Managing ICT third-party risk under DORA: due diligence, contracts and exit

This page applies to both frameworks: to financial entities under the full framework of Articles 5 to 15 DORA and under the simplified framework of Article 16, which includes factoring and leasing firms, guarantee banks and the other institutions under Section 1a(2a) of the German Banking Act (KWG) (“KWG group” below). For the KWG group, Articles 28 to 30 apply from 1 January 2027. Which framework applies to you is explained on DORA applicability.

Who is an ICT third-party service provider, and what stays with the institution?

An ICT third-party service provider is any undertaking providing ICT services (Article 3(19) DORA). ICT services are digital and data services provided through ICT systems on an ongoing basis, including hardware as a service, excluding traditional analogue telephone services (Article 3(21)). This covers software vendors, data centres, cloud services and managed service providers as well as providers from your own group. According to BaFin, the rules apply in principle unchanged to intra-group ICT providers. A regulated financial service provided by a supervised firm is not covered.

Responsibility cannot be handed over. A financial entity that uses ICT services remains fully responsible at all times for compliance with all obligations under DORA and applicable financial services law (Article 28(1)(a)). How far the management of these providers goes follows the principle of proportionality, in particular the criticality of the functions supported (Article 28(1)(b)). Whether a service supports a critical or important function determines the scope of the obligations. How to classify that is set out on critical or important functions.

Is this the same as outsourcing?

No. The DORA term is considerably wider than the outsourcing term, which is why BaFin expects every third-party arrangement with an ICT element to be assessed (supervisory notice of 21 August 2025, section 7.1). The sectoral outsourcing rules continue to apply alongside, and many ICT contracts are outsourcings at the same time. For banks and financial services institutions, MaRisk (BaFin’s Minimum Requirements for Risk Management) takes ICT services subject to Articles 28 to 30 DORA out of AT 9. How the two sets of rules interact is explained on MaRisk and DORA, and for insurers, who are subject to the VAIT (BaFin’s supervisory requirements for IT in insurers), on VAIT and DORA.

What do you check before signing?

Before any contract on ICT services, Article 28(4) DORA requires five steps and paragraph 5 a sixth. This applies to all contracts, not only to critical ones:

If the service supports a critical or important function, three further checks follow. On concentration risk you ask whether the provider is not easily substitutable, or whether you would have several such contracts with the same or closely connected providers (Article 29(1)). If so, you weigh the benefits and costs of alternatives. On subcontracting you weigh benefits and risks, especially for subcontractors in third countries and for long chains (Article 29(2)). You also consider the consequences of the provider’s insolvency for recovering your data and, for providers in third countries, data protection and the enforcement of the law.

Delegated Regulation (EU) 2025/532 makes the subcontracting question concrete. Before signing you decide whether the provider may subcontract services supporting critical or important functions (Article 3(1)). If it may, you only sign if these conditions, among others, are met: the provider can select and monitor subcontractors and name them to you. The subcontractors grant you and the supervisor the same rights of access and inspection. You yourself have assessed the impact of failures, location risks and concentration risk. You repeat the assessments under points (f) to (j) regularly (Article 3(2)).

What must the contract contain?

Article 30 DORA sets minimum content in two tiers. The contract is set out in writing in one document, including the service level agreements (paragraph 1). Paragraph 2 applies to all contracts on ICT services, paragraph 3 in addition to contracts supporting critical or important functions. According to BaFin, large parts of contracts will therefore have to be renegotiated in many cases, including contracts without a critical or important function. There are no extended transition periods for existing contracts, and standard contractual clauses from the European authorities are not yet available. BaFin has published a tabular overview of the minimum contract content.

Besides Article 30, Article 28(7) requires that every contract can be terminated in four cases: a significant breach of laws or contractual terms by the provider, circumstances identified through monitoring that may alter performance, evidenced weaknesses in the provider’s ICT risk management, and where the supervisor can no longer effectively supervise the financial entity because of the contract. For services supporting critical or important functions, the contract also sets out under RTS 2025/532 Article 4 which services may be subcontracted and under which conditions. The provider must give timely notice of material changes to subcontracting, with a period in which you can approve or object (Article 5). If it implements them despite your objection or before the period ends, or subcontracts without approval, you can provide for a right of termination (Article 6).

What does an exit strategy look like?

For ICT services supporting critical or important functions you put exit strategies in place (Article 28(8)). The aim is to exit the contract without disruption to business activities, without limiting compliance with regulatory requirements and without detriment to the continuity and quality of services provided to clients. This includes:

• a comprehensive, documented exit plan that is sufficiently tested and reviewed periodically,
• alternative solutions and transition plans to transfer the service and data securely and in full to another provider or back in-house,
• contingency measures in case the provider fails or stops providing the service,
• in the contract, a mandatory adequate transition period in which the provider continues to perform (Article 30(3)(f)).

The waiver of exit strategies and options for action that AT 9 para. 14(d) of MaRisk 06/2026 provides for intra-group and intra-network outsourcings (still cited in the BaFin FAQ as para. 15(d) of the previous version) no longer applies according to BaFin if the arrangement is also an ICT service. Where the risk is lower, you can still take proportionality into account.

What is different under Article 16?

Under the simplified framework, Articles 28 to 30 apply in principle in full. The reliefs concern strategy and organisation, the assessment and contract duties stay the same:

For microenterprises in the KWG group, Articles 28 to 30 do not apply under Section 1a(2a) sentence 2 no. 3 KWG. This special rule is in the KWG and does not apply to all DORA microenterprises. On our derivation, their ICT sourcing remains within the scope of AT 9 MaRisk. The reasoning is on MaRisk and DORA. Whether an institution is a microenterprise is explained on DORA applicability. Do not assume it. Microenterprises to which Article 30 applies may agree that the rights of access, inspection and audit are delegated to an independent third party appointed by the provider (Article 30(3), final subparagraph).

Under the full framework and the Article 16 framework, all ICT contracts go into the register of information, with those supporting critical or important functions identified as such. You notify the supervisor of planned contracts of this kind in a timely manner. Structure, submission and notification are covered on DORA register of information.

Example: contract checklist for a cloud archive

Fictitious example, not a client. Muster-Factoring GmbH (23 staff, EUR 61 million total assets, so not a microenterprise) applies the Article 16 framework and Articles 28 to 30 from 1 January 2027. Its document archive with customer and debtor data is critical or important according to its function list, because of confidentiality. The archive contract expires at the end of March 2027. In December 2026 a new provider (here: archive provider A) presents its draft contract. It runs the service in a data centre of a subcontractor in the EU. The head of operations records the status as follows:

The assessment is a professional evaluation against the wording of Article 30 DORA and RTS 2025/532. Whether a clause is legally sufficient and how it is worded is reviewed by the institution’s legal advisers. In the example, the following also applies: the institution rates the concentration risk as low because there are several comparable providers and export in standard formats is possible. The exit strategy describes the way back to the previous archive as an interim solution. In the register, the institution records the contract with the archive provider as “supports a critical or important function”, with the data centre operator as a subcontractor.

Three typical gaps

Which evidence an institution needs from its providers in ongoing operations is shown in the sample case on DORA for factoring and leasing. How providers meet the requirements of their financial customers is described on DORA for ICT providers.

How we can help

Institutions moving from the BAIT (BaFin’s supervisory requirements for IT in banks) on 1 January 2027 start with the service for the transition from BAIT to Article 16. Everyone else, including entities under the full framework, starts with the DORA gap analysis. It shows, for the contracts reviewed, which required content is still missing. In the Article 16 gap analysis that is up to five ICT providers, under the full framework we set the scope in a scoping call. The institution leads the renegotiation, and its legal advisers carry out the legal review of the clauses.