Selling Software to Banks and Insurers: What DORA Means for ICT Providers

How DORA reaches you

Under DORA (Regulation (EU) 2022/2554), an ICT third-party service provider is any undertaking providing ICT services, meaning digital and data services provided through ICT systems on an ongoing basis (Article 3(19) and (21)). SaaS, hosting, managed IT, data feeds and hardware as a service all qualify. Your obligations come through four channels:

The clauses you will be asked to sign

For every ICT service (Article 30(2)):

• a clear description of all functions and services, and whether subcontracting of critical or important functions is allowed and on what conditions;
• where services are provided and data processed and stored, with advance notice of any change of location;
• data availability, authenticity, integrity and confidentiality provisions;
• access, recovery and return of data in an easily accessible format on your insolvency, resolution, discontinuation or contract termination;
• service level descriptions;
• assistance in ICT incidents related to your service, at no additional cost or at a cost agreed in advance;
• full cooperation with the customer's competent and resolution authorities;
• termination rights and minimum notice periods;
• your participation in the customer's ICT security awareness and resilience training.

If your service supports a critical or important function, add (Article 30(3)): precise quantitative and qualitative service levels; notice of developments that may affect your service; business contingency plans that you implement and test, and appropriate security measures; participation in the customer's threat-led penetration testing where it is required; unrestricted rights of access, inspection and audit for the customer, an appointed third party and the authority, with alternative assurance levels possible where other clients' rights are affected; and exit strategies with a mandatory adequate transition period. See the full list in our Article 30 checklist.

Termination rights you cannot negotiate away: the customer must be able to terminate in the cases of Article 28(7), including a significant breach of law or contract by you, evidenced weaknesses in your ICT risk management, and where the authority can no longer effectively supervise the customer because of the arrangement.

Subcontracting critical services

Where you subcontract ICT services that support a customer's critical or important functions, Delegated Regulation (EU) 2025/532 applies through your contract. Expect to:

• remain responsible for the services your subcontractors provide, and monitor them;
• flow down the customer's audit and access rights, contingency, service level and security requirements to subcontractors;
• assess the risks of subcontractors' locations and ensure continuity throughout the chain;
• give the customer advance notice of material changes to subcontracting, with a period in which it can object, and not implement them until it has approved or not objected (Article 5); the customer may terminate if you go ahead anyway (Article 6).

Your identifiers and subcontractors in the register

Your customers must identify you in their register of information by a valid and active Legal Entity Identifier (LEI) or a European Unique Identifier (EUID), and, for services supporting critical or important functions, list the subcontractors in the chain (Implementing Regulation (EU) 2024/2956). If you do not have an LEI, getting one removes friction from every financial customer. See the DORA register of information.

Direct oversight: only for critical providers

The European Supervisory Authorities can designate ICT providers as critical for the EU financial sector and oversee them directly (Article 31). The first list was published on 18 November 2025 and is reviewed yearly. Designation does not apply to providers serving only financial entities active in one member state from that state, to intra-group providers, or to financial entities providing ICT services to others (Article 31(8)). Most SaaS companies will never be designated; for them, DORA works through contracts.

How to get ready

1. Ask each financial customer whether your service supports a critical or important function; the answer decides which clauses and controls apply.
2. Prepare a standard DORA addendum covering Article 30(2) and (3), so negotiations start from your text.
3. Keep an evidence pack: security policy, certifications or audit reports, penetration test summary, business continuity and incident response plans, subcontractor list with locations.
4. Define how you notify customers of incidents and how fast, so they can meet their own major incident reporting deadlines.
5. Document data export and a transition plan you can actually run within an agreed period.
6. Obtain an LEI, and keep your subcontractor list and data locations current.

If you also sell to NIS2 entities, most of this overlaps with what they ask under NIS2 supply chain security.

Answer the questionnaire once. The Vendor Security Assessment Pack includes a security requirements addendum with a DORA Article 30 clause, a vendor security questionnaire, a vendor exit plan template, an onboarding checklist, a risk register and a data processing agreement.

Sources

• Regulation (EU) 2022/2554 (DORA), Articles 3, 28, 30 and 31, EUR-Lex
• Commission Delegated Regulation (EU) 2025/532: subcontracting of ICT services supporting critical or important functions, EUR-Lex
• Commission Delegated Regulation (EU) 2024/1773: policy on ICT services supporting critical or important functions, EUR-Lex
• Commission Implementing Regulation (EU) 2024/2956: register of information templates, EUR-Lex
• ESAs: European Supervisory Authorities designate critical ICT third-party providers (18 November 2025)

Related tools