ICT third-party providers and DORA: meeting customer requirements

This page is for IT service providers with customers in the financial sector: managed service providers, software vendors, data centres, cloud and telecoms providers. Your customers apply either the full framework under Articles 5 to 15 DORA or the simplified framework under Article 16. For the requirements passed on to you, that makes little difference, because Articles 28 to 30 apply in both. The only exception in Germany is microenterprises among the institutions covered by section 1a(2a) of the German Banking Act (KWG), such as factoring and leasing firms, for which Articles 28 to 30 do not apply. Which framework a customer is in is explained on DORA applicability.

Does DORA apply to ICT providers?

Not as a direct obligation, with one exception. ICT third-party service providers are listed in Article 2(1)(u) DORA but are not financial entities under Article 2(2). According to BaFin, the rules apply only to financial entities and affect ICT providers indirectly, because financial entities have to include certain requirements in their contracts. Providers have no incident reporting duty under DORA. If an incident at your end causes a major incident at a customer, the customer reports it. You may have reporting duties of your own under other laws, see below.

The exception is critical ICT third-party service providers. They are designated by the European Supervisory Authorities under Article 31 DORA and then fall under the oversight framework in Chapter V, Section II, with a Lead Overseer. The criteria are the systemic impact of a failure, the importance of the customers, their reliance for critical or important functions, and substitutability (Article 31(2)). The authorities designate annually on the basis of the registers of information and publish a list. Under Article 31(8), designation does not apply to intra-group providers, among others, or to providers serving financial entities in only one Member State where those entities are only active in that Member State. A provider that is designated is notified and must tell its financial customers (Article 31(5)). Financial entities may only use the services of a designated provider established in a third country if it has set up an EU subsidiary within twelve months following the designation (Article 31(12)).

The Regulation does not provide for a “DORA certificate” that a provider could obtain. What matters is the contract and the evidence behind it.

Are you an ICT provider under DORA?

An ICT third-party service provider is any undertaking providing ICT services (Article 3(19)). ICT services are digital and data services provided through ICT systems to internal or external users on an ongoing basis, including hardware as a service, excluding traditional analogue telephone services (Article 3(21)). BaFin expects financial entities to assess every third-party arrangement with an ICT element. Expect questions even if you never thought of your service as outsourcing:

Where a supervised firm provides a regulated financial service, BaFin does not treat that service as an ICT service. BaFin treats intra-group providers in principle like external ones.

Which clauses will financial customers require?

Article 30 DORA sets the minimum content in two tiers. Whether your service supports a critical or important function at the customer is decided by the customer before signing (Article 28(4)(a)). That decides which tier applies:

BaFin expects many existing contracts to be renegotiated, including those without critical or important functions. There is no extended transition period, and no standard contractual clauses from public authorities exist yet. Two points leave room for manoeuvre. The contract may provide for alternative assurance levels if other clients’ rights are affected (Article 30(3)(e)(ii)). With customers that are microenterprises you may agree that an independent third party you appoint exercises the audit rights.

What goes into an evidence pack?

An evidence pack collects what every financial customer will ask for sooner or later, so you do not answer the same questions from scratch for each one. We recommend this structure:

1. Service description per service, with the systems that deliver it.
2. Location and subcontractor list with countries, legal entity identifier (LEI or EUID) and rank in the ICT service supply chain. Customers need this for their register of information.
3. DORA contract addendum following Article 30(2) and (3), Article 28(7) and RTS 2025/532, with a version for all contracts and a supplement for critical or important functions.
4. Security evidence: certificates with scope, current audit reports, a shareable version of your security concept.
5. Contingency and test evidence: contingency plan, summary of the last restore test.
6. Incident process: availability, time to first notice, content of your incident reports, cost of assistance.
7. Exit support: export formats, transition period, data return procedure.

Certificates and audit reports help but do not fully replace the customer’s own checks. Under Delegated Regulation (EU) 2024/1773, Article 8(3), customers in the full framework that are not microenterprises may rely on them only under conditions and not solely in the longer term. They must, for example, check that the scope covers their systems and be able to request extensions.

Example: a managed service provider answers a customer questionnaire

Fictitious example, not a client. Muster-IT-Service GmbH has 40 staff and serves business customers in North Rhine-Westphalia. For Muster-Factoring GmbH (23 staff, EUR 61 million total assets, not a microenterprise) it runs servers, workplaces, firewall and backup. The servers sit in a rented data centre in Germany, and backup copies are also held by a storage provider in Germany. Muster-Factoring GmbH applies the Article 16 framework from 1 January 2027 and sends a questionnaire in November 2026. The questions derive from Articles 28 to 30 DORA, RTS 2025/532 and the register templates. The provider answers:

The answers show the form, they do not recommend particular deadlines or costs. What you can commit to depends on your operations and your own supplier contracts. Whether a wording is legally sufficient is for you and your customer to clarify with your legal advisers.

What other obligations do you have?

DORA governs only the relationship with your financial customers. As a provider you may have statutory duties of your own under other rules, including reporting duties, for example NIS2 and the German BSI Act, or the Telecommunications Act (TKG) as a telecoms provider. Assess these separately: for NIS2 at nis2-readiness.de, for security duties under the TKG at tkg-readiness.de (both in German).

Three typical gaps

How we can help

There is a dedicated ICT provider variant of the DORA gap analysis: we compare your financial customers’ clauses and questionnaires with what you have and build the evidence pack with you. Scope and price are set after a scoping call. Legal review of your addendum stays with your legal advisers.