Hanfa holds a conference on digital resilience of the financial sector

At the conference “DORA and Digital Resilience: Challenges of Practical Implementation”, organised by the Croatian Financial Services Supervisory Agency (Hanfa) on 24 November 2025, key stakeholders from the non-bank financial sector and numerous information security experts gathered to discuss the requirements introduced by the Digital Operational Resilience Act (DORA), the current state of digital resilience in the financial services sector, and the main steps in the process of DORA implementation.

In his opening address, Ante Žigman, President of Hanfa Board, highlighted the key aspects of Hanfa’s supervisory approach and what lies ahead in the coming period. “DORA is finally entering full application and brings a fundamental change in the management of ICT risks, especially those arising from complex supply chains,” he said, adding that the Regulation has significantly strengthened the overall system and harmonised ICT risk-management standards across the entire financial sector. He stressed the importance of proportionality, along with stricter conditions for subcontracting and EU-level supervision of critical providers. He also warned about a significant rise in cyberattacks and increasingly sophisticated breach methods, including the misuse of advanced AI tools, as well as the risks posed by quantum computing. He emphasised the necessity of “cyber hygiene” as a basic defensive standard in today’s digital society.

Experts at the conference presented from a range of perspectives on key cyber risks and shared their practical insights and experiences. Peter Braumüller, representative of the Austrian Financial Market Authority (FMA), outlined Austria’s experience in conducting digital resilience assessments under DORA, as well as the latest lessons learned from incident handling and successful breach defences, with a particular focus on preventive measures. A representative of the National Cyber Security Centre (NCSC-HR) presented an analysis of current threats in Croatia and the wider region. Edward Starkie and Shreeji Doshi from Thomas Murray Cyber presented the results of external vulnerability analyses that simulate real-world attack methods, with special attention to risks related to ICT service providers. Bojan Ždrnja of Infigo IS spoke about trends in cyberattack prevention. Mladen Gavrančić and Boris Mršić from Hanfa’s Information Security Office presented supervisory activities carried out in 2025 and the results of an extensive digital resilience test covering 46 financial institutions.

During the panel discussion “Between Regulation and Real Threats,” panellists Bojan Ždrnja (Infigo IS), Marin Hrešić (Eurizon Asset Management Croatia / Association of Investment and Pension Funds at the Croatian Chamber of Economy), Davor Tomašković (Croatia osiguranje), Kristijan Buk (Allianz ZB) and Lukas Oliver Pavić (UNIQA osiguranje) reflected on the first months of DORA’s full application. They emphasised that the new regulation has fundamentally changed the way ICT risks are managed and has increased the level of responsibility of management boards, especially in large and highly exposed institutions. They also noted that, beyond strengthening digital resilience, DORA significantly increases consumer confidence in financial institutions and in the financial system as a whole. The panellists discussed their experience with the PiXi platform, its practical usability and potential improvements that could further enhance digital resilience. They highlighted the biggest challenges during preparation for DORA, as well as the benefits it has brought – from greater business stability to clearer structuring of security processes. In addition, they pointed to the need for continuous education of all employees in the area of ICT risks and shared examples of digital resilience testing and exercises carried out within their institutions.

During the panel, Marin Hrešić, President of the Association of Investment and Pension Funds, presented a new step forward in inter-institutional cooperation – an initiative to establish an inter-institutional working group at the Croatian Chamber of Economy called the DORA Forum. The aim of the group is to bring together key financial-sector stakeholders to regularly exchange experience, discuss the practical application of DORA, and jointly contribute to strengthening digital resilience and compliance with regulatory requirements.