DORA Compliance for Payment Services: PSD2 Infrastructure & Operational Resilience

ICT Risk Management for Payment Infrastructure

• Transaction processing resilience: Payment processing systems classified as critical ICT systems under DORA Art. 5-16. Must have documented RTOs (typically < 2 hours for Tier 1 PSPs)
• API gateway resilience: Open Banking APIs (PSD2 Art. 36 RTS) must meet availability requirements. DORA adds systematic resilience testing.
• Strong Customer Authentication (SCA): Authentication infrastructure is critical ICT — outage means customers can't authenticate, transactions fail
• Real-time fraud detection: ML-based fraud detection systems must be resilient and accurate. False positives block legitimate transactions; false negatives enable fraud.
• Settlement and clearing: End-of-day settlement processes must complete within defined windows. DORA requires documented recovery procedures.

Third-Party Risk (DORA Art. 28-44)

PSPs typically depend on 20-50 critical third-party ICT providers:

• Card networks: Visa, Mastercard processing dependencies
• Banking APIs: Account information and payment initiation service dependencies
• Cloud infrastructure: AWS, Azure, GCP hosting critical payment workloads
• Fraud detection: Third-party fraud scoring services (Featurespace, Feedzai, NICE Actimize)
• KYC/AML providers: Identity verification and sanctions screening services

DORA requires: contractual resilience requirements, exit strategies for each critical provider, and concentration risk assessment.

• Multi-region deployment: Active-active across at least two regions for transaction processing
• Circuit breakers: Isolate failing third-party dependencies without cascading to the entire payment flow
• Async processing: Queue-based architectures (Kafka, RabbitMQ) for non-real-time operations — settlement, reconciliation, reporting
• Observability: End-to-end transaction tracing from API gateway through processing to settlement
• Chaos testing: Regular failure injection in payment paths — test what happens when Visa is unreachable, when the fraud engine times out, when a database replica lags

Good news: if you're already PSD2-compliant, you have a foundation for DORA. The gaps are typically:

1. Formalised ICT risk framework — PSD2 focuses on security; DORA requires a comprehensive ICT risk management framework
2. Resilience testing programme — PSD2 doesn't require threat-led penetration testing (TLPT); DORA does for significant PSPs
3. Third-party risk management — PSD2 outsourcing guidelines exist but DORA is more prescriptive about contractual requirements and exit strategies
4. Incident reporting — DORA harmonises incident reporting with specific timelines and severity classification