meta_id 3231888

On June 11, 2026, the Dutch Authority for the Financial Markets (AFM) published findings from a thematic review of trading platforms' ICT risk management frameworks under the Digital Operational Resilience Act (DORA). The AFM's review examined how regulated markets, multilateral trading facilities and organised trading facilities have implemented DORA requirements. The authority identified four key areas requiring improvement and set out its recommendations for improvement, which are to: Ensure a sufficiently detailed DORA gap assessment - the AMF found that gap assessments conducted by trading platforms remain insufficiently detailed, with many being too broad to identify relevant DORA requirements or emerging deficiencies. Improve the design and coverage of core ICT risk management framework controls - the AFM found that certain ICT risk management framework components require enhanced coverage, particularly security monitoring, access controls, logging, emergency changes and continuity management. These are measures the AFM considers crucial for cyber resilience and orderly market functioning. Ensure that policies are correctly scoped and formally approved in line with Article 2 of Commission Delegated Regulation (EU) 2024/1774 - the AMF found that policies and procedures lack consistent qualification and clear distinction, creating uncertainty about whether specific requirements are properly documented as regulations demand. Apply group-level DORA-compliant policies for intragroup ICT services - the AMF found that when trading platforms use ICT services within their corporate groups, DORA-compliant policies and procedures are not always adopted at the group level, limiting consistency and ICT risk control. The AFM emphasised that although trading platforms generally possess foundational DORA implementations, further steps are necessary to achieve full and sustainable compliance. The authority will continue supervising digital operational resilience compliance, increasingly focusing on practical application rather than documentation alone. Trading platforms should consider the review's findings and recommendations when advancing their DORA implementation efforts.