In this episode of the Connector Podcast, host Koen van der Hooijdonk interviews Marissa from Performative, a Copenhagen‑based wealth‑tech scale‑up. Marissa explains how Performative built DORAEdge, a standalone SaaS solution designed to help regulated financial entities meet the EU Digital Operational Resilience Act (DORA). The conversation covers the regulatory backdrop – the EBA’s Register of Information template, its 12‑tab data‑point model, and the need for a dynamic, continuously updated view of an organization’s ICT network. Marissa describes how DORAEdge turns the static spreadsheet into a real‑time database that supports cross‑functional teams (GRC, procurement, IT, legal) in managing third‑party dependencies, assessing provider resilience, and maintaining compliance documentation. The platform includes an end‑to‑end incident‑management module that guides users through DORA’s strict reporting timelines (24‑hour initial, 72‑hour interim, 30‑day final) and stores incident data for future risk analysis. A policy‑governance module, enhanced with a large‑language‑model (LLM) assistant, helps users upload, map, and gap‑fill policy documents against over 200 identified DORA controls, providing thematic, article‑level guidance. Marissa also outlines upcoming roadmap items: multi‑entity collaboration with granular access controls, deeper integrations with external GRC and policy‑management tools, and continued automation of compliance monitoring. The episode ends with a call‑to‑action, inviting regulated firms—from wealth managers to crypto platforms—to book a demo via doragedge.com.
Chapters
Welcome to the Connector Podcast, an ongoing conversation connecting fintechs, banks, and regulators worldwide. Join CEO and founder Koen van der Hooijdonk as you learn more about the latest available trends and solutions in the markets.
Welcome to another Connector Podcast, and today I'm with Marissa. Marissa, it's not your first time, and it's really nice to have people coming back to this podcast. So Tell us who you are, what you do, and who you represent.
Amazing. Well, thanks so much, Koen, and thanks everyone who's listening. I'm Marissa. I'm on the commercial team at Performative. We are a Copenhagen-based, 5-year-old wealth tech scale-up at this point. Why that's relevant is we've actually built a standalone product as well to help entities in the DORA realm too, to help with managing their compliance operations related to the new regulatory framework. which is why I'm excited to be here and to speak a little bit more about the platform today.
I think it has been more than 6 months, and the time we were talking, Dora was not yet in place. So what has changed and what has changed in your app? And maybe also a good opportunity to maybe reintroduce also DoraEdge to everyone here listening into the podcast.
So the Performative team decided to build an app called DoraEdge in Q3 of last year in response to many of our wealth management clients asking us for advice in terms of what they needed to do once the new DORA, the Digital Operational Resilience Act, new regulatory framework came into effect in the EU in January of 2025. So we built DORA Edge as a standalone product within our suite to not just help our wealth management clients, but actually entities across other sectors of, of the financial sector. So we're actually supporting large global international insurance institutions, stock markets, payments companies, the list really goes on from being single entities to multi-jurisdiction global firms. So we've built this app and of course the regulation went into effect in Q1. It's been an interesting period of time with the first regulatory reporting requirements that went into effect in April and some ongoing deadlines at the moment for each and every entity to submit a register of information that really shows the competent authorities and overall the financial sector supervisory authorities what their information communication technology network looks like, who are the primary vendors that they're using for cloud hosting to be able to operate their business and ultimately serve their clients and drive revenue for their organization.
Because indeed, I hear some clients actually struggling today with the register of information. Could you specify a little bit how you are then specifically helping them to complete this task?
Yeah. So the EBA has published a template, which is the register of information, which is 12 distinct tabs within a workbook. And if you're just looking at it, only 12, and they're all very interconnected. There's the data point model, which is a new updated model within the supervisory authority that states how all of this information needs to connect. So if you're an insurance company, you have multiple entities across different jurisdictions in the EU, and you need to then connect how do, within the group, how do these entities receive services from those information communication technology third-party providers?
Mm-hmm.
So if you are outsourcing any of your activities, who are you outsourcing to? What service are they providing? What critical function within your business or license activity are they impacting? And, you know, what is your assessment of that provider? So obviously there's a lot of talk in the world right now with the global political climate to really show what happens if a provider cannot offer those existing services to an entity like they might be receiving it today. What is the backup plan? You know, what if there's not only a cyber threat or a risk, natural disaster that might take down that—
Mm-hmm.
provider's ability to offer their service. But what if due to political reasons, a certain provider pulls out of supporting or providing services to a particular region, country, et cetera?
Mm-hmm.
So it's super, super critical. While there are definitely complaints, you know, from every client that we are working with right now, again, from small to really large institutions, in what is the sophistication of this data point model that is the, baseline formatting or foundational layer of the register of information. The fact of the matter is that the supervisory authority needs to have a better understanding for who are these critical providers within the European financial sector. How are our financial sectors who are regulated, you know, licensed entities, how are they impacted in case, you know, there could be a threat or a stoppage entirely of these services, and how could that potentially impact customers? So it is whether or not the right method forward, it is the first layer that is being done from a compliance and regulatory perspective.
And do you see a lot of impact within the compliance operations teams in terms of government and policies?
This is one of the, maybe not first regulations, but maybe first in a while that is impacting these financial entities in a cross-functional way. This is not just an IT issue. This is not just a legal issue. This is not just a compliance or a risk issue. So GRC, governance, risk, and compliance, is really coming together also with procurement, vendor management, contract management. So the IT function as well, to say, who are the providers that we're working with? How strong are they as providers in terms of their resiliency? our dependence upon their data, do we actually have backups in that need? And it's sort of the first time that compliance teams are held responsible for having a grasp of that and ensuring that their governance as well, so policies and procedures that they have in place appropriately cover what's happening across all of these different functions internally.
So could you almost state that because of doing the exercise of the register of information that you get an insight in your company and that therefore transparency creates a better resilience of what has happened or potentially should happen or could happen.
I think that's entirely the idea. Whether how effective it is, it is the exercise that every single regulated entity must follow. And if you don't submit the register of information, there will be ramifications for that. So it is at least the first layer for every single entity to do an assessment of What are their outsourced dependencies? Who do they have providing those services? And, you know, what could the potential impact be to a really critical business function in case that service goes down?
And I can understand you do that one time, but how does that look over time? Is there a, is there a way that DORA Edge is helping you to keep that filter sort of dynamic and keep it up to date?
Yes. So, I think many organizations are probably just using the EBA template, and that is, you know, a version spreadsheet that they submitted with a reference date of March 31st and uploaded it to their competent authority's regulatory portal. What we've done is actually take that data and make it more dynamic so that compliance, risk, IT teams can actually manage that data, have a glance of it in real time at any, any point throughout the year. So not just hitting that reporting deadline annually, but actually being able to interact with that data as if it were your complete ICT network database.
But how does it work when something happens? How do you support the event of an incident?
Absolutely. So we have an end-to-end incident management module. So some organizations might have a disparate system to manage this, but within DoraEdge, You have your full ICT network at your fingertips where we're helping you throughout the process of being able to understand the impact of that incident on your organization and satisfy those reporting requirements as quickly as possible. So for a lot of critical ICT vendors, Performative, the company that I work for as well, being that to many of our wealth management clients, we need to be able to abide by the DORA regulation in terms of helping our clients Provide information and work with them to achieve the time limit requirements for those reports. That being maybe 24 hours after a major incident needing to report initially, having 72 hours after that to provide an intermediate report, 30 days after resolution providing the final report. So what we're doing is helping these teams who are managing an incident in real time have the data at their fingertips and get those reporting requirements. execute it as quickly as possible, but by also then being able to store it, learn from it in the context of that ICT network. So you could say, oh wow, my cloud hosting provider has gone down 3 times this year. I should highly suggest to my IT team that we actually look at alternatives so that we can find a more suitable, reliable vendor to work with in the future.
Yeah, you're getting close to SLAs as well.
Exactly. Absolutely.
What I like about it is that compliance becomes a perpetual process and it's storing information, it's storing incidents. But there's one thing missing in the mix, and that's the policies, the rules of engagement. How does that work with Endora Edge?
This is my favorite module within Endora Edge because governance—
Luckily, I asked the question.
It can maybe because I designed it, but I really do find that when I'm sharing it with clients and walking them through, not just in a presales context, but actually in getting them up to speed on the app myself, they are relieved to see a tool that can really drive value for them and they can practically use. So the policy module is an excellent tool that sits in tandem with the ICT network management side of the app. And this is where the legal, the compliance team can maintain all of their DORA-related governance documents. So this could be the business continuity plan. This could be your third-party management. policy, everything that, that the DORA regulation requires that you have in the implementation side of compliance, you can store that within the app. And we've made a super cool module where we have some suggested controls that we think should be included within policies of certain types.
Mm-hmm.
If you were to upload a policy and say that this is for third-party provider management, you would select that button and then it would actually dynamically filter down the regulation to only provide you with articles where we think the controls are in place there in our interpretation should then be reflected back in that document. I think this can be a helpful tool for organizations who have not yet updated their policy documents pre-DORA, or if they already have gone through that process but do want to have that extra gut check or layer of confidence to know that they have everything included in there as possible.
Mm-hmm.
And so, you know, if we— if there are 46 or so different articles within the DORA regulation, we've identified 200+ overall controls and requirements that an organization should put in place. But instead of having to go through every single article or requirement one by one, it does so in a more thematic way.
And responsibility is always with the company themselves.
Absolutely. And that's— I explained the functionality of the product, but the human needs to be a part of that process. And needs to be at the forefront of it too. So we have actually built an LLM within the app, but we recommend it to be the second line of defense. So this is a tool where you can upload your policy document and say, here's my business continuity plan. I have done the mapping based upon my review and performative suggested requirements.
Mm-hmm.
But what are the gaps? How, you know, how would you recommend that I account for this type of control in my existing document to ensure that It fully fulfills my obligation to the DORA regulation for this particular type of document. So we have definitely made this a process so that it's more efficient for the human, so for the legal or compliance expert within the financial entity, but that they have tech to enable them through that process.
Yeah, we should not forget that many of the wealth managers don't necessarily have 10,000 compliance officers working for them.
Absolutely. So if you're an independent wealth manager, you have a pretty lean business operation. Absolutely. So we highly recommend, you know, working with— if you don't have that expertise in-house, we can help connect you to legal expertise external to your organization. But the policy element, we want to make the process more efficient, but it really is an entity-level approach to fit that business best.
No, interesting. We're almost at the end of this podcast, and what I always want to do at the end is to look forward. What's the future? And I really liked when you said there's human-like compliance rules. Is that the next thing in DORA?
Absolutely. So within DORA Edge, we have made this DORA regulation compliance tool. So with that, again, you get to manage your ICT network, maintain a risk register, track, manage, report incidents, and do all of your governance in one place. But we know that There are many clients today who we're working with who are in multi-entity international groups. And so we're making the platform even more feasible so that collaborative teams across time zones, across different functions have the right ACL. So permissions, access levels, viewability, or viewing into particular records. And that when it comes to an incident coming through, you know, who is your line of attack? Who is there to to follow along in that incident process to make sure it gets through resolution as quickly as possible? Who is managing a provider contract and ensuring that we are assessing it every, every year, but also that we are proactively looking out for concerns that we should be assessing in, in the interim as well? So all of the enhancements that we are continuing to make to the product is to, you know, continue to make it incredibly strong for the purposes of DORA. So we're building it out internally to make enhancements, but also brand new product features. And then we're also looking at third parties. So really strong integrations that we can bring into the mix. Think GRC tools that don't have a DORA framework, policy management tools where you need to make sure that every single employee has read through and approved every policy on an annual basis. How can we then make sure from an executional standpoint, there are the right monitors in place? Call it multifactor as an example, to ensure that you are running a compliant organization in, in the day-to-day and not just saying that you are. So we've heard from some of the larger institutions that we're working with. It is amazing to finally have one tool to bring it all in one place when they might already have, you know, a separate compliance, a separate legal, multiple IT platforms already. But here's their source of truth for DORA, and they can pull in that data where needed to ensure that they can fulfill the reporting requirements.
Super exciting. And I guess I'll need to end up like I ended up last time. So how can people be part of this journey?
Well, we would love to have conversations with any regulated financial entity, again, from wealth management through crypto. It really spans to see, you know, where are you today? What challenges did you face when you were going through the register of information process? But what gaps do you have to ensure that you're fulfilling all of the additional obligations under DORA to ensure that your organization really is compliant throughout the year? So our website is doragedge.com. You can book a demo with me directly. I would be more than happy to have a discovery conversation and show you the platform's capabilities.
Excellent.
Talk more about what's on the product roadmap And see what gaps we can help fill and value we can drive to your organization.
Marisa, thank you very much for having you again in our podcast, and I hope to see you again in the next 6 months. So we're curious to know what's the next update. But for now, thank you very much to you, but also to the listeners, and stay tuned. More news from the financial industry will come in this podcast.
Thanks, Koen.
Bye-bye.
Thanks for listening to another episode of the Connector Podcast. To connect and keep up to date with all the latest, head over to www.jointheconnector.com or hit subscribe via your podcast streaming platform.
