At a glance
- DORA (EU 2022/2554) applies directly and takes precedence over the NIS2 rules in the financial sector.
- Financial entities keep a register of information on all ICT service contracts and report it to the supervisory authority.
- Contracts with ICT service providers need minimum content – considerably more for critical or important functions.
- Since November 2025, 19 critical ICT third-party service providers have been under direct EU oversight; all others feel DORA through their clients.
Who DORA covers
Around 20 types of financial entity are directly obliged: credit institutions, payment and e-money institutions, investment firms, insurance and reinsurance undertakings, fund management companies, crypto-asset service providers and others. Simplified rules apply in part to microenterprises.
ICT third-party service providers – that is, anyone providing digital or data services, from data centres and software development to IT operations – are not themselves the addressees of most obligations. But their clients must pass these obligations on to them, contractually and organisationally.
What financial clients require from service providers
Minimum contractual content (Art. 30 DORA)
For all ICT services, DORA requires, among other things:
- a complete description of the services and of any subcontracting,
- the locations where services are provided and data is processed,
- provisions on availability, integrity, confidentiality and on data access in the event of insolvency or termination,
- assistance with ICT incidents at costs agreed in advance,
- cooperation with the supervisory authority and termination rights.
If the service supports critical or important functions, the following are added: measurable service levels, notification and reporting obligations, business contingency plans and their testing, participation in security awareness training and threat-led penetration testing (TLPT), unrestricted rights of access, inspection and audit, and exit strategies with appropriate transition periods.
Register of information
Every financial entity keeps a register of all contractual arrangements on ICT services – with details of the provider, the service, the function and subcontractors. So expect data requests, for example about your LEI (Legal Entity Identifier), your locations and your supply chain.
Incidents and testing
Financial entities must report major ICT-related incidents to the supervisory authority within tight deadlines – in Germany to BaFin (German Federal Financial Supervisory Authority). To do so, they need fast, reliable information from their service providers. On top of this come regular resilience tests, and for larger institutions also threat-led penetration tests, in which service providers may be involved.
Critical ICT third-party service providers
On 18 November 2025, the European Supervisory Authorities (EBA, EIOPA, ESMA) designated 19 providers as critical ICT third-party service providers for the first time – among them large cloud platforms, software and telecommunications groups. Since then they have been subject to direct EU oversight. For the vast majority of IT service providers, this changes nothing: they remain bound through their clients.
How service providers prepare
- Classify your servicesWhich of your services support critical or important functions at your financial clients? The scope of the requirements depends on this.
- Prepare contractsYour own DORA annex with the mandatory content saves negotiation rounds and avoids ill-fitting clauses from client templates.
- Disclose your supply chainDocument subcontractors, data centre locations and data flows – for your clients’ register of information.
- Align the incident processWho informs the client, how quickly and with what details? A rehearsed process is worth more in an emergency than any clause.
- Bundle your evidencePrepare your ISMS, contingency concepts, test results and audit reports so that audits run efficiently.
DORA and NIS2
For financial entities, DORA is the more specific law: where DORA sets requirements, these take precedence over the BSIG (German BSI Act). Many IT service providers, however, fall under NIS2 themselves – for example as managed service providers. They must then meet both: their own NIS2 obligations and the DORA requirements of their financial clients. A shared ISMS covers both most cost-effectively. How to check whether you are affected is shown in our article NIS2: Is my company affected?
Frequently asked questions
Does DORA also apply to small IT service providers?
Not directly. But as soon as you work for a financial entity, the contractual requirements apply to you too – regardless of your size.
What is a “critical or important function”?
A function whose disruption would materially impair the financial performance, the soundness or the continuity of the business of the financial entity. The classification is made by the financial entity.
Do service providers have to allow on-site audits?
For services supporting critical or important functions, yes: DORA requires unrestricted rights of access, inspection and audit for the financial entity and the supervisory authority. Pooled audits on behalf of several clients are possible.
Note: This article provides a specialist overview (as of October 2026) and does not replace legal advice. For a binding assessment of your company, we are happy to work with your legal advisers.
Related service