Finance

By January 2025, banks and their technology suppliers will have to comply with a new EU law known as DORA. It could help prevent major IT disruptions in future.
The importance of financial firms reducing risks stemming from third-party tech vendors became more pronounced after a faulty CrowdStrike software update caused widespread global tech outages.
CNBC runs through what you need to know about DORA — including what it is, why it matters, and what banks are doing to make sure they’re prepared for it.

Traffic_analyzer | Digitalvision Vectors | Getty Images

Financial services companies and their digital technology suppliers are under intense pressure to achieve compliance with strict new rules from the EU that require them to boost their cyber resilience.
By the start of next year, financial services firms and their technology suppliers will have to make sure that they’re in compliance with a new incoming law from the European Union known as DORA, or the Digital Operational Resilience Act.

CNBC runs through what you need to know about DORA — including what it is, why it matters, and what banks are doing to make sure they’re prepared for it.

What is DORA?

DORA requires banks, insurance companies and investment to strengthen their IT security. The EU regulation also seeks to ensure the financial services industry is resilient in the event of a severe disruption to operations.
Such disruptions could include a ransomware attack that causes a financial company’s computers to shut down, or a DDOS (distributed denial of service) attack that forces a firm’s website to go offline. 
The regulation also seeks to help firms avoid major outage events, such as the historic IT meltdown last month caused by cyber firm CrowdStrike when a simple software update issued by the company forced Microsoft’s Windows operating system to crash. 
Multiple banks, payment firms and investment companies — from JPMorgan Chase and Santander, to Visa and Charles Schwab — were unable to provide service due to the outage. It took these firms several hours to restore service to consumers.

In the future, such an event would fall under the type of service disruption that would face scrutiny under the EU’s incoming rules.
Mike Sleightholme, president of fintech firm Broadridge International, notes that a standout factor of DORA is that it doesn’t just focus on what banks do to ensure resiliency — it also takes a close look at firms’ tech suppliers.

Under DORA, banks will be required to undertake rigorous IT risk management, incident management, classification and reporting, digital operational resilience testing, information and intelligence sharing in relation to cyber threats and vulnerabilities, and measures to manage third-party risks.
Firms will be required to conduct assessments of “concentration risk” related to the outsourcing of critical or important operational functions to external companies.
These IT providers often deliver “critical digital services to customers,” said Joe Vaccaro, general manager of Cisco-owned internet quality monitoring firm ThousandEyes.
“These third-party providers must now be part of the testing and reporting process, meaning financial services companies need to adopt solutions that help them uncover and map these sometimes hidden dependencies with providers,” he told CNBC.
Banks will also have to “expand their ability to assure the delivery and performance of digital experiences across not just the infrastructure they own, but also the one they don’t,” Vaccaro added.

When does the law apply?

DORA entered into force on Jan. 16, 2023, but the rules won’t be enforced by EU member states until Jan. 17, 2025.
The EU has prioritised these reforms because of how the financial sector is increasingly dependent on technology and tech companies to deliver vital services. This has made banks and other financial services providers more vulnerable to cyberattacks and other incidents.
“There’s a lot of focus on third-party risk management” now, Sleightholme told CNBC. “Banks use third-party service providers for important parts of their technology infrastructure.”
“Enhanced recovery time objectives is an important part of it. It really is about security around technology, with a particular focus on cybersecurity recoveries from cyber events,” he added.
Many EU digital policy reforms from the last few years tend to focus on the obligations of companies themselves to make sure their systems and frameworks are robust enough to protect against damaging events like the loss of data to hackers or unauthorized individuals and entities.
The EU’s General Data Protection Regulation, or GDPR, for example, requires companies to ensure the way they process personally identifiable information is done with consent, and that it’s handled with sufficient protections to minimize the potential of such data being exposed in a breach or leak.
DORA will focus more on banks’ digital supply chain — which represents a new, potentially less comfortable legal dynamic for financial firms.

What if a firm fails to comply?

For financial firms that fall foul of the new rules, EU authorities will have the power to levy fines of up to 2% of their annual global revenues.
Individual managers can also be held responsible for breaches. Sanctions on individuals within financial entities could come in as high a 1 million euros ($1.1 million).
For IT providers, regulators can levy fines of as high as 1% of average daily global revenues in the previous business year. Firms can also be fined every day for up to six months until they achieve compliance.
Third-party IT firms deemed “critical” by EU regulators could face fines of up to 5 million euros — or, in the case of an individual manager, a maximum of 500,000 euros.

That’s slightly less severe than a law such as GDPR, under which firms can be fined up to 10 million euros ($10.9 million), or 4% of their annual global revenues — whichever is the higher amount.
Carl Leonard, EMEA cybersecurity strategist at security software firm Proofpoint, stresses that criminal sanctions may vary from member state to member state depending on how each EU country applies the rules in their respective markets.
DORA also calls for a “principle of proportionality” when it comes to penalties in response to breaches of the legislation, Leonard added.
That means any response to legal failings would have to balance the time, effort and money firms spend on enhancing their internal processes and security technologies against how critical the service they’re offering is and what data they’re trying to protect.

Are banks and their suppliers ready?

Stephen McDermid, EMEA chief security officer for cybersecurity firm Okta, told CNBC that many financial services firms have prioritized using existing internal operational resilience and third-party risk programs to get into compliance with DORA and “identify any gaps they may have.”
“This is the intention of DORA, to create alignment of many existing governance programs under a single supervisory authority and harmonise them across the EU,” he added.
Fredrik Forslund vice president and general manager of international at data sanitization firm Blancco, warned that though banks and tech vendors have been making progress toward compliance with DORA, there’s still “work to be done.”
On a scale from one to 10 — with a value of one representing noncompliance and 10 representing full compliance — Forslund said, “We’re at 6 and we’re scrambling to get to 7.”
“We know that we have to be at a 10 by January,” he said, adding that “not everyone will be there by January.” More

JPMorgan Chase CEO Jamie Dimon said he still believes that the odds of a “soft landing” for the economy are around 35% to 40%, making recession the most likely scenario in his mind.
When asked if he had changed his view from February that markets were too optimistic on recession risks, Dimon said the odds were “about the same” as his earlier call.
Dimon added he was “a little bit of a skeptic” that the Federal Reserve can bring inflation down to its 2% target because of future spending on the green economy and military.

JPMorgan Chase CEO Jamie Dimon said Wednesday he still believes that the odds of a “soft landing” for the U.S. economy are around 35% to 40%, making recession the most likely scenario in his mind.
When CNBC’s Leslie Picker asked Dimon if he had changed his view from February that markets were too optimistic on recession risks, he said the odds were “about the same” as his earlier call.

“There’s a lot of uncertainty out there,” Dimon said. “I’ve always pointed to geopolitics, housing, the deficits, the spending, the quantitative tightening, the elections, all these things cause some consternation in markets.”
Dimon, leader of the biggest U.S. bank by assets and one of the most respected voices on Wall Street, has warned of an economic “hurricane” since 2022. But the economy has held up better than he expected, and Dimon said Wednesday that while credit-card borrower defaults are rising, America is not in a recession right now.
Dimon added he is “a little bit of a skeptic” that the Federal Reserve can bring inflation down to its 2% target because of future spending on the green economy and military.
“There’s always a large range of outcomes,” Dimon said. “I’m fully optimistic that if we have a mild recession, even a harder one, we would be okay. Of course, I’m very sympathetic to people who lose their jobs. You don’t want a hard landing.” More

A weak jobs report in America has raised fears that the world’s largest economy is heading for recession. America’s stockmarkets have tumbled, with fear spreading to other countries. Japan’s Topix index is 15% off its recent high; Germany’s main index is down by 7%. When America sneezes, everywhere catches a cold. More

McDonald’s owed its early success to zealous pickiness. Other restaurant chains in the 1960s had similar rules for food preparation and cleanliness. But none enforced them as rigorously, according to “McDonald’s: Behind the Arches”, a history of the company by John Love. More

A weaker-than-expected jobs report on Friday fueled fears of a U.S. recession.
An increase in the national unemployment rate triggered the “Sahm rule” in July, suggesting the U.S. is in a downturn.
While there are causes for concern, data suggest the overall economy remains resilient, economists said.

Traders on the floor of the New York Stock Exchange during afternoon trading on Aug. 02, 2024.
Michael M. Santiago | Getty Images

Recession fears led to a sharp stock-market selloff in recent days, with the S&P 500 index posting a 3% loss Monday, its worst in almost two years.
Weaker-than-expected job data on Friday fueled concerns that the U.S. economy is on shaky footing, and that the Federal Reserve may have erred in its goal of achieving a so-called “soft landing.”

A soft landing would mean the Fed charted a path with its interest-rate policy that tamed inflation without triggering an economic downturn.
Federal data on Friday showed a sharp jump in the U.S. unemployment rate. Investors worried this signaled a “hard landing” was becoming more likely.
However, the odds of a recession starting within the next year are still relatively low, economists said.
In other words, a soft landing is still in the cards, they said.

“I think far and away the most likely scenario is a soft landing: The economy avoids an economic downturn,” said Mark Zandi, chief economist at Moody’s.

Likewise, Jay Bryson, chief economist at Wells Fargo Economics, said a soft landing remains his “base case” forecast.
But recession worries aren’t totally unfounded due to some signs of economic weakness, he said.
“I think the fears are real,” he said. “I wouldn’t discount them.”
Avoiding recession would also require the Fed to soon start cutting interest rates, Zandi and Bryson said.
If borrowing costs remain high, it increases the danger of a recession, they said.

Why are people freaking out?

The “big shock” on Friday — and a root cause of the ensuing stock-market rout — came from the monthly jobs report issued by the Bureau of Labor Statistics, Bryson said.
The unemployment rate rose to 4.3% in July, up from 4.1% in June and 3.5% a year earlier, it showed.
A 4.3% national jobless rate is low by historical standards, economists said.

But its steady increase in the past year triggered the so-called “Sahm rule.” If history is a guide, that would suggest the U.S. economy is already in a recession.
The Sahm rule is triggered when the three-month moving average of the U.S. unemployment rate is half a percentage point (or more) above its low over the prior 12 months.
That threshold was breached in July, when the Sahm rule recession indicator hit 0.53 points.

Goldman Sachs raised its recession forecast over the weekend to 25% from 15%. (Downturns occur every six to seven years, on average, putting the annual odds around 15%, economists said.)
Zandi estimates the chances of a recession starting over the next year at about 1 in 3, roughly double the historical norm. Bryson puts the probability at about 30% to 40%.

The Sahm rule may not be accurate this time

However, there’s good reason to think the Sahm rule isn’t an accurate recession indicator in the current economic cycle, Zandi said.
This is due to how the unemployment rate is calculated: The unemployment rate is a share of unemployed people as a percent of the labor force. So, changes in two variables — the number of unemployed and the size of the labor force — can move it up or down.
More from Personal Finance:’Don’t panic’ amid stock market volatilityThis labor data trend is a ‘warning sign,’ economist saysNow is the time to buy stocks ‘on sale’
The Sahm rule has historically been triggered by a weakening demand for workers. Businesses laid off employees, and the ranks of unemployed people swelled.
However, the unemployment rate’s rise over the past year is largely for “good reasons” — specifically, a big increase in labor supply, Bryson said.

More Americans entered the job market and looked for work. Those who are on the sidelines and looking for work are officially counted amid the ranks of “unemployed” in federal data, thereby boosting the unemployment rate.
The labor force grew by 420,000 people in July relative to June — a “pretty big” number, Bryson said.
Meanwhile, some federal data suggest businesses are holding on to workers:  The layoff rate was 0.9% in June, tied for the lowest on record dating to 2000, for example.

‘The flags are turning red’

That said, there have been worrying signs of broader cooling in the labor market, economists said.
For example, hiring has slowed below its pre-pandemic baseline, as have the share of workers quitting for new gigs. Claims for unemployment benefits have gradually increased. The unemployment rate is at its highest level since the fall of 2021.

“The labor market is in a perilous spot,” Nick Bunker, economic research director for North America at job site Indeed, wrote in a memo Friday.
“Yellow flags had started to pop up in the labor market data over the past few months, but now the flags are turning red,” he added.

Other positive signs

There are some positive indicators that counter the negatives and suggest the economy remains resilient, however.
For example, “real” consumer spending (i.e., spending after accounting for inflation) remains strong “across the board,” Zandi said.
That’s important since consumer spending accounts for about two-thirds of the U.S. economy. If consumers keep spending, the economy will “be just fine,” Zandi said.

I think far and away the most likely scenario is a soft landing: The economy avoids an economic downturn.

Mark Zandi
chief economist at Moody’s

Underlying fundamentals in the economy like the financial health of households are “still pretty good” in aggregate, Bryson said.
It’s also a near certainty the Fed will start cutting interest rates in September, taking some pressure off households, especially lower earners, economists said.
“This is not September 2008, by any stretch of the imagination, where it was ‘jump into a fox hole as fast as you can,'” Bryson said. “Nor is it March 2020 when the economy was shutting down.”
“But there are some signs the economy is starting to weaken here,” he added. More

Sahm was the economist who introduced the so-called Sahm Rule in 2019.
It states that the initial phase of a recession has started when the three-month moving average of the U.S. unemployment rate is at least half a percentage point higher than the 12-month low.

The U.S. Federal Reserve does not need to make an emergency rate cut, despite recent weaker-than-expected economic data, according to Claudia Sahm, chief economist at New Century Advisors.
Speaking to CNBC “Street Signs Asia,” Sahm said, “we don’t need an emergency cut, from what we know right now, I don’t think that there’s everything that will make that necessary.”

She said, however, there is a good case for a 50 basis point cut, adding that the Fed needs to “back off” its restrictive monetary policy.
While the Fed is intentionally putting downward pressure on the U.S. economy using interest rates, Sahm warned the central bank needs to be watchful and not wait too long before cutting rates, as interest rate changes take a long time to work through the economy.
“The best case is they start easing gradually, ahead of time. So what I talk about is the risk [of a recession], and I still feel very strongly that this risk is there,” she said.
Sahm was the economist who introduced the so-called Sahm Rule, which states that the initial phase of a recession has started when the three-month moving average of the U.S. unemployment rate is at least half a percentage point higher than the 12-month low.
Lower-than-expected manufacturing numbers, as well as higher-than-forecast unemployment fueled recession fears and sparked a rout in global markets early this week.

The U.S. employment rate stood at 4.3% in July, which crosses the 0.5 percentage point threshold. The indicator is widely recognized for its simplicity and ability to quickly reflect the onset of a recession, and has never failed to indicate a recession in cases stretching back to 1953.
When asked if the U.S. economy is in a recession, Sahm said no, although she added that there is “no guarantee” of where the economy will go next. Should further weakening occur, then it could be pushed into a recession.
“We need to see the labor market stabilize. We need to see growth level out. The weakening is a real problem, particularly if what July showed us holds up, that that pace worsens.” More

Starbucks reported China same-store sales dropped by 14% in the quarter ended June 30, far steeper than the 2% decline in the U.S.
“Consumer sentiment in China is quite weak,” McDonald’s chairman, CEO and director Christopher Kempczinski, said of the quarter ended June 30.
After a “strong start” to the year in China, General Mills CFO Kofi Bruce said the quarter ending May 26 “saw a real souring or downturn in consumer sentiment.”

Pictured here is a McDonald’s store in Yichang, Hubei province, China, on July 30, 2024.
Nurphoto | Nurphoto | Getty Images

BEIJING — A theme emerging in the latest slew of U.S. companies’ earnings reports is a drag from the China market.
The Chinese economy — home to more than four times the population of the U.S. — has attracted multinational corporations for decades given its large, fast-growing market. But slower growth and intense local competition, amid tensions with the U.S., are now weighing on corporate earnings.

“Consumer sentiment in China is quite weak,” McDonald’s chairman, CEO and director Christopher Kempczinski, said of the quarter ended June 30.
“You’re seeing both in our industry and across a broad range of consumer industries, the consumer being very, very much deals seeking,” he added. “In fact, we’re seeing a lot of switching behavior in terms of just consumers, whatever is the best deal, that’s where they end up going.”
McDonald’s said sales for its international developmental licensed markets segment declined 1.3% from a year ago. The unit includes China, for which the company indicated sales declined but did not specify by how much.

Chinese companies have also struggled. Nationwide retail sales grew by just 2% in June from a year ago.
In the mainland China stock market, known as A shares, earnings likely hit a bottom in the first quarter and may “pick up mildly” in the second half of the year, Lei Meng, China equity strategist at UBS Securities, said in a July 23 note.

Several U.S. consumer giants echoed the downward trend in their latest earnings reports.
Apple said Greater China sales fell by 6.5% year-on-year in the quarter ended June 29. Johnson and Johnson said China is a “very volatile market” and a major business segment that’s performed below expectations.
After a “strong start” to the year, General Mills CFO Kofi Bruce said the quarter ending May 26 “saw a real souring or downturn in consumer sentiment,” hitting Haagen-Dazs store traffic and the company’s “premium dumpling business.” General Mills owns the Wanchai Ferry dumpling brand.
The company’s China organic net sales fell by double digits during the quarter.

We don’t expect the return to the growth rates that we saw pre-Covid.

Andre Schulten

The regional results are also affecting longer-term corporate outlooks.
In China, “we don’t expect the return to the [double-digit] growth rates that we saw pre-Covid,” Procter and Gamble CFO Andre Schulten said on an earnings call last week. He expected that over time, China would improve to mid-single-digit growth, similar to that in developed markets.
Procter and Gamble said China sales for the quarter ending late June fell by 9%. Despite declining births in China, Schulten said the company was able to grow baby care product sales by 6% and increase market share thanks to a localization strategy.
Hotel operator Marriott International cut its revenue per available room (RevPAR) outlook for the year to 3% to 4% growth, due largely to expectations that Greater China will remain weak, as well as softer performance in the U.S. and Canada.
Marriott’s RevPAR Greater China fell by about 4% in the quarter ended June 30, partly affected by Chinese people choosing to travel abroad on top of a weaker-than-expected domestic recovery.
However, the company noted it signed a record number of projects in the first half of the year in China.
McDonald’s also affirmed its goal to open 1,000 new stores in China a year.
Domino’s said its China operator, DPC Dash, aims to have 1,000 stores in the country by the end of the year. Last week, DPC Dash said it had just over 900 stores as of the end of June, and that it expects first-half revenue growth of at least 45% to 2 billion yuan ($280 million).

Local competition

Coca-Cola noted “subdued” consumer confidence in China, where volumes fell in contrast to growth in Southeast Asia, Japan and South Korea. Asia Pacific net operating revenue fell by 4% year-on-year to $1.51 billion in the quarter ended June 28.
“There’s a general macro softness as the overall economy works through some of the structural issues around real estate, pricing, etc.,” Coca-Cola Chairman and CEO James Quincey said on an earnings call.
But he attributed the drop in China volumes “entirely” to the company’s shift from unprofitable water products in the country toward sparkling water, juice and teas. “I think the sparkling volume was slightly positive in China,” Quincey said.
Having to adapt to a new mix of products and promotions was a common occurrence in U.S. companies’ earnings calls.
“We’ve continued to face a more cautious consumer spending and intensified competition in the past year,” Starbucks CEO Laxman Narasimhan said on an earnings call. “Unprecedented store expansion and a mass segment price war at the expense of comp and profitability have also caused significant disruption to the operating environment.”
Starbucks reported China same-store sales dropped by 14% in the quarter ended June 30, far steeper than the 2% decline in the U.S.
Chinese rival Luckin Coffee, whose drinks can cost half the price of one at Starbucks, reported a 20.9% drop in same-store sales for the quarter ended June 30.
But the company claimed sales for those stores surged by nearly 40% to the equivalent of $863.7 million. Luckin has more than 13,000 self-operated stores, primarily in China.
Starbucks said its 7,306 stores in China saw revenue drop by 11% to $733.8 million during the same quarter.
Both companies face many competitors in China, from Cotti Coffee on the lower end to Peet’s on the higher end. The only public disclosures regarding Peet’s China business described it as “strong double-digit organic sales growth” in the first half of the year.

Bright spots

Not all major consumer brands have reported such difficulties.
Canada Goose reported Greater China sales grew by 12.3% to 21.9 million Canadian dollars ($15.8 million) in the quarter ended June 30.
Athletic shoe brands also reported growth in China, while warning of slowdown ahead.
Nike reported 7% year-on-year growth in Greater China revenue — nearly 15% of its business — for the quarter ended May 31.
“While our outlook for the near term has softened, we remain confident in Nike’s competitive position in China in the long term,” said Matthew Friend, CFO and executive vice president of the company.
Adidas reported 9% growth in Greater China revenue for the quarter ended June 30. The region accounts for about 14% of the company’s total net revenue.
CEO Bjorn Gulden said on an earnings call that Adidas was taking market share in China every month, but local brands posed fierce competition. “Many of them are manufacturers that go then straight to retail with their own stores,” he said. “So the speed they have and the price value they have for that consumer was different than it was earlier. And we are trying to adjust to that.”
Skechers reported 3.4% year-on-year growth in China in the three months ended June 30.
“We continue to think China is on the road to recovery,” Skechers CFO John Vandemore said on an earnings call. “We expect a better second half of the year than what we’ve seen thus far, but we are watching things carefully.”
— CNBC’s Robert Hum and Sonia Heng contributed to this report. More

Investors may want to consider bonds to help navigate the market’s recent volatility.
Joanna Gallegos, BondBloxx co-founder and CEO, recommends prioritizing income and high-yield bonds.

“It can be really important to start looking at fixed income as you start to diversify and manage more risk,” she told CNBC’s “ETF Edge” on Monday.
Gallegos also suggests moving out on the yield curve.
“Fixed income is very different today than it was two years ago,” she said. “We’re at the end of the great rate hike. So, rates are high, and that makes a lot of difference in a portfolio today than it did when we started out with rates being almost at zero.” 

Arrows pointing outwards

PIMCO’s Jerome Schneider, who manages one of the biggest actively managed bond exchange-traded funds in the world, also advises investors to look toward bonds.
“They’re entering these market conditions with a generally underweight posture to fixed income,” the firm’s head of short-term portfolio management said. “What we’re seeing here is that there are better risk-adjusted returns by being an actively managed, fixed income diversified portfolio than there have been in many years.”

Schneider predicts the Federal Reserve will start cutting rates this year and warns money market funds will likely see yields ebb “pretty quickly.”
“Favoring the front part of the yield curve is a place that we think is … most attractive at this point in time,” Schneider said. “In the 2-, 3-, [and] 5-year spaces, there’s plenty of opportunities across diversified portfolios to look.”

Don’t miss these insights from CNBC PRO

Disclaimer More