Mostly, it asks through the contract. DORA, the EU's Digital Operational Resilience Act (Regulation (EU) 2022/2554), has applied since 17 January 2025, and its third-party rules bind the financial entity rather than its suppliers. A bank, investment firm, fund manager or crypto-asset service provider stays fully responsible for its own obligations when it uses an ICT service. It has to assess a provider before signing, record the arrangement in a register of information, and sign a written contract that contains the clauses listed in Article 30, with more of them when the service supports a critical or important function. Only providers that the European Supervisory Authorities designate as critical come under direct EU oversight.
This note explains the regulation text as published in the Official Journal; article numbers refer to Regulation (EU) 2022/2554 unless stated otherwise. It is an explainer, not legal advice. How DORA applies to a particular contract is for your legal counsel and your competent authority to decide.
Who counts as what
Financial entities are the twenty types listed in Article 2(1), points (a) to (t). They include credit institutions, payment and e-money institutions, investment firms, crypto-asset service providers, central securities depositories, trading venues, managers of alternative investment funds, management companies, insurers and crowdfunding service providers.
An ICT third-party service provider is "an undertaking providing ICT services" (Article 3(19)). ICT services are "digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis" (Article 3(21)), a definition that includes hardware as a service. Whether a given engagement falls under it is one of the first questions a financial entity's legal team answers.
A critical or important function is one whose disruption "would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities", or its compliance with its authorisation and financial services law (Article 3(22)). That label decides how much of Article 30 a contract has to contain.
What the financial entity has to do
Articles 28 and 29 set out the duties. In order:
- Remain fully responsible for compliance with DORA and financial services law, whatever it outsources (Article 28(1)(a)).
- Adopt and regularly review a strategy on ICT third-party risk, including a policy on ICT services that support critical or important functions (Article 28(2)). Microenterprises and the entities in Article 16(1), first subparagraph, such as small and non-interconnected investment firms, are exempt from this paragraph. Delegated Regulation (EU) 2024/1773 sets out what the policy has to contain.
- Keep a register of information on every contractual arrangement for ICT services, report at least yearly to the competent authority on the number and type of new arrangements, and inform it "in a timely manner" about any planned arrangement for a critical or important function (Article 28(3)). Implementing Regulation (EU) 2024/2956 provides the templates.
- Before signing, assess whether the service supports a critical or important function, whether supervisory conditions are met and what the risks are, including concentration risk; carry out due diligence on the provider; and identify conflicts of interest (Article 28(4)).
- Contract only with providers that "comply with appropriate information security standards", and for critical or important functions give due consideration to "the most up-to-date and highest quality information security standards" (Article 28(5)).
- Decide in advance, on a risk basis, how often to audit and inspect the provider and which areas (Article 28(6)).
- Make sure the contract can be terminated in four situations: a significant breach of law or contract by the provider; circumstances found during monitoring that could alter the service; evidenced weaknesses in the provider's ICT risk management; and when the competent authority can no longer supervise the entity effectively because of the arrangement (Article 28(7)).
- For critical or important functions, have documented and tested exit strategies and transition plans that move the service and its data to another provider or back in-house without disrupting the business (Article 28(8)).
- Weigh concentration risk: a provider that is not easily substitutable, several arrangements with the same or closely connected providers, long subcontracting chains, subcontractors in third countries, the insolvency law that would apply to the provider and the recovery of the entity's data (Article 29).
What the contract has to contain
Article 30(1) requires the rights and obligations of both sides to be set out in writing, with the full contract, including the service level agreements, in one written document. Article 30(2) lists what every contract for ICT services must contain; Article 30(3) adds clauses when the service supports a critical or important function.
| Article | Clause | Applies to |
|---|---|---|
| 30(2)(a) | A clear and complete description of all functions and services, and whether and on what conditions subcontracting of a critical or important function is allowed | All ICT services |
| 30(2)(b) | The regions or countries where the services are provided and where data is processed and stored, with advance notice of any change | All ICT services |
| 30(2)(c) | Availability, authenticity, integrity and confidentiality of data, including personal data | All ICT services |
| 30(2)(d) | Access to the data, its recovery and its return in an easily accessible format on the provider's insolvency, resolution or discontinuation, or when the contract ends | All ICT services |
| 30(2)(e) | Service level descriptions, including updates | All ICT services |
| 30(2)(f) | Help with any ICT incident related to the service, at no additional cost or at a cost determined in advance | All ICT services |
| 30(2)(g) | Full cooperation with the entity's competent authorities and resolution authorities | All ICT services |
| 30(2)(h) | Termination rights and minimum notice periods | All ICT services |
| 30(2)(i) | The conditions for the provider's participation in the entity's ICT security awareness programmes and digital operational resilience training | All ICT services |
| 30(3)(a) | Full service level descriptions with precise quantitative and qualitative performance targets | Critical or important functions |
| 30(3)(b) | Notice periods and reporting duties, including notice of anything that could materially affect the provider's ability to deliver | Critical or important functions |
| 30(3)(c) | Business contingency plans that the provider implements and tests, and appropriate ICT security measures, tools and policies | Critical or important functions |
| 30(3)(d) | Participation and full cooperation in the entity's threat-led penetration testing (TLPT, Articles 26 and 27) | Critical or important functions |
| 30(3)(e) | Unrestricted rights of access, inspection and audit for the entity, an appointed third party and the competent authority, with full cooperation during on-site inspections | Critical or important functions |
| 30(3)(f) | An exit strategy with a mandatory transition period in which the provider keeps delivering while the entity moves to another provider or in-house | Critical or important functions |
A financial entity that is a microenterprise may agree that its access, inspection and audit rights under 30(3)(e) are delegated to an independent third party appointed by the provider. When negotiating, both sides must consider standard contractual clauses developed by public authorities for specific services (Article 30(4)). Delegated Regulation (EU) 2025/532 specifies what the entity has to assess when a provider subcontracts services that support critical or important functions.
What a supplier should prepare
None of this is optional for the financial entity, so it arrives in your contract and in its supplier questionnaire. These are the answers to have ready:
- Whether your service supports a critical or important function. Ask early. The answer decides whether Article 30(3) applies: performance targets with numbers, TLPT participation, unrestricted audit rights and a transition period on exit.
- Where the service runs and where data is processed and stored, by country or region, including your subcontractors' locations. A change later needs advance notice (30(2)(b)).
- Your subcontractors, what each one does and how you oversee them, for anything that supports a critical or important function (29(2), 30(2)(a), Delegated Regulation (EU) 2025/532).
- Your security measures and the information security standards you work to (28(5), 30(2)(c), 30(3)(c)).
- What you do in an ICT incident and what it costs, agreed before the contract is signed (30(2)(f)).
- How the client gets its data back and leaves, in which format and with how much transition support (30(2)(d), 30(3)(f)).
- Who handles audits and regulators' requests, because the entity, its auditors and its competent authority can all ask (30(2)(g), 30(3)(e)).
- Who on your side attends the client's security awareness and resilience training (30(2)(i)).
Direct oversight is for critical providers only
Article 31 lets the European Supervisory Authorities, through their Joint Committee and on a recommendation from the Oversight Forum, designate ICT third-party service providers as critical for financial entities and appoint a Lead Overseer for each. The criteria are in Delegated Regulation (EU) 2024/1502. A designated provider is overseen directly; every other provider meets DORA through its clients' contracts.
If you are a financial entity onboarding Mochavi as a supplier, send your questionnaire through the contact form and we answer it directly. The engagement letter names the contracting entity; ask for the Dutch B.V. if your policies require an EU supplier. Procurement details.
Sources
Quotes are from the text published in the Official Journal (OJ L 333, 27 December 2022), checked on 14 October 2026.
- Regulation (EU) 2022/2554 (DORA) on EUR-Lex ↗, Articles 2, 3, 28 to 31 and 64
- Delegated Regulation (EU) 2024/1773 ↗: the policy on contractual arrangements for critical or important functions
- Implementing Regulation (EU) 2024/2956 ↗: templates for the register of information
- Delegated Regulation (EU) 2025/532 ↗: subcontracting of services that support critical or important functions
- Delegated Regulation (EU) 2024/1502 ↗: criteria for designating critical ICT third-party service providers
This is the regulatory context we build in for regulated on-chain finance. If you have a system to build under these rules, start a project.
