DORA in a sales conversation: what a bank will ask an ICT supplier

A bank buying from you under DORA will ask for four things: a contract that contains the clauses of Article 30, a due diligence file on your company, the data it must enter about you in its register of information, and, if your service supports a critical or important function, audit rights, subcontracting controls and an exit plan. DORA places the duty on the bank. You meet it as paperwork, and the vendor who has that paperwork ready closes months earlier than the one who meets it in legal review.

The state described here is as of November 2026. Technical standards and supervisory lists change, so check the official sources before you quote them to a customer. This is a guide for sales and partner teams, not legal advice.

what DORA is, and why it reads differently from NIS2

DORA is Regulation (EU) 2022/2554. It entered into force on 16 January 2023, has applied since 17 January 2025, and, in the words of its Article 64, is “directly applicable in all Member States”. There is no national transposition to wait for and no country table of dates. NIS2, Directive (EU) 2022/2555, is a directive: it binds member states, and reaches companies only as transposed into national law. The guide on NIS2 in a sales conversation covers that side.

DORA applies to the financial entities listed in Article 2: credit institutions, payment and e-money institutions, investment firms, insurers and reinsurers, crypto-asset service providers, fund managers and others. ICT third-party service providers appear in the same list, but for most vendors the obligations arrive through the customer.

The principle that shapes every conversation is in Article 28(1)(a): a financial entity using ICT services “shall, at all times, remain fully responsible” for compliance. The bank cannot hand its duty to you, so it builds controls around you instead. The detail sits in technical standards adopted by the Commission and published in the Official Journal.

DORA and the standards that reach suppliers

16 January 2023DORA enters into force

25 June 2024RTS on the policy for ICT third-party contracts published, Regulation (EU) 2024/1773

2 December 2024ITS on register of information templates published, Regulation (EU) 2024/2956

17 January 2025DORA applies

2 July 2025RTS on subcontracting published, Regulation (EU) 2025/532

18 November 2025ESAs publish the first list of critical ICT third-party providers

as of November 2026

what DORA asks of the bank, and what reaches you

Five duties of the financial entity turn into requests to you.

• Assess before signing. Article 28(4) requires the bank, before any ICT contract, to check whether the service supports a critical or important function, identify the risks, including concentration risk, and “undertake all due diligence” on the provider. Delegated Regulation (EU) 2024/1773 sets what the policy behind that due diligence covers.
• Keep a register. Article 28(3) requires a register of information on all ICT contracts, with yearly reporting to the competent authority, and a timely notice to the authority about any planned contract for services supporting critical or important functions.
• Write the clauses. Article 30 lists the minimum content of every ICT contract, with more for critical or important functions.
• Plan the exit. Article 28(8) requires exit strategies for services supporting critical or important functions, with plans that are documented, tested and reviewed.
• Report incidents. Article 19 requires financial entities to report major ICT-related incidents to their competent authority. You do not report to the bank’s supervisor. You help the bank report, under the assistance clause in your contract.

A “critical or important function” is defined in Article 3(22) as one whose disruption would materially impair the entity’s financial performance, the soundness or continuity of its services, or its compliance. The bank makes that call. Whether a privileged access tool or a SOC service counts depends on what it protects in that bank, and you will often learn the answer only when the longer annex arrives.

what DORA asks of the bank

directly, as a regulation

• Assess risks and do due diligence before signing, Article 28(4)
• Keep a register of all ICT contracts and report it yearly, Article 28(3)
• Put the Article 30 clauses in every ICT contract
• Hold tested exit plans for critical or important functions, Article 28(8)
• Report major ICT incidents, Article 19

what the bank will ask of you

through procurement and the contract

• A due diligence file: financials, security standards, certifications, audit reports
• Register data: LEI or EUID, headquarters, data locations, subcontractors
• A DORA annex signed with the contract
• Exit support and a transition period
• Incident assistance at no extra cost or a cost fixed in advance

the contract annex the bank will send

Most banks send a DORA addendum mapped to Article 30. Article 30(1) requires the rights and obligations to be set out in writing, with the full contract, including service levels, in one written document. Article 30(2) lists what every ICT contract contains at minimum:

• a full description of the services, and whether subcontracting of services supporting critical or important functions is allowed and on what conditions;
• the regions or countries where services are provided and data is processed and stored, with advance notice if you plan to change them;
• provisions on availability, authenticity, integrity and confidentiality of data;
• access to and return of data if you become insolvent, stop operating or the contract ends;
• service level descriptions;
• assistance when an ICT incident related to your service occurs, “at no additional cost, or at a cost that is determined ex-ante”;
• full cooperation with the bank’s competent and resolution authorities;
• termination rights and minimum notice periods;
• participation in the bank’s ICT security awareness and resilience training.

For services supporting critical or important functions, Article 30(3) adds full service levels with quantitative targets, notice of developments that could affect your service, tested business contingency plans, participation in the bank’s threat-led penetration testing, unrestricted rights of access, inspection and audit for the bank, a third party it appoints and its supervisor, and exit terms with a mandatory transition period.

The legal team on the other side usually has no authority to drop mandatory content. Argue about mechanics instead: how audits are scheduled, what evidence satisfies a request, how long the transition period runs and what it costs. Article 30(3)(e)(ii) itself allows “alternative assurance levels if other clients’ rights are affected”, which is the basis for pooled audits and report-first arrangements in a multi-tenant service. Treat this as a negotiation point for counsel on both sides. The guide on working with procurement covers how to trade on the commercial terms around it.

the due diligence questions and the register data

The questionnaire follows Article 6 of Delegated Regulation (EU) 2024/1773. For services supporting critical or important functions, the bank must check whether you have the reputation, resources, information security standards, risk management and internal controls to deliver, whether you use subcontractors, whether you process or store data in a third country, whether you accept audits including onsite, and whether you act ethically and responsibly. Article 6(3) lists the assurance the bank may rely on: its own audits, independent audit reports you provide, your internal audit reports, third-party certifications and other information. That list is why an up-to-date certification and an audit report under NDA shorten the review.

The register asks for exact data. The templates in Implementing Regulation (EU) 2024/2956 require, among other fields:

field in the register	what you provide
identification code	an LEI or EUID for a legal person; only an LEI if you are established outside the EU
legal name and headquarters	registered name and the country of your global operating headquarters
ultimate parent	the identification code of your parent undertaking
data locations	the country of data at rest and the country where data is processed
supply chain	your subcontractors, ranked by position in the chain
assessment, for critical or important functions	substitutability, date of the last audit, whether an exit plan exists, whether the service can be brought in-house

A vendor from outside the EU without an LEI cannot be recorded correctly. The fix takes days, and nobody likes doing it during a contract deadline.

When a partner sells, check whose name is on the contract. The ITS defines the direct provider as the one that signed the contractual arrangement with the financial entity, and everyone behind it as a subcontractor with a rank. A reseller or integrator that signs may become the direct provider in the bank’s register, with you further down the chain. Whether a licence resale counts as an ICT service in a given deal is a question for the bank and counsel. Agree with the partner who answers which questions before the questionnaire arrives, the same way you split roles for the security review run alongside the POC.

subcontracting, concentration and critical providers

Delegated Regulation (EU) 2025/532, adopted on 24 March 2025 after a revision round between the Commission and the ESAs, applies to subcontracting of services supporting critical or important functions. As of November 2026 it is in force. The contract must say which services may be subcontracted and on what conditions, keep you responsible for your subcontractors and require you to monitor them. Article 5 requires you to tell the bank about intended material changes to subcontracting “well in time”, with a reasonable notice period in which the bank may approve or object. Article 6 lets the bank terminate if you go ahead anyway. If your SaaS runs on a cloud provider, or support comes from a third-country subsidiary, list it now, before the bank finds it.

Concentration risk is the second reason the bank asks about your supply chain. Article 29 requires it to weigh whether a provider is easily substitutable, and whether it holds several contracts with the same or closely connected providers. Expect the question “how would we replace you?” and answer it with a credible exit plan, data export formats and the transition support you offer. Banks expect a supplier to make leaving possible, and an easy exit lowers the risk score of the purchase.

The oversight regime for critical ICT third-party providers is separate. Under Article 31 the ESAs designate providers critical for the financial sector and publish the list, updated yearly. The first list, published on 18 November 2025, names 1919 ICT third-party providers were named critical under DORA in the first list the European Supervisory Authorities published on 18 November 2025. ESAs (EBA, EIOPA, ESMA), 2025 providers, built partly from the data banks reported in their registers. Article 31(8) excludes some providers from designation, including those that provide ICT services solely in one member state to financial entities active only in that member state. For most security vendors this matters indirectly: if your product runs on a designated provider, the bank sees it in your chain.

why your product does not make a bank DORA compliant

DORA obligations sit with the financial entity, which “shall, at all times, remain fully responsible”. A product can support specific measures inside the bank’s ICT risk management framework, such as access control, logging or incident detection. It cannot satisfy the framework, the register, the testing or the reporting duties. “DORA compliant” on a datasheet invites a question your sales team cannot answer, and a bank’s compliance officer will ask it.

The accurate statement is longer and sells better: here is the DORA requirement, here is how the product supports it, here is what the bank still has to do, and here is the evidence. Then add the supplier side: the annex you have already mapped to Article 30, your register data and your exit plan. That last part speaks to people outside the demo, such as legal, procurement, risk and the outsourcing function, so map the buying committee early and give each of them their piece.

If you also sell products with digital elements, the questions from your channel about the Cyber Resilience Act follow a similar pattern; see what your distributor will ask about the CRA.

the next bank conversation

When a bank opens with “we need a DORA addendum”, ask: “Does this service support a critical or important function in your assessment?” The answer tells you whether you face Article 30(2) alone or the full Article 30(3) set, and how long the paper process will take.