A regulation for banks that also reaches their suppliers
DORA (Regulation (EU) 2022/2554, the Digital Operational Resilience Act) has applied since January 2025 and directly covers "financial entities": banks, insurers, investment firms, payment institutions, fund managers and other organisations in the sector. On the face of it, this is not something SMEs need to worry about, yet one of its main obligations is managing ICT third-party risk: financial entities must map, assess and monitor their technology suppliers, including the smallest ones.
The practical result: if your company provides software, hosting, systems support or cloud services to a bank or an insurer, sooner or later that customer will ask you to meet requirements that come straight from DORA.
What it requires, in brief
- ICT risk management: a structured framework covering identification, protection, detection, response and recovery for IT systems.
- Incident reporting: classification and reporting of major ICT-related incidents to the competent authorities, within set deadlines.
- Digital operational resilience testing: periodic testing, extending to threat-led penetration testing (TLPT) for the most significant entities.
- ICT third-party risk management: a register of all ICT contracts, mandatory contractual clauses, and direct oversight of providers considered critical at European level.
- Information sharing on cyber threats among entities in the sector.
How it actually reaches ICT suppliers
A bank or insurer subject to DORA must keep a register of information on all its ICT third-party service providers, classify them by criticality and include specific clauses in contracts: audit rights, measurable service levels, notice of subcontracting, cooperation during incidents and testing, and a clear exit strategy if the relationship ends.
In practice, for an IT supplier working with regulated customers, this means more detailed contracts, requests for documentation on business continuity and security, and sometimes taking part in resilience tests organised by the customer.
| What a DORA-regulated customer may ask of you | Why |
|---|---|
| A documented business continuity plan | It has to assess your ability to withstand a disruption |
| Prompt notification of incidents that involve you | It has its own reporting obligations, with tight deadlines |
| The right to audit your systems and processes | It must be able to verify, not just trust |
| An exit strategy if the contract ends | It cannot be locked into a supplier with no alternative |
DORA and NIS2: different rules, same logic
Anyone familiar with NIS2 will recognise the pattern: here too the direct obligations apply to specific organisations (in DORA's case, the financial sector), but they extend along the supply chain through contracts. The main difference is that DORA is a regulation, so it applies directly and in the same way throughout the European Union, without having to be transposed into national law as directives do.
Where to start if you work with regulated customers
- Check whether any of your customers are financial entities subject to DORA, directly or as part of a larger group.
- Review your current contracts: what they already say about audits, continuity and incident notification, and what is missing.
- Document your business continuity: a written plan with defined RTO and RPO is often the first thing requested (see the guide on RTO and RPO).
- Prepare an incident notification procedure, with timings that fit the deadlines your customer has to meet in turn.
- Assess your exposure to resilience testing: if your customer classifies you as a critical supplier, you may be involved in periodic testing.
Quick checklist
- I know whether any of my customers are banks, insurers or other financial entities subject to DORA;
- I have a written business continuity plan, not just informal practice;
- my contracts with regulated customers already include the required clauses (audit, notification, exit);
- I have a procedure for promptly notifying an incident that affects a regulated customer;
- I can tell a direct DORA obligation apart from a contractual request that stems from it.
In short
DORA applies directly to the financial sector, but it reaches ICT suppliers through contracts: register of suppliers, mandatory clauses, resilience testing. Anyone working with banks and insurers should expect more detailed contracts and business continuity that is documented, not just promised.