Innovative mechanisms of state regulation of information security of financial institutions in Ukraine in the context of dora implementation and suptech tools development

Abstract

The article is devoted to the study of Ukraine’s transition from fragmented ICT- security regulation toward a fully-fledged Digital Operational Resilience framework that mirrors the requirements of EU Regulation 2022/2554 (DORA). It outlines the wartime pressures that have accelerated this shift, details the National Bank of Ukraine’s three-pillar SupTech architecture (incident-reporting API, regulatory sandbox, real-time supervisory dashboard) and argues that automated compliance is not a discretionary upgrade but a macro-prudential necessity that preserves investor confidence and systemic liquidity.

Examined are the economic and legal incentives that make DORA alignment financially viable even for under-capitalised institutions. Scenario modelling shows that avoided outage losses, lower cyber-insurance premia and access to Eurosystem threat-intelligence platforms deliver a positive net present value within two supervisory cycles. The analysis further highlights the cost-of-compliance-as-a-service market: while bundled cloud solutions reduce initial expenditure, they raise questions about data sovereignty and third-party concentration risk, which the draft Law “On Digital Resilience of the Financial Sector” seeks to balance through localisation clauses and annual provider stress tests.

Explored in depth are the technological underpinnings of the proposed SupTech platform. A microservice architecture integrates graph databases, BERT-based semantic parsers and Deep SVDD anomaly-detection algorithms, cutting average incident-detection time from twenty- seven to nine minutes in pilot trials. The platform’s design embeds GDPR impact-assessment fields directly into DORA incident messages, thereby eliminating reporting duplication and aligning with European Data Protection Board guidance on cross-regime notifications.

Particular emphasis is placed on the human-factor dimension, identifying the Technology Risk & Resilience Officer certification, shared-responsibility cloud clauses and continuous skills-training as indispensable complements to automation. The study concludes that only a synchronized fusion of advanced analytics, robust legal scaffolding and security-minded organisational culture will allow Ukrainian financial institutions to guarantee uninterrupted critical services, accelerate EU financial-market integration and reinforce national economic security in an era of persistent hybrid threats.