Bank of Italy highlights operational resilience gaps and technology provider risks in Senate testimony

In testimony before the Senate committee investigating the banking, financial and insurance system, Bank of Italy financial supervision and regulation head Giuseppe Siani reviewed progress under the Digital Operational Resilience Act (DORA) but highlighted remaining weaknesses in technology controls and supplier oversight. The assessment draws on self-assessments requested in December 2024 and subsequently supported by a standard template. These show improvements in risk monitoring, expertise and investment, while identifying further work needed on infrastructure security, measures to limit cyberattack impacts and supplier contracts. Incident reporting underscores the exposure to external technology providers. In the first nine months of 2026, intermediaries submitted 92 reports covering 68 events, with nearly 60% of reports attributable to third parties. Supervisory reviews also identified room to improve incident classification and the implementation of lasting corrective measures. Intermediaries need stronger oversight of critical services, including appropriate supplier selection, clear service levels and mapping of subcontracting chains. Concentration among providers and limited alternatives require workable exit strategies and business continuity arrangements. Outsourcing does not transfer intermediaries’ responsibility for managing these risks. Siani also recalled the July request for directly supervised intermediaries to prepare plans by the end of 2026 to strengthen cybersecurity and operational resilience in response to advanced artificial intelligence models. Such models can accelerate attacks and increase fraud sophistication, while making effective control of processes more difficult. Operational resilience requires senior management involvement and investment in technology, controls and skills, rather than formal compliance alone.