DORA for ICT service providers: what financial customers now ask for in your contract
A software company that sells to a few banks and an insurer gets three contract amendments in one quarter. Each is called something like “DORA addendum”. One asks for unrestricted audit rights. One wants a list of every subcontractor and the countries where data is processed. One asks the company to take part in the bank’s penetration tests. The sales team wants to sign quickly. Legal wants to know what is actually required and what is a bank asking for more than the law says.
Key takeaways
- DORA applies to financial entities such as banks, insurers, investment firms and payment institutions. It has applied since 17 January 2025.
- ICT providers feel it through contracts. Financial entities must manage ICT third-party risk and put specific clauses into every ICT contract.
- Article 30 sets the minimum content. Contracts for services that support critical or important functions need considerably more.
- Your customer has to list you in its register of information, so expect questions about your services, locations and subcontractors.
- A small number of providers are directly supervised as critical ICT third-party providers. The first list of 19 was published in November 2025.
- Prepare once: a standard DORA annex, a current subcontractor list and evidence for the security questions.
Why DORA reaches you
DORA, Regulation (EU) 2022/2554, sets rules for the digital operational resilience of the financial sector. Chapter V deals with ICT third-party risk. Financial entities remain fully responsible for their compliance when they outsource, so they have to assess providers before signing, monitor them during the contract and be able to exit. Most of these duties land on the provider as contract clauses, questionnaires and audit requests.
The key distinction is whether your service supports a critical or important function of your customer. That is a function whose disruption would materially impair the customer’s financial performance, the soundness or continuity of its services, or its compliance with its licence. Your customer makes that assessment, not you. Ask for the result, because it decides how much of Article 30 applies.
What Article 30 requires
For every ICT contract, Article 30(2) requires among other things:
- a clear description of the services, including whether services supporting critical or important functions may be subcontracted,
- the locations where services are provided and data processed, with a duty to notify changes,
- provisions on data security and on access, recovery and return of data if the contract ends or the provider fails,
- service level descriptions,
- help with ICT incidents related to the service at no additional cost or at a cost agreed in advance,
- full cooperation with the customer’s supervisors,
- termination rights with minimum notice periods,
- participation in the customer’s security awareness and resilience training where relevant.
For services that support critical or important functions, Article 30(3) adds:
- full service level descriptions with precise quantitative and qualitative targets,
- notice periods and reporting duties for developments that could affect the service,
- business contingency plans that you implement and test, and security measures that give an appropriate level of protection,
- participation in the customer’s threat-led penetration testing where it applies,
- unrestricted rights of access, inspection and audit for the customer, an auditor it appoints and its supervisor,
- exit strategies with an adequate transition period.
Subcontracting and the register of information
Financial entities have to keep a register of information on all contractual arrangements for ICT services, with a fixed set of fields defined in an implementing regulation. For you, that means your customer needs data such as your legal entity identifier, the services you provide, where they run and, for services supporting critical or important functions, the relevant subcontractors in the chain.
Since 22 July 2025, Delegated Regulation (EU) 2025/532 also sets out what a financial entity must assess before it allows subcontracting of ICT services that support critical or important functions, and what happens when subcontracting arrangements change materially. Expect questions about who your key subcontractors are, how you select and monitor them and how you will notify changes.
Critical ICT third-party providers
A separate regime applies to providers the European Supervisory Authorities designate as critical, such as large cloud providers. They are subject to direct oversight by a lead overseer. The ESAs published the first list of 19 critical ICT third-party providers on 18 November 2025 and review it every year. Most software and service companies that sell to financial customers are not on that list. They are affected through contracts, as described above.
How to prepare
- Map your financial customers and ask each whether your service supports a critical or important function.
- Write a standard DORA annex that covers Article 30(2) and, as an option, 30(3). Offer it before the customer sends its own.
- Keep a current list of subcontractors with services, locations and data processed, and a process to announce changes.
- Document your incident support: what you provide, how fast and at what cost.
- Define audit access in a way you can live with: pooled audits, reports such as ISO 27001 or SOC 2 as a first step, and on-site access with notice.
- Prepare an exit plan per service: data export formats, transition support and timeframes.
- Test your continuity plans and keep the results. A plan that has never been tested will not satisfy Article 30(3).
Where providers lose time
- Signing every addendum as drafted. Some clauses go beyond DORA. Know what the regulation requires before you negotiate.
- Refusing audit rights outright. For critical services the regulation requires them. Agree the method, not whether.
- An outdated subcontractor list. It is one of the first things a bank checks, and one of the easiest to keep current.
- Treating DORA as a legal topic only. Most clauses describe operational capabilities your security team has to deliver.
- Answering each customer from scratch. The questions repeat, so keep the answers in one maintained source.
Our DORA page shows how GetTeddy supports checking ICT contracts against Article 30, and the page for legal teams explains how the Contract Agent supports contract reviews.
