#
The US has no single statutory operational-resilience regime equivalent to EU DORA; resilience is delivered through supervisory guidance from the prudential banking agencies. The cornerstone is the June 2023 Interagency Guidance on Third-Party Relationships: Risk Management (Fed/FDIC/OCC), applying to all supervised banking organisations. Operational resilience and cybersecurity remain top supervisory priorities per the OCC's FY2025 operating plan.
Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. Open this jurisdiction's page on Dataprotection.gi →
The analytical point of structural significance is that the US has no single statutory operational-resilience regime equivalent to EU DORA. Resilience is delivered through layered supervisory guidance, which is a material structural divergence for global payment service providers that operate across both regimes and must reconcile a statutory European framework against a guidance-based US framework.
Outlook
The Interagency TPRM guidance is stable standing knowledge and is the settled US approach to third-party and operational-resilience risk for the supervised banking sector. There is no current signal of a move toward a DORA-style statute; the supervisory-guidance model is the durable US position, and the trajectory is stable. The principal forward-looking consideration is continued supervisory emphasis on resilience and cybersecurity reflected in the OCC's planning priorities.
Operational Resilience & Critical Infrastructure
The United States has no single statutory operational-resilience regime equivalent to the EU's Digital Operational Resilience Act (DORA); resilience expectations are instead delivered through supervisory guidance. The Federal Reserve, FDIC and OCC's final Interagency Guidance on Third-Party Relationships: Risk Management, finalised June 6, 2023, is the functional US equivalent, and it applies to all supervised banking organisations regardless of size — including institutions with $10bn or less in total assets, which had previously received lighter-touch treatment under some prior frameworks. Under the guidance, examiners assess third-party operational resilience, incident-reporting practices, business-continuity-plan test results and telecom redundancy as part of ordinary supervisory review. The OCC's FY2025 supervisory plan reaffirms resilience and cybersecurity as continuing top priorities, indicating this guidance-based approach remains the active US posture rather than a transitional one pending statutory reform.
Outlook
Absent congressional action, the interagency guidance framework is likely to remain the US resilience baseline for the foreseeable future, with incremental tightening delivered through supervisory priorities and bulletins rather than new legislation — a structural divergence from the EU's statutory DORA model that global PSPs operating across both jurisdictions must continue to navigate as two materially different compliance architectures.
1 further periodic run re-emitted the standing brief unchanged and is not shown.
Sources and findings (4)
- T1Federal Register / OCC Bulletin 2023-17 — In June 2023 the Federal Reserve Board, FDIC and OCC issued final uniform Interagency Guidance on Third-Party Relationships: Risk Management (final as of June 6, 2023), replacing each agency's prior guidance and applying to all supervised banking organisations.
- T1Federal Reserve CA Letter 24-02 — The guidance applies to all institutions supervised by the Federal Reserve, including those with $10bn or less in total consolidated assets, and sets sound risk-management principles across the full life cycle of third-party relationships.
- T1OCC Cybersecurity and Financial System Resilience Report 2025 — The OCC views operational resilience and cybersecurity as top issues for the federal banking system, reiterated as key priorities in its FY2025 Bank Supervision Operating Plan, citing ransomware and DDoS threats.
- T1Federal Reserve FRRS guidance — The interagency guidance expects banks to assess a third party's operational resilience and incident-reporting/management processes, including business-continuity test results, telecom redundancy, and dependency on single providers for multiple activities.