Financial sector – DORA, MiCA and supervisory expectations
Run operational, financial, reputational and other non-financial risk management on one model, and catch the events that should move it.
Typical requirementsDORA (EU) 2022/2554MiCA (EU) 2023/1114ECB / SSM supervisory expectationsEBA guidelines on internal governance and outsourcingISO 31000
Who it is forBanks, payment and e-money institutions, investment firms, insurers and crypto-asset service providers, and the ICT providers that serve them.
Financial regulators look at the whole of non-financial risk, not only ICT. DORA sets the rules for ICT risk, incident reporting, resilience testing and ICT third parties. MiCA brings governance, conflicts of interest, complaints handling, outsourcing and business continuity to crypto-asset service providers. Supervisory expectations, including those of the ECB for significant institutions and the EBA guidelines, ask for a risk taxonomy, appetite, self-assessments, loss data and management body oversight.
Most of this work is still manual: self-assessments in spreadsheets, events collected by email, indicators in a separate report. In WINGMAN, risks, controls, events and third parties are linked records, so an event updates the risk it concerns, and the management body sees one picture.
Videos
Plays from youtube-nocookie.com. YouTube sets no cookies until you press play.
Registers WINGMAN keeps
Each register is a set of linked records in one model, not a separate spreadsheet. Pick an entity to see it in the data model.
Non-financial risk register
Operational, reputational, compliance, conduct, model, outsourcing and ICT risks in one hierarchy, scored on the same scale and linked to appetite.
Processes and critical functions
Business processes, products and critical or important functions, with the systems, data and third parties behind each.
Third-party and outsourcing register
ICT third-party arrangements and other outsourcing, with the functions they support, contracts, exit plans and assessments. The basis for the DORA register of information.
Indicators and events feed
Key risk indicators, complaints, media and sector news, supplier notices and supervisory communications, each triaged and linked to risks.
Loss event and incident log
Loss events, near misses and major incidents with cause, impact, realised risks, reporting and follow-up.
Control library
Controls with owners, frequency and evidence, tested in self-assessments and by internal audit.
Regulatory obligations
DORA, MiCA, EBA guidelines and supervisory expectations as clause-level records, mapped across frameworks so one control counts for several.
The governance cycle on the model
Step through how the regulation runs on WINGMAN records, from scope to proof.
Screens for this stage · Stage 1: Risk taxonomy and appetite
Screens for this stage · Stage 3: Risk and control self-assessment
Screens for this stage · Stage 4: Key risk indicators and events
Screens for this stage · Stage 5: Loss and incident events
Screens for this stage · Stage 6: Reporting and oversight
Use cases from this angle
The same use cases, with what changes for this regulation.
Risk
Risk identification
Interview-based risk identification per process, feeding the operational risk hierarchy instead of a one-off workshop.
Risk
Risk review and treatment
Risk and control self-assessment with second-line challenge, scheduled and tracked as a plan.
Operations
Incident handling
Loss events and major ICT-related incidents are recorded once, with classification, reporting and lessons learned that update risks.
Operations
Supplier evaluation
Third-party risk under DORA and outsourcing guidelines, from pre-contract assessment to exit plans, feeding the register of information.
Risk
Business impact analysis
Critical or important functions with impact tolerances, recovery objectives and the dependencies behind them.
Compliance
New requirements
New supervisory expectations or MiCA requirements are mapped to existing controls before anyone writes a new policy.
Compliance
Management review
The management body reviews exposure against risk appetite, events and remediation status.
Operations
Change management
New products and material changes are assessed for risk before they go live.
Questions it answers
What is our exposure against appetite right now?
From the enterprise risks to the process risks below them, with current ratings, the events and indicators that moved them, and the controls in place.
Which events this quarter should have changed a risk rating?
From signals and loss events to the risks they indicate or realise, showing which ratings were reviewed and which were not.
Which critical functions depend on a single third party?
From the function to the assets it runs on, to the suppliers that provide them, with contracts and exit plans.
Is the register of information complete?
Suppliers with no linked function, contract or assessment show up as gaps before the submission is due.
Other sectors and regulations
NIS2 and national cybersecurity law
Run the information security office of an essential or important entity from one registry of suppliers, assets, risks, incidents, vulnerabilities, threats and tasks.
ISO 27001 and SOC 2 Type 2
Keep the whole ISMS in one model, with control ownership, recurring reviews, management review and evidence that holds up over an audit period.
AI governance – ISO 42001, EN 18286 and the EU AI Act
Treat each AI use case as an asset with its own risks, controls and work plan, and show conformity with the EU AI Act from the same records.
Cyber Resilience Act
Design CRA compliance into how products are built and supported, from risk assessment and SBOM to vulnerability handling and reporting.
GDPR and data protection
Keep the record of processing, DPIAs, processors, data subject requests and breaches as linked records, so accountability can be shown at any time.