I supply a bank: which DORA controls will they ask me for?

The short answer: DORA binds the financial entity, not you. The only exception is ICT providers designated as critical by the European authorities, who come under their direct oversight. But the bank, insurer or asset manager that hires you remains fully responsible for what it outsources (Art. 28(1)(a)), and the only way it can comply is by requiring it of you in the contract. In practice you face three levels of requirements: a baseline for any ICT service (Art. 30(2)), a stricter level if your service supports a critical or important function of the entity (Art. 30(3) and its delegated regulations), and direct oversight if you are a critical provider (Arts. 31 to 44).

This article is written from your side of the table. If you are looking for the entity's obligations towards its providers, see what DORA requires of ICT third-party providers, article by article. Here you will see what you will be asked for, which article each item comes from and what to have ready before the questionnaire arrives.

Why a regulation not addressed to you still affects you

DORA, Regulation (EU) 2022/2554, has applied since 17 January 2025 to banks, insurers, investment firms, payment institutions, asset managers and other financial entities. It is a regulation: there is no national transposition and its text applies as written.

The requirements reach you in two ways:

1. The contract. Article 30 sets what any ICT services contract with a financial entity must contain. If yours does not, the entity is in breach. That is why you will receive a "DORA addendum" or a renegotiation.
2. The entity's own obligations. Due diligence before contracting, the register of information, continuity testing, incident reporting and penetration testing. All of them need data and cooperation from you.

Two questions decide how much you will be asked for, and the entity answers both of them, not you.

Is what you provide an ICT service? The definition in Article 3(21) is very broad: digital and data services provided through ICT systems on an ongoing basis. It covers software as a service, hosting, technical support, technology consulting with access to systems and managed services. The Commission clarified in a Q&A that regulated financial services are not ICT services, but that ICT services provided by a financial entity outside its regulated activity are.

Does it support a critical or important function? That is a function whose disruption would materially impair the entity's financial soundness, continuity or regulatory compliance (Art. 3(22)). The entity classifies it case by case. The same service can be critical for one client and ancillary for another. Always ask how you have been classified, because half of this article depends on the answer.

Level 1: what you will be asked for any ICT service

For all contracts, Article 30(2) sets a baseline that does not depend on criticality. On top of that comes what the entity needs for its register of information and its due diligence.

Two items in this table tend to surprise providers. The first is the LEI: many small companies do not have one, and without it or an EUID the entity cannot complete its register. Get it before you are asked. The second is the termination grounds in Article 28(7). The entity must be able to terminate if you seriously breach the contract, if something changes that alters the service, if your ICT risk management has weaknesses or if the supervisor cannot supervise effectively. This is not negotiable, because the regulation requires it to exist.

Level 2: if you support a critical or important function

This is where most of the work is. Article 30(3) adds clauses to the contract, and three delegated regulations develop them: 2024/1773 on the contractual policy, 2025/532 on subcontracting and 2024/1774 on the ICT risk management framework.

Audits: your certificate helps, but it is not enough

The question providers ask most is whether an ISO 27001 certificate or a SOC 2 Type II report spares them audits. The answer in Article 8 of Delegated Regulation 2024/1773 is: not entirely.

The entity may rely on certifications and third-party audit reports, and may organise pooled audits with other financial entities that are your clients. But it cannot rely on them alone indefinitely. They must cover the key systems and controls of your service, be up to date and come from a competent party that demonstrates the operating effectiveness of the controls. And the entity always keeps the right to ask for a wider scope and to audit you itself.

Article 30(3)(e) allows "alternative assurance levels" to be agreed when a direct audit would affect the rights of your other clients, such as in a shared data centre. That is the real room for negotiation. Some providers limit audits to one a year or do not allow direct audits of their subcontractors. Whether that fits within "unrestricted" rights is debated among law firms and there is no official position. A contract that rules out direct audits altogether, on the other hand, clearly conflicts with Article 30(3)(e).

If you want your certificate to carry weight, check that its scope covers the service you provide to the entity. We explain how in how to read a SOC 2 report or an ISO certificate beyond the seal.

Subcontractors: the clauses flow down the chain

Delegated Regulation 2025/532 entered into force on 22 July 2025. Its history matters: the Commission rejected the first draft in January 2025 because its Article 5 required the entity to monitor the entire subcontracting chain, and the final text was published without it. What remains affects you just the same:

• The contract states which parts of the service you may subcontract and under which conditions.
• You remain responsible for your subcontractors and must monitor them on an ongoing basis.
• You pass down to your subcontractors the reporting duties, contingency plans, security standards and the same access and audit rights for the entity and the supervisor.
• You give advance notice of any material change to subcontracting. The entity has a reasonable period to approve it or object, and you cannot implement it before that period ends.
• If you implement the change despite the entity's objection or before the deadline, or subcontract without permission, the entity can terminate the contract.

In addition, the entity will have to identify your relevant subcontractors in its register with their LEI or EUID. Keeping that list current with those identifiers saves you weeks. The underlying problem is covered in fourth-party risk.

Incidents: the entity's deadline sets yours

The entity reports a major incident to the supervisor, not you. It may outsource the reporting to a third party, but it remains responsible (Art. 19(5)). What DORA requires of you is assistance (Art. 30(2)(f)) and, for critical services, reports and notices (Art. 30(3)(b)).

DORA does not set how quickly you must notify your client. The contract does, shaped by the entity's own deadlines under Delegated Regulation 2025/301:

In the DORA addenda that providers publish, notification commitments range from 24 to 72 hours. Given the entity's deadlines, 72 hours is too long for a critical service. If the entity has four hours to notify and you take a day to tell it, the breach starts on your side. To see what data it will need from you, read when an incident is major under DORA.

Level 3: if you are a critical provider

Critical providers are designated on the basis of their systemic impact, the number of entities that rely on them for critical or important functions and how hard they are to replace (Art. 31(2)). The European supervisory authorities published the first list on 18 November 2025, with 19 providers: Accenture, AWS, Bloomberg, Capgemini, Colt, Deutsche Telekom, Equinix, FIS, Google Cloud, IBM, InterXion, Kyndryl, LSEG Data and Risk, Microsoft, NTT DATA, Oracle, Orange, SAP and TCS.

For them, DORA applies directly:

• A European Lead Overseer can request information from them, investigate them, inspect them and issue recommendations (Art. 35).
• If they do not cooperate, it can impose daily periodic penalty payments of up to 1% of their average daily worldwide turnover, for up to six months.
• They pay oversight fees (Art. 43).
• If they are not established in the EU, they must set up a subsidiary in the Union within twelve months of designation (Art. 31(12)).
• If they do not follow the recommendations, the entity's supervisor can ultimately require it to suspend or terminate the contract (Art. 42).

Some providers can never be designated critical: financial entities providing ICT services to others, intra-group providers and those that only provide services in one Member State to entities that only operate there (Art. 31(8)). That does not take them out of levels 1 and 2. And being critical does not exempt the provider from the Article 30 contracts, nor the entity from monitoring it.

The Spanish case

In Spain, the Bank of Spain supervises credit, payment and electronic money institutions, the CNMV supervises investment services and asset managers, and the DGSFP supervises insurance and pensions. Royal Decree-law 8/2023 also extended part of DORA to payment operators and processors.

In July 2026 the Government approved the bill on digitalisation and modernisation of the financial system, which is now before Parliament. According to finreg360's analysis, it completes DORA's supervisory powers and sanctioning regime in Spain, and it may change how subcontracted providers are held liable. Until it is passed, what this article says still holds: your obligation arises from the contract. It is worth following its progress.

What is not true

• "DORA binds me as a provider." Only if you are critical. Otherwise, what binds you is what you sign.
• "It only affects the cloud and big tech." It affects any ICT service, and the definition leaves very little out.
• "All my contracts need the stricter clauses." Only those supporting critical or important functions, and each entity decides that.
• "ISO 27001 gets me out of audits." It helps you reduce them, not eliminate them.
• "The provider reports to the supervisor." The entity reports. You give it the data on time.
• "My subcontractors are out of scope." The clauses flow down to them, even though the entity no longer has to monitor the whole chain.
• "There are official DORA standard clauses." There are none. EIOPA confirmed this in its Q&A database. The closest thing is the Data Act model clauses for cloud contracts, which are neither binding nor specific to DORA.

How to have it ready

The financial entity will ask you for the same as its other client entities, with different templates. What works is a single DORA file that you answer once and reuse:

• Identification: your LEI or EUID and your parent's, country, and locations of service and data.
• Subcontractor map: who does which part of the service, from where and with which identifier.
• Security evidence: certificates with their scope, the latest independent audit report and your vulnerability management policy.
• Continuity: your plan, its RTO and RPO per service and the result of the latest test.
• Incidents: your procedure, with the client notification deadline and the data you will provide.
• Exit: how you return data, in which format, and how long the transition lasts and what it costs.
• Your reference DORA addendum, so the negotiation starts from your text.

With Almenara, if a client assesses you through us, you answer in the supplier portal at no cost: you upload each piece of evidence once and always see what is missing. And if you are the one managing providers, the Third-party risk module keeps the register of information, the due diligence and the contract monitoring. The DORA guide covers the rest of the regulation's obligations.

Frequently asked questions

What about contracts signed before 2025?

DORA has no transition period for contracts. Since 17 January 2025, existing contracts have had to comply with Article 30, so entities are renegotiating them or adding addenda. If yours has not arrived yet, it will probably come at the next renewal.

I am a company in the same group as the entity. Does it affect me?

Yes. Intra-group providers count as third-party providers for the contract and the register. The only thing Article 31(8) excludes them from is designation as a critical provider.

My service is not ICT. Am I off the hook?

From DORA, yes. But if you provide an outsourced service to a financial entity, you will be covered by the EBA guidelines on the management of third-party risk published in September 2026, which replace the outsourcing guidelines for non-ICT services, or by your sector supervisor's guidance.

Can I refuse a clause?

You can negotiate its wording, audit frequency, notice periods or the cost of assistance. What you cannot do is remove what Article 30 requires, because then the entity cannot sign. The real negotiation is in alternative assurance levels, pooled audits and deadlines.