In short: The Digital Operational Resilience Act (Regulation EU 2022/2554) has applied since 17 January 2025 and requires financial institutions to manage ICT third-party providers in a structured way. How to assess vendors, which contract clauses are mandatory, what belongs in the ICT register, and what applies to “critical” vendors.

Who DORA applies to

DORA applies to nearly all financial entities in the EU:

  • Credit institutions (including small savings banks and cooperative banks)
  • Investment firms, crypto-asset service providers
  • Insurance and reinsurance undertakings
  • Payment and e-money institutions
  • Fund management companies
  • Trading venues, data reporting service providers and credit rating agencies

In Germany, BaFin is the national supervisor. The European Supervisory Authorities (ESAs) designate critical ICT third-party providers and oversee them directly.

Why third parties are the DORA risk

In practice, financial institutions rarely deliver their full IT stack themselves. Cloud providers, core-banking providers, compliance SaaS, market-data suppliers, identity services, AI-model providers. Each can disrupt the bank's operations. DORA turns these dependencies into a regulated obligation.

Key DORA articles on third-party risk:

  • Article 28: General principles, register of information (para. 3), assessment before contracting (para. 4), exit strategies (para. 8)
  • Article 29: Preliminary assessment of ICT concentration risk
  • Article 30: Mandatory contract clauses
  • Articles 31-44: Oversight framework for critical ICT third-party providers

Closing or renewing ICT contracts today without DORA clauses risks supervisory findings.

Vendor assessment before contract

DORA requires a systematic assessment before contracting (Article 28 (4)), supplemented by a review of concentration risk (Article 29). Items that belong in any vendor review:

  1. Service criticality. What function is being outsourced? Which business processes depend on it? What damage results from failure?
  2. Concentration risk. How many of our ICT services already run through this vendor? How many of our competitors also? Are there cluster risks (e.g. two hyperscalers owned by the same group)?
  3. Geography and law. Where is data processed, where stored? Which legal regime applies in disputes? Third-country jurisdiction risks, EU data-protection regime, all relevant.
  4. Sub-contractor chain. Who are our vendor's vendors? DORA covers the whole chain, not just the first contract partner.
  5. Security maturity. Certifications (ISO/IEC 27001:2022, SOC 2 Type II), penetration-test reports, vulnerability management, incident history.
  6. Financial stability. Vendor going-concern risk: insolvency risk, ownership structure, exit strategy.
  7. Exit capability. How do we get out of the contract? Data portability, transition periods, reversibility.

This assessment must be documented, approved by the board, and updated at regular intervals.

Mandatory contract clauses per Article 30

DORA lists what must be in every ICT contract. Highlights:

  • Full service description including all functions and service levels
  • Geography of data processing with mandatory prior notice on changes
  • Data protection, availability, integrity requirements
  • Audit and inspection rights for the financial institution AND the supervisor
  • Cooperation obligations on security incidents with clear deadlines
  • Training and awareness obligations for the vendor
  • Obligation to participate in threat-led penetration tests (TLPT), for critical or important functions
  • Exit strategy with transferable data in standardised formats
  • Termination rights on serious violations
  • Stricter requirements for critical or important functions

DORA provides no general transition period for existing contracts. Existing contracts should therefore be amended promptly, not only at renewal.

The ICT register

Every financial institution must maintain an ICT third-party register and provide it to the supervisor (in Germany: BaFin) on request (Article 28 (3)). Contents:

  • Vendor identification (name, location, legal form, LEI)
  • Service description and criticality classification
  • Contract data, term, renewal options
  • Sub-contractor chain
  • Geography of data processing
  • Risk assessment with update date
  • Vendor concentration metrics

The structure and format of the register are set bindingly by Implementing Regulation (EU) 2024/2956. Many institutions still work with loose Excel lists. A maintained database with versioning, roles and change logging makes reporting to the supervisor much easier.

Critical ICT third-party providers

Providers on which many financial entities depend can be designated by the ESAs as critical ICT third-party providers (Article 31). They then come under direct EU oversight. For financial entities this means:

  • The ESAs examine the provider directly and can issue recommendations to it (Article 35).
  • If the provider does not follow recommendations, the national supervisor can require financial entities to temporarily suspend or terminate the use of affected services (Article 42).

The ESAs published the first list on 18 November 2025. It covers 19 providers, including large cloud, telecommunications and software providers, and is updated annually. Check which of your service providers are on it.

Typical gaps in practice

Three recurring patterns in DORA advisory work:

  • Contracts adjusted too late. Old cloud contracts often run 3 to 5 years and do not contain DORA clauses. The “only applies at renewal” argument is risky, as BaFin can require adjustments earlier.
  • Concentration risk underestimated. Three different SaaS providers all run on the same hyperscaler. If the hyperscaler fails, all three are gone. Diversified on paper, not in reality.
  • AI vendors not in the register. LLM APIs, AI compliance tools, language models for customer service: all ICT third-party providers under DORA. If AI services are not in the register, there is a gap.

How GermanAI Defense supports

We support financial institutions in building DORA-compliant third-party governance: vendor assessment per Articles 28 and 29, contract-clause templates per Article 30, ICT register design and maintenance, preparation for TLPT (Threat-Led Penetration Testing). ISO/IEC 27001:2022 certified ourselves, based in Frankfurt am Main.

→ More on our GRC and compliance services: GRC & Compliance Consulting