation across the economy, and its impact on the resilience of the banking sector were a key focus, alongside new EU legislative developments and international initiatives on digital operational resilience for financial institutions. Policy-makers, bank experts and international stakeholders also shared insights on European and international priorities for facilitating efficient, timely cyber information-sharing among market participants — an important tool for identifying and mitigating cyber threats.
