On 29 September 2026, the Autoriteit Financiële Markten (AFM) concluded that large institutional asset managers have the foundations for ICT recovery in place, but require further improvements. The regulator examined how they are prepared for a major ICT outage. According to AFM, DORA sets requirements for the timely restoration of critical services following a disruption.
The asset managers examined broadly have the key processes, plans and testing programmes in place. According to AFM, there is not always a clear link between critical functions, recovery objectives, dependencies on ICT service providers and the way in which recovery is tested. According to the regulator, this link is important to ensure that services can also be restored quickly in the event of serious disruptions.
AFM identifies four areas for attention. Institutions must classify critical functions clearly and consistently and establish recovery objectives for these functions. According to the study, recovery objectives are often established only for systems or applications.
In addition, arrangements with external ICT service providers must align with the institution’s recovery objectives. AFM also considers it important to test regularly using a range of extreme scenarios, including cyber attacks, prolonged system outages and problems involving an external ICT service provider.
