Voluntary Dry Run Exercise for Digital Operational Resilience Act (DORA) Implementation

TO : Regulated Entities:
i. Cyprus Investment Firms (‘CIFs’)
ii. Central Securities Depositories
iii. Trading Venues
iv. Alternative Investment Fund Managers (‘AIFMs’)
v. UCITS Management Companies (‘UCITS’)
FROM : Cyprus Securities and Exchange Commission DATE : 24 April 2024 CIRCULAR No : C639 SUBJECT : Voluntary Dry Run Exercise to prepare industry for the next stage of Digital Operational Resilience Act (DORA) implementation

The Cyprus Securities and Exchange Commission (the ‘CySEC') hereby issues this circular to notify Regulated Entities of the upcoming voluntary exercise initiated by the European Supervisory Authorities (EBA, EIOPA, ESMA – collectively referred to as ESAs) for the collection of the registers of information of contractual arrangements on the use of ICT third-party providers by the financial entities1 . Under the Digital Operation Resilience Act (‘DORA’) and starting from 2025, financial entities will have to maintain registers of information regarding their use of ICT third-party providers. In this dry run exercise, this information will be collected from financial entities through their competent authorities and will serve as preparation for the implementation and reporting of registers of information under DORA. The ESAs and the competent authorities are introducing this voluntary exercise to help financial entities prepare for establishing their register of information, gathering the relevant information specified in the ESAs’ final draft Implementing Standards on the registers of information and reporting their registers of information to their respective competent authorities, who will, in turn, provide those to the ESAs. Financial entities participating in the dry run will receive support from the ESAs to: (1) build their register of information in the format as close as possible to the steady-state reporting from 2025, (2) test the reporting process, (3) address data quality issues, and (4) improve internal processes and quality of their registers of information. 1 As defined in Article 2(1) and (2) of DORA.

As part of the exercise, the ESAs will provide feedback on data quality to financial entities participating, return cleaned files with their register of information, organise workshops and respond to frequently asked questions. Next steps The ad-hoc data collection is expected to be launched in May 2024 with the financial entities expecting to submit their registers of information to the ESAs through their competent authorities between 1 July and 30 August. Workshop To provide more information regarding the dry run exercise, the ESAs invite financial entities to take part in an introductory workshop on 30 April 2024 from 10:00 to 12:00 CEST. The workshop will be held virtually, and interested parties are invited to register by 25 April 2024 using the following link. A dedicated factsheet is also available for more information. Yours sincerely, George Theocharides Chairman Cyprus Securities and Exchange Commission