DORA and ICT third-party providers: what financial entities need from their suppliers

01Where DORA stands in autumn 2026

The Digital Operational Resilience Act (opens external site), Regulation (EU) 2022/2554, has applied since 17 January 2025. As a regulation it applies directly in every Member State; national law mainly designates the competent authorities and sets the penalties. The detail sits in technical standards adopted by the Commission on the ICT risk-management framework, incident classification and reporting, the register of information, contractual policies, subcontracting and threat-led penetration testing.

For financial entities, DORA is the sector-specific act that takes the place of the NIS2 rules on ICT risk management, incident reporting and supervision. On 18 November 2025 the three European Supervisory Authorities (EBA, EIOPA and ESMA) published (opens external site) the first list of critical ICT third-party providers that they oversee directly.

02Financial entities and their ICT providers

DORA covers twenty types of financial entity, from credit institutions, payment and electronic money institutions and investment firms to crypto-asset service providers, trading venues, fund managers, insurers, insurance intermediaries, occupational pension institutions, credit rating agencies and crowdfunding platforms. Proportionality is built in: Article 4 scales the requirements to size, risk profile and complexity, and Article 16 sets a simplified framework for some smaller entities.

An ICT third-party service provider is any undertaking that provides ICT services, and DORA defines those broadly: digital and data services provided through ICT systems to internal or external users on an ongoing basis. Hosting, managed services, software as a service, application maintenance and support, and data services typically qualify. Suppliers are not supervised under DORA unless they are designated as critical, but their customers carry the obligations into every contract.

03The management body carries the ICT risk

Article 5 gives the management body the ultimate responsibility for ICT risk. It defines, approves and oversees the ICT risk-management framework, sets the digital operational resilience strategy and risk tolerance, approves the business continuity policy and the response and recovery plans, and approves and reviews the policy on the use of ICT services from third-party providers. Its members must keep their knowledge up to date, including through regular training.

04Major incidents: 4 hours, 72 hours, one month

Financial entities classify ICT-related incidents on criteria set out in Article 18 and detailed in Delegated Regulation (EU) 2024/1772 (opens external site): clients and transactions affected, duration and downtime, geographical spread, data losses, criticality of the services affected and economic impact. A major incident is reported to the competent authority in three steps, with time limits set by Delegated Regulation (EU) 2025/301 (opens external site):

Clients whose financial interests are affected must be informed without undue delay. A financial entity may outsource the reporting itself to a third party, but it stays fully responsible for it (Article 19(5)).

For suppliers this is concrete. Every ICT contract must include the provider’s obligation to assist when an incident related to its service occurs, at no additional cost or at a cost agreed in advance (Article 30(2)(f)). The customer’s four-hour window only works if the supplier’s monitoring, logs and contacts are in place before the incident.

05Testing, up to threat-led penetration tests

Article 24 requires a risk-based testing programme, carried out by independent internal or external testers, with appropriate tests at least yearly on all ICT systems and applications that support critical or important functions. Entities identified by their competent authority must also carry out threat-led penetration testing at least every three years, on live production systems, under Delegated Regulation (EU) 2025/1190 (opens external site), which follows the TIBER-EU framework.

When a supplier’s services are in scope of a TLPT, the financial entity must ensure the supplier takes part (Article 26(3)), and contracts for critical or important functions must include that obligation (Article 30(3)(d)). If a supplier’s participation could harm its other clients, DORA allows pooled testing, in which the supplier contracts an external tester directly on behalf of several financial entities (Article 26(4)).

06ICT third-party risk: strategy, register and exit

Article 28 makes ICT third-party risk part of the ICT risk-management framework, and the financial entity remains fully responsible for compliance whatever it outsources. The main duties:

• A strategy on ICT third-party risk, including a policy on ICT services that support critical or important functions, reviewed regularly by the management body.
• A register of information on all contractual arrangements for ICT services, at entity and group level, that distinguishes the arrangements supporting critical or important functions. The templates are set by Implementing Regulation (EU) 2024/2956 (opens external site). Entities report on it to their competent authority at least yearly and provide the full register on request.
• Due diligence before signing: whether the service supports a critical or important function, the risks including concentration risk, the supplier’s suitability and any conflicts of interest. Suppliers must apply appropriate information security standards, and for critical or important functions the most up-to-date and highest quality ones.
• Termination rights, among other things for a significant breach by the supplier, evidenced weaknesses in its ICT risk management, or circumstances that prevent effective supervision.
• Exit strategies for ICT services supporting critical or important functions, documented and tested, so the entity can leave without disrupting its business, limiting its compliance or harming the services to its clients.

What the contract must say

Article 30 sets the minimum contract terms. Every ICT contract has to be in writing, in one document that includes the service levels, and cover at least:

• a complete description of the functions and services, and whether, and on which conditions, subcontracting is allowed;
• the locations where services are provided and data is processed and stored, with advance notice of any change;
• availability, authenticity, integrity and confidentiality of data, including personal data;
• access to, recovery and return of data in an easily accessible format on insolvency, discontinuation or termination;
• service level descriptions;
• assistance during ICT incidents related to the service, at no additional cost or at a cost agreed in advance;
• full cooperation with the competent and resolution authorities;
• termination rights and minimum notice periods;
• participation in the entity’s ICT security awareness programmes and resilience training.

For services supporting critical or important functions, Article 30(3) adds precise quantitative and qualitative performance targets, notice and reporting duties, business contingency plans that the supplier implements and tests, participation in TLPT, unrestricted rights of access, inspection and audit for the entity and its supervisor, and an exit strategy with a mandatory transition period. Delegated Regulation (EU) 2025/532 (opens external site) adds what the entity must assess when such services are subcontracted.

07Critical ICT third-party providers

Under Article 31, the European Supervisory Authorities designate ICT providers that are critical for the financial sector, based on their systemic impact, the importance of the financial entities that rely on them, their role in critical or important functions and how easily they can be replaced. Each critical provider gets a Lead Overseer, one of the three authorities, which can request information, carry out investigations and inspections, and issue recommendations.

The first list (opens external site), published on 18 November 2025, designated 19 providers, from cloud and data centre operators to telecoms, IT services, market data and enterprise software companies. Designation does not lift any duty from the financial entity: it still keeps the register, the contract terms and an exit strategy for each of these providers.

08What an ICT provider should have ready

Most suppliers to financial entities will never be designated as critical, but all of them meet DORA through contracts, due diligence and audits. A supplier with the following in place shortens procurement and makes its customer’s dialogue with the supervisor easier:

• Register data. What the customer needs for its register of information: legal entity and identifiers, the services provided and the functions they support, locations, and the subcontractors in the chain.
• Contract terms that match Article 30. Ideally a standard DORA addendum that covers both lists, instead of negotiating each clause from scratch.
• Incident evidence. Monitoring, logs with reliable timestamps and a notification procedure that lets the customer classify and report within hours.
• Tested continuity. Business contingency plans and restore tests, with dates and results.
• Security you can show. Information security standards, access control, a secure development lifecycle and vulnerability handling, with independent evidence where possible.
• Audit and test readiness. A workable way to host audits and inspections, and to take part in TLPT, including pooled testing where it fits.
• An exit plan. Data return in usable formats, documentation and transition support for an agreed period.

This is how we work as an ICT supplier to financial entities: we agree the contract provisions DORA requires, notify incidents through the agreed channel, document exit plans, take part in resilience testing and supply the information your register needs. Our page on trust and compliance describes how we work, including our information security management system certified to ISO/IEC 27001.

09A practical plan for both sides

1. 01Complete the register. Link every ICT contract to the functions it supports and mark the critical or important ones.
2. 02Close the contract gaps. Compare each contract with Article 30 and agree an addendum where terms are missing.
3. 03Align incident handling. Agree classification inputs, contacts and notification times with each critical supplier, and test them.
4. 04Plan testing with suppliers. Include them in the testing programme and, where relevant, in the scoping of a TLPT.
5. 05Write and test exit strategies. For each critical or important function: alternatives, data return and transition period.
6. 06Watch concentration. Several critical functions on the same provider is a risk to document and manage (Article 29).

10Your competent authority

DORA is the same text everywhere, but supervision is national for most financial entities: the central bank, the prudential supervisor or the markets authority, depending on the type of entity, and the ECB for significant banks. The format and channel for the register of information and for incident reports, and the authority responsible for TLPT, are set at national level. Check the guidance of your own authority.

11What to watch in the coming months

• The supervisory priorities and findings of your competent authority on the register of information and incident reporting.
• Oversight of critical ICT third-party providers by the Lead Overseers, and any recommendations that touch services you use.
• The Commission’s Digital Omnibus proposal (opens external site), COM(2025) 837, which would make DORA major incident reports go through a single entry point run by ENISA. In October 2026 it was still before the European Parliament; until it is adopted and applies, current channels and time limits remain.

Organisations outside the financial sector meet similar supply-chain duties under NIS2; see our article on NIS2 and software suppliers. The European Supervisory Authorities keep an overview of the technical standards and the oversight framework on their DORA pages (opens external site).