DORA and value creation for fund administrators

The short answer

Treat the Digital Operational Resilience Act as a map of the operation as well as a compliance file. The register of ICT third parties, the incident process and the testing programme describe how the business actually runs. Build them once, properly, and the same work removes manual steps from onboarding, monitoring and reporting, which is where a fund administrator's margin is made.

Why it matters now

DORA has applied to financial entities in the European Union since January 2025. An administrator that built its resilience file as a separate project ends up maintaining two descriptions of one operation.

How to do it

1. Start from the value chain. Every process from client onboarding to reporting, each with its owner, its systems and its third parties.
2. Build the ICT register from it. The register then describes the business, and stays current when the business changes.
3. Mark the processes that are critical or important. That is a regulatory judgement and a commercial one, and they usually agree.
4. Automate where resilience and margin meet. Onboarding, AML and KYC monitoring and due-diligence workflows are slow, manual and risky at once.
5. Test what you automate. The testing programme proves the new process holds.
6. Report both results together. Hours removed and resilience gained, to the board and the supervisor.

What good looks like

A published case: a European fund-administration platform under private-equity ownership automated onboarding, AML and KYC monitoring and due-diligence workflows, cut middle-office inefficiency by 40 per cent and accelerated top-line growth into high single digits (as reported by the company; case 03 at makersofnew.com/value.html).

Where it goes wrong

• Compliance and operations run separate projects. Two maps of one business drift apart within a year.
• The register is built from contracts. It should be built from the processes the contracts serve.
• Automation ships without a test. A faster process nobody tested is a new risk.

The instrument

The regulated-finance pages of a MakersOS room record licences, capital and counterparties beside the reading, and the value chain library holds the fund-administration processes.

Source: Regulation (EU) 2022/2554 on digital operational resilience for the financial sector, applicable from 17 January 2025.