PRMIA 8020 Exam Dumps

Definition of DORA

The Digital Operational Resilience Act (DORA) is a regulation by the European Union (EU) aimed at strengthening the digital resilience of financial institutions.

It establishes a regulatory framework for managing information and communication technology (ICT) risks in the financial sector.

Key Objectives of DORA

Ensures that financial institutions can withstand, respond to, and recover from cyber threats and ICT-related disruptions.

Introduces standards for risk management, incident reporting, and third-party ICT risk oversight.

Why Other Answers Are Incorrect

Option

Explanation

A . Domain for Operational Risk Act.

Incorrect -- No such regulation exists under this name.

B . Digital Operational Risk Act.

Incorrect -- The official name is Digital Operational Resilience Act (DORA).

C . Daily Operational Resilience Act.

Incorrect -- DORA is not focused on daily operations but rather long-term digital resilience.

PRMIA Reference for Verification

PRMIA Risk Governance & Digital Resilience Standards

European Commission's Official DORA Regulation

The FTX collapse involved fraudulent fund mismanagement, where FTX executives created a 'backdoor' to allow Alameda Research (FTX's sister trading firm) to borrow client funds without their consent.

Step 1: The 'Backdoor' in FTX

The backdoor was a hidden code in FTX's system, allegedly created by Sam Bankman-Fried, which allowed Alameda to access customer deposits without triggering alerts to auditors or compliance teams.

Alameda used these funds for risky trading strategies and investments, leading to the eventual collapse of FTX when a liquidity crunch exposed the missing funds.

Step 2: Why the Other Options Are Incorrect

Option A ('allowed a stablecoin to be removed from the ledger and added to the balance sheet')

Incorrect because FTX's fraud involved misuse of customer funds, not just a stablecoin misclassification.

Option C ('allowed currency traders to smooth profits and conceal losses for over two years')

Incorrect because this sounds more like LIBOR-rigging scandals, whereas FTX misappropriated client funds.

Option D ('allowed a rapid pace of acquisitions but poor integration of acquired companies')

Incorrect because FTX's collapse was due to financial fraud, not poor acquisition strategy.

PRMIA Risk Reference Used:

PRMIA Financial Crime Risk Management -- Discusses insider risk and fraudulent misappropriation of funds.

FTX Collapse Reports -- SEC, CFTC, and DOJ filings confirm that Alameda had unauthorized access to client funds.

Final Conclusion:

FTX's backdoor enabled Alameda to take $65 billion in client funds without permission, making Option B the correct answer.

Understanding Credit Risk and Operational Risk Overlap

In some cases, credit risk losses contain elements of operational risk, such as fraud, documentation errors, or IT failures affecting credit transactions.

Basel II and III frameworks require institutions to distinguish between pure credit risk losses and operational risk components within those losses.

Treatment of Losses

The credit-related portion is accounted for under credit risk capital calculations.

The operational risk portion (e.g., fraud-related losses) should be classified separately and included in operational risk databases for risk measurement.

Why Answer C is Correct

Basel III and PRMIA recommend a clear split between credit risk and operational risk components to ensure accurate risk modeling.

If operational risk elements are ignored, an organization may underestimate its true operational risk exposure.

Why Other Answers Are Incorrect

Option

Explanation

A . The entire loss amount is treated as credit risk.

Incorrect -- This ignores operational risk components that should be accounted for separately.

B . The entire loss amount is treated as operational risk.

Incorrect -- Credit risk losses are typically dominant in lending-related losses and should not be fully classified as operational risk.

D . The entire loss amount is treated as credit risk, but the loss is entered as a memorandum within the operational loss database and not used for capital modeling purposes.

Incorrect -- The operational risk portion must be considered for capital modeling, not just recorded as a memo.

PRMIA Reference for Verification

Basel II & III Guidelines on Credit and Operational Risk Integration

PRMIA Operational Risk Framework

Definition of Consumer Protection in Risk Management

Consumer protection ensures ethical business practices, transparency, and regulatory compliance.

It builds trust with customers and reduces legal and reputational risks.

Key Principles of Consumer Protection

Treating customers fairly Ensures honest and ethical financial services.

Prioritizing customer interests Prevents conflicts of interest and unfair treatment.

Honoring commitments Strengthens customer confidence and regulatory trust.

Why Answer C is Correct

Following these principles ensures regulatory compliance, customer satisfaction, and risk mitigation.

Why Other Answers Are Incorrect

Option

Explanation

A . Engage with consumers once there are enough complaints.

Incorrect -- Proactive engagement is essential; waiting for complaints is a reactive and poor risk management approach.

B . Add a consumer protection section to all reports.

Incorrect -- Documentation alone does not ensure fair treatment; actions matter more.

D . This risk cannot be managed.

Incorrect -- Consumer protection risks can and should be actively managed.

PRMIA Reference for Verification

PRMIA Consumer Protection & Fair Treatment Standards

Financial Conduct Authority (FCA) Consumer Duty Guidelines

Step 1: Definition of a Critical Business Service in Operational Resilience

A Critical Business Service is one whose failure could result in severe harm to customers, financial markets, or the firm's viability.

Regulators (e.g., Bank of England, Basel Committee, PRMIA) define three primary factors for identifying critical services:

Customer impact

Market integrity impact

Firm viability impact

Step 2: Why Option C Is Incorrect

Risk appetite is an internal business decision, not an external measure of criticality.

A service can be critical even if its disruption stays within risk appetite.

Criticality is based on external impacts, not just internal risk limits.

Step 3: Why the Other Options Are Correct

Option A ('Material customer detriment') Correct as customer harm defines critical services.

Option B ('Harm to market integrity') Correct as market stability is a regulatory priority.

Option D ('Threaten firm viability') Correct as critical services often determine business survival.

PRMIA Risk Reference Used:

PRMIA Operational Resilience Framework -- Defines criteria for critical business services.

Basel Committee Operational Risk Guidelines -- Highlights customer, market, and firm viability as resilience factors.

Final Conclusion:

Risk appetite is an internal benchmark, not a measure of critical service designation, making Option C the correct answer.