The EU’s Digital Operational Resilience Act (DORA) is a positive step for the payments industry and will help boost the resilience of an ecosystem that has changed radically over the last twenty years. Even so, the implications of this landmark regulation for payment service providers (PSPs) are complex and far-reaching. It will require investment in processes and infrastructure, which must also factor in the ongoing shift to real-time payments.

The technology backstory

Two decades ago, payment technology predominantly referred to back-end systems used by banks and PSPs to process electronic transactions. Online banking was still in its infancy, the smartphone hadn’t yet been launched, and traditional payment methods such as cash and cheques were much more prevalent.  

Today, it is a very different story. The number of electronic payments made via cards and digital wallets, credit transfers and direct debits has exploded. Technology is front and centre in payment service delivery, as individuals and businesses use online portals and mobile apps to manage accounts and initiate payments. While the rise of real-time payments, such as the EU’s SEPA Instant Credit Transfer (SCT Inst), means an increasing proportion of bank transfers are settled instantly rather than over several working days, which also means that anti-fraud measures and other compliance checks have to take place in real-time given the heightened fraud risk.

So, if there is a technological failure at any point in this new world of payments, it can have immediate and considerable ramifications for individuals and businesses. The now-infamous CrowdStrike outage in July 2024 affected several sectors, including banking, with some PSPs unable to process payments. More recently, an hours-long glitch at Bank of Ireland in December 2024 caused delays in processing payroll transactions for some employers, while a two-day outage at Barclays in February 2025  left customers unable to make bank transfers and use their debit cards. To catch up, Barclays had to process payments over the weekend and extend call centre operating hours.  

DORA’s goals

DORA aims to make the EU’s financial institutions (FIs) more resilient to information and communication technology (ICT) risks. It will minimise the potential for IT outages and require FIs to be back online as quickly as possible when they do occur. From a practical perspective, it will oblige them to create and implement ICT risk management frameworks. And meet new requirements for resilience testing, outage reporting, and information sharing.

Of course, the advent of DORA adds to the compliance burden for FIs, who will partly be spurred to comply to avoid fines for non-compliance and the associated negative press. Still, its rollout should be seen as positive for the industry. It should help to improve resilience across the ecosystem and boost customer confidence in the sector.

Improving infrastructure resilience with DORA

One angle that is less widely discussed when it comes to DORA is its implications for a PSP’s infrastructure. Whether developed in-house or outsourced, payment systems will need to have the capacity to accommodate peak loads following any outage. This will require PSPs to scale by multiples of their standard throughput.

For example, if a PSP’s average processing volume is 1,000 transactions per hour and its systems are down for three hours, it will need to have the capacity to process those 3,000 outstanding transactions once service resumes. And without impacting new transactions coming through the system. Additionally, if they are real-time payments, the delayed transactions must be settled as soon as possible. In this hypothetical example, such an outage would mean the system needs to handle 4,000 transactions in one hour, four times its usual capacity.

This requirement to recover quickly from IT outages will necessitate additional investment in infrastructure and automation. Especially given the move towards real-time settlement. In particular, it will likely drive interest in cloud-native technology, which can scale more readily on demand.

Third-party vendor relationships

DORA will also significantly impact how PSPs manage third-party IT vendor relationships. This development has been driven by the growing complexity of the financial ecosystem in the wake of digitisation and the rise of open banking. Research from McKinsey Digital highlights how the growth in the number of apps and vendors has increased the complexity and pressure on IT leaders.  

Under DORA, FIs are expected to monitor third-party providers, update supplier contracts to cover IT resilience, and establish an oversight framework for critical third-party providers. Consequently, conducting due diligence on third-party providers, particularly new vendors, and their approach to resilience is essential. Generally, we are likely to witness a flight to quality, with the providers that invest in controls and resilience set to fare best in the long term.

Adjusting to DORA

The arrival of DORA is a positive development for the payments industry. The sector has changed significantly in recent decades and relies heavily on technology for service delivery. Likewise, its customers depend on the PSPs to deliver their services so that they can conduct their business uninterrupted. However, the changes required by DORA are extensive and will require PSPs to invest in their infrastructure, processes and third-party relationships. As they adjust to the requirements of DORA, PSPs should ensure that infrastructure is resilient and flexible enough to handle surges in transaction flows. And factor in the shift to real-time settlement, which will only add to the demands made of payment systems.