Financial institutions have encrypted sensitive email for decades. The EU’s Digital Operational Resilience Act changes the standard by which that protection is judged.
The question is no longer simply whether a message was encrypted. Institutions must demonstrate that critical communication channels are governed, observable, resilient and recoverable. That means producing evidence across the message lifecycle, not relying on a policy document or a vendor checkbox.
Proof begins after the send button
Legacy reviews often capture one event: an outbound message was encrypted. But the risk continues after delivery. A recipient can reply, add another domain, forward content or download an attachment. Each action changes the exposure and may create a new control requirement.
Modern governance therefore needs message-level boundaries. The institution should be able to restrict who enters a reply chain, control forwarding and reconstruct recipient activity.
The latest Echoworx release provides practical examples. Portal reply-all controls can remove unrecognized domains, and controlled forwarding can keep messages within authorized boundaries. Per-recipient notification settings reduce unnecessary noise while preserving the audit record. These capabilities are not the main DORA story, but they show what continuous governance looks like at product level.
Audit evidence should flow into the institution’s control environment
Evidence locked inside a separate administrative console creates operational friction. Security and compliance teams need communication events inside the same systems used for monitoring, investigation and reporting.
Echoworx’s new Web Portal Audit API can send notifications, message reads, attachment downloads, replies and antivirus activity into a SIEM. The significance is correlation. A message event can be examined alongside identity, endpoint, gateway and threat signals rather than exported as an isolated report.
Institutions should test event completeness, timestamps, retention and retrieval. “We believe it was protected” is not defensible evidence. A documented sequence of policy and recipient events is.
Cryptographic assurance includes the lifecycle
DORA-driven resilience is undermined when certificate processes depend on manual work or institutional memory. Expired credentials, inconsistent key discovery and missing signing keys can interrupt critical communication.
The control should cover issuance, renewal, storage, ownership, discovery, rotation and revocation. Echoworx has expanded this area through integrations with DigiCert, SwissSign and AWS Private CA. These options allow automated S/MIME certificate activity while supporting different trust and ownership models.
Its latest release adds configurable 2048-, 3072- and 4096-bit RSA options for S/MIME and PGP, with 3072 bits as the new default. Dynamic recipient-key lookup, separate S/MIME and PGP discovery policies, sender-only signing enforcement and self-service decryption reduce manual intervention while strengthening assurance.
These details matter because operational resilience is built from ordinary processes. A certificate that renews correctly and a missing signing key that fails safely are more meaningful than a broad statement about “strong encryption.”
Sovereignty must include keys, regions and recovery
Financial institutions need to know where protected information is processed and who controls the cryptographic material. A hosting location alone does not answer that question.
Echoworx operates regional infrastructure in the United States, United Kingdom, Germany, Ireland and Canada. Its AWS-based architecture supports regional and dedicated deployment models. Manage Your Own Key uses AWS Key Management Service to give customers direct governance over key rotation and revocation, while AWS Private CA support allows certificate issuance to remain inside the enterprise’s managed authority.
For a DORA review, institutions should connect these controls to continuity: tested recovery, regional redundancy and evidence that keys and data remained within agreed boundaries.
Usability is part of operational resilience
Secure communication controls fail when customers and employees avoid them. Excessive registration, inaccessible authentication and confusing delivery options create workarounds that weaken governance.
Echoworx reports that an Irish commercial bank saw encryption adoption rise 63 percent after registration friction was reduced. A Canadian bank used its existing Sinch service to enforce two-factor authentication for external contacts while supporting alternate methods for users who did not want to provide a mobile number.
Adoption, completion rates and support incidents should be included in the control dashboard. A secure channel that legitimate recipients cannot use is not operationally resilient.
Supplier assurance helps, but does not replace testing
Financial institutions need suppliers that can provide independent evidence about their own security and resilience practices.
Echoworx is FSQS registered and has expanded supplier status into the Netherlands, supporting procurement assurance across European financial markets. It also reports annual SOC 2 review, PCI DSS Level 1 certification for Encrypted Mail and Secure Portal, AWS Qualified Software status and OpenID Connect RP certification.
Each accreditation supports a different part of due diligence: FSQS for supplier risk, SOC 2 for operational controls, PCI DSS for payment-data environments, AWS qualification for cloud architecture and OpenID Connect certification for identity integration.
None of these proves that a customer’s configuration is compliant. They provide a stronger foundation on which the institution can perform its own testing.
Secure communications resilience demands a community
Echoworx is an affiliate member of FS-ISAC and a confirmed sponsor of the 2026 Americas Fall Summit in Austin, Texas. This participation places the company within the financial sector’s shared work on threat intelligence, operational resilience and trusted technology ecosystems.
DORA’s secure-communications demands cannot be solved by any institution or technology provider in isolation. They require a community in which financial institutions, specialist providers and sector bodies exchange operational insight, test assumptions and turn regulatory obligations into resilient practice. Echoworx’s affiliate membership and summit sponsorship matter not merely as market exposure, but as participation in that feedback loop—bringing encryption expertise into sector-wide discussions while learning directly from the institutions responsible for demonstrating resilience.
A practical DORA evidence set for secure communications
A defensible program should be able to produce five categories of evidence.
Policy evidence should show how sensitive external communications are classified, which protection is applied and how exceptions are approved.
Identity evidence should demonstrate recipient authentication, recovery behavior and the handling of shared or exceptional access scenarios.
Cryptographic evidence should cover key ownership, certificate issuance and renewal, signing assurance and approved algorithm policy.
Operational evidence should record delivery, reads, downloads, replies, forwarding attempts, antivirus events and relevant administrative changes in a queryable timeline.
Resilience evidence should demonstrate regional architecture, tested recovery, supplier dependencies and the ability to maintain or restore secure communication during disruption.
The objective is continuous proof, not a binder prepared for the next audit.
The competitive advantage is a shorter distance to evidence
DORA raises the cost of ambiguity. Institutions that rely on fragmented legacy tools must spend more time proving how policies, keys, recipients and events fit together. Modern platforms reduce that distance by generating evidence as part of normal operation.
Echoworx is useful here as supporting context rather than the headline. Its five-region footprint, FSQS progress, AWS architecture, certificate-authority partnerships and latest audit capabilities form a coherent picture of a provider moving closer to financial-sector governance requirements. Reported deployments with global and Canadian banks add scale and operational proof.
The institution remains responsible. Encryption compliance is becoming continuous control. The winners will show, message by message, how sensitive external communication remains governed under ordinary conditions and under stress.
