DORA for ICT Providers: What EU Banks Will Ask You

The Digital Operational Resilience Act, known as DORA, has applied since January 2025. It is an EU regulation for financial entities such as banks, insurers and investment firms. If you provide technology or digital services to these firms, from India or anywhere else, DORA will reach you through your customers.

Most ICT suppliers are not regulated by DORA directly. Their financial customers are, and those customers must manage the risk that comes from their ICT third-party providers. In practice, that means new contract terms, more detailed questions and requests to support testing and exit planning. This guide explains what to expect from the supplier side.

1. Why DORA reaches suppliers

DORA asks financial entities to manage ICT risk across their whole operation, including the services they buy. A bank cannot simply outsource a critical service and forget about it. It has to understand the risk, set clear contract terms, monitor the supplier and plan for what happens if the supplier fails or the relationship ends.

So the expectations flow down the supply chain. Your customer’s compliance team has its own obligations, and it meets them partly by asking you questions and asking you to sign stronger terms. The more important your service is to the customer’s critical functions, the more detailed those requests will be.

The regulation also creates an oversight framework for ICT providers designated as critical at EU level. That applies to a relatively small number of large providers. For most suppliers, the impact comes through customer contracts rather than direct supervision.

2. What your customers are likely to ask

Requests vary between customers and depend on how important your service is to them. Check your own contracts and questionnaires carefully. In general, ICT suppliers can expect questions in the following areas.

• Contract terms. Clear descriptions of the service, service levels, where data is processed, security requirements, incident reporting, cooperation with the customer’s regulators, audit and access rights, and termination rights.
• Information for registers. Financial entities keep a register of information about their ICT third-party arrangements. They will ask you for details about your service, your company and the subcontractors you rely on.
• Incident cooperation. How quickly you will tell them about incidents affecting their service, and what information you will provide.
• Testing. Your own security and resilience testing, and in some cases support for the customer’s testing programme.
• Business continuity. How you keep the service running during a disruption and how you recover.
• Exit plans. How the customer could move the service to another provider or bring it in-house, including the return of data and a transition period.
• Subcontracting. Which parts of the service you subcontract, and how you manage those suppliers in turn.

None of this is unusual for a mature supplier. The difference is that it is now asked consistently and recorded carefully.

3. How to prepare as a supplier

Start by understanding which of your customers are EU financial entities and how important your service is to each of them. That tells you where the most detailed requests will come from.

Next, prepare a standard pack. A clear service description, your security and resilience practices, your incident process, your continuity and recovery arrangements, a list of key subcontractors and a summary of your exit support. Reusing a well-prepared pack saves time on every request.

Keep the pack current. A pack that describes last year’s subcontractors or an old recovery plan creates more questions than it answers. Review it on a schedule and after any major change to the service.

Review your standard contract. Decide in advance which DORA-related terms you can accept as standard, which need discussion and which you cannot accept. A consistent position makes negotiations faster and safer.

Look at your evidence. Independent assurance such as a SOC 2 report or an ISO 27001 certificate helps answer many questions, as does a recent penetration test. Our VAPT services article explains the testing side.

Finally, think about exit with care. Customers will want a credible way to leave you without disruption. Clear data export, documented configurations and a defined transition period make that possible, and they also make you look like a mature partner.

If you supply technology to EU financial firms and want to prepare for DORA requests, our regulatory audits team can help you build the pack and review your contracts. Feel free to get in touch.