DORA: when your customer is a bank in the EU

In brief

The Digital Operational Resilience Act, DORA for short, is an EU regulation. It applies directly in every member state, with no national implementing law needed. It is addressed to financial entities: banks, insurers, payment and e-money institutions, investment firms, fund managers, crypto-asset service providers and others. They have to set up their IT so that they can withstand disruptions, attacks and outages.

A large part of the regulation deals with ICT third-party service providers, meaning the external providers of IT services. Article 28 requires the financial entity to assess a provider's risks before signing a contract, to record all contracts in a register of information and to have an exit strategy for important services. Article 29 deals with concentration risk and explicitly mentions providers in third countries: insolvency law and data protection in the provider's country have to be taken into account. Article 30 sets out what every contract must contain.

For a provider from South America, this means your customer may only hire you if the contract contains these minimum terms and you supply the information required.

Who it affects in South America

Only providers that the European Supervisory Authorities (EBA, EIOPA and ESMA) designate as critical ICT third-party service providers have direct obligations under DORA. The first list was published on November 18, 2025 and named 19 providers, mostly large cloud, data center, network and financial software companies. Under Article 31(12), a critical provider from a third country may only be used if it sets up a subsidiary in the EU within twelve months of its designation.

The usual case is indirect. This includes:

• Fintechs and software companies, for example from São Paulo, Buenos Aires or Bogotá, that develop or run payment, lending or insurance software for EU customers.
• Nearshore teams that code, test or maintain systems for European banks.
• Data centers and hosting providers with European financial customers.
• Call centers and BPO providers working with access to customer systems.
• Providers of market, credit or fraud data.

All of them are recorded in the customer's register of information and have to accept the contract clauses under Article 30. According to an EBA answer in its Q&A process (Q&A 2024_7096), intra-group service providers are excluded from designation as critical providers. That exemption does not extend to the contractual obligations.

An example: a software company in Montevideo runs the claims portal for a Spanish insurer. Before renewing the contract, the insurer has to check where the data is stored, who has access, how quickly the portal is back up after an outage and what happens if the software company stops operating. The answers go into its register and its risk assessment. If the software company cannot back them up, the insurer has to cover the risk in some other way or switch providers.

Deadlines

DORA has applied since January 17, 2025. Financial entities had to update existing contracts and build their registers. If you negotiate with an EU bank today, the DORA addendum comes along with the framework agreement. Older contracts without these clauses are brought up to date at the next renewal, often at short notice.

Oversight of critical providers is strict. Under Article 35(6), periodic penalty payments of up to 1% of average daily worldwide turnover are possible.

What EU customers actually ask for

Article 30 sets out what a contract for ICT services must contain. This includes a clear description of the services, the locations where data is processed, rules on access, inspection and audit, termination rights, support during security incidents and, for important services, participation in the customer's tests and exercises. In practice, expect the following:

• A DORA contract addendum covering these points. Many banks have their own templates.
• Data for the register of information: your LEI (Legal Entity Identifier), data processing locations and the subcontractors you use.
• An ISO/IEC 27001 certificate or a SOC 2 report.
• Evidence of business continuity management, often based on ISO 22301.
• Willingness to host the customer's and the supervisors' auditors on site.
• An exit plan describing how the customer can bring the service back in-house or transfer it in an orderly way.

For important or critical functions, participation in testing comes on top. Large financial entities must regularly carry out threat-led penetration tests, and a provider running such a function can be brought in. Agree in the contract how this works, who bears the costs and how your other customers are protected.

Your own providers come under scrutiny too. If you work for an EU bank on a cloud platform or hand parts of the work to freelancers, the customer will want to know and may need to approve it.

First steps

1. Check which of your EU customers are financial entities. A leasing company or a payment service provider can fall under DORA too.
2. Apply for an LEI if you do not have one yet.
3. List every location where you store or process customer data, and all your subcontractors.
4. Go through your most important customer's DORA addendum point by point and mark what you do not meet today.
5. Write an incident response and recovery plan for the services you provide to financial customers, and test it.
6. Keep evidence, policies and audit reports ready in one place. A GRC platform such as Sightadel helps you maintain this for several customers at once.

The EU Readiness Check gives you an initial assessment.

How it relates to certifications

DORA does not name a mandatory certificate. EU banks do assess their providers against fixed criteria, though, and a recognized certificate shortens that review considerably. For information security that means ISO/IEC 27001, often supplemented by SOC 2 for providers with US customers. If you supply AI models for credit decisions or fraud detection, you should also know the AI Act and ISO/IEC 42001. Whenever personal data is processed, the GDPR applies as well. For providers from Brazil, Argentina and Uruguay, data transfers are simpler thanks to an adequacy decision.

DORA and NIS2 overlap. For financial entities, DORA takes precedence as the more specific rule, but the requirements for suppliers are similar. If you work for both groups of customers, one management system can serve both.

FAQ