DORA Compliance: The Complete Guide to the Digital Operational Resilience Act for Financial Services and Their Tech Providers

A SaaS company in Austin sells infrastructure monitoring tools to European banks. The company has no offices in Europe, no European entity, and no European customers outside of financial services. In January 2025, those bank customers started sending new vendor questionnaires -- longer, more technical, and more prescriptive than anything the company had seen from SOC 2 or ISO 27001 audits. The questionnaires cited something called DORA.

The Digital Operational Resilience Act (Regulation (EU) 2022/2554) is the European Union's framework for ensuring that financial entities can withstand, respond to, and recover from ICT-related disruptions. It entered into force on January 16, 2023, and became applicable on January 17, 2025. Unlike most financial regulations, DORA does not stop at regulated financial institutions. It reaches directly into the technology supply chain, imposing obligations on the ICT third-party service providers that financial entities depend on -- including SaaS companies, cloud providers, and managed service providers headquartered outside the EU.

If you sell technology services to European financial institutions, DORA is now part of your compliance landscape. This guide covers who the regulation applies to, what it requires, and what SaaS companies need to do to remain viable vendors in the EU financial services market.

Who DORA Applies To

DORA applies to two categories of organizations:

Financial Entities

DORA covers virtually the entire EU financial sector. The regulation explicitly lists 21 categories of financial entities, including:

Credit institutions (banks)
Investment firms
Insurance and reinsurance undertakings
Payment institutions
Electronic money institutions
Central securities depositories
Trading venues
Fund managers (UCITS and AIFMs)
Crypto-asset service providers
Crowdfunding service providers
Credit rating agencies

The proportionality principle applies: smaller and less complex financial entities may implement simplified versions of certain requirements, but the core obligations apply across the board.

ICT Third-Party Service Providers

This is where DORA's reach extends beyond traditional financial regulation. An "ICT third-party service provider" under DORA is any undertaking that provides ICT services on an ongoing basis. This includes:

Cloud service providers (IaaS, PaaS, SaaS)
Data analytics providers
Software vendors providing critical applications
Managed security service providers
Data center operators
Network infrastructure providers

The designation that matters most is "critical ICT third-party service provider." The European Supervisory Authorities (ESAs) -- EBA, EIOPA, and ESMA -- designate certain providers as critical based on the systemic importance of the financial entities they serve, the degree of dependency, and the substitutability of the provider. Critical providers are subject to direct oversight by a Lead Overseer appointed from among the ESAs.

Even providers not designated as critical face significant indirect obligations through the contractual requirements DORA imposes on financial entities' ICT arrangements.

The Five Pillars of DORA

DORA is structured around five core areas of digital operational resilience. Each carries specific requirements that flow through to technology providers.

Pillar 1: ICT Risk Management

Financial entities must establish a comprehensive ICT risk management framework covering governance (board-level accountability), asset identification and classification, protection and detection mechanisms, incident response, and business continuity. The framework must address all ICT assets including those managed by third-party providers, with dependencies and interconnections mapped.

Impact on SaaS providers: Financial entity customers will require you to demonstrate how your ICT risk management practices align with DORA's framework. Expect detailed questionnaires about asset classification, vulnerability management, detection capabilities, incident response, and business continuity planning.

DORA establishes a harmonized incident reporting framework. Financial entities must:

Classify ICT-related incidents using criteria defined in the regulation (number of clients affected, duration, geographic spread, data losses, criticality of services affected, economic impact)
Report major incidents to their competent authority using standardized templates
Submit an initial notification, an intermediate report, and a final report within prescribed timeframes
Voluntarily report significant cyber threats

Impact on SaaS providers: Financial entity customers will require contractual commitments for incident notification within specific timeframes -- often shorter than what you may currently promise in your standard SLA. Your incident detection, classification, and communication processes must be mature enough to meet these timelines. You may also be required to participate in root cause analysis reporting.

Pillar 3: Digital Operational Resilience Testing

DORA requires two levels of testing:

Basic testing (all financial entities). Vulnerability assessments, network security assessments, gap analyses, source code reviews, scenario-based tests, and end-to-end testing -- performed at least annually.

Threat-led penetration testing (TLPT). Entities identified by competent authorities must conduct advanced adversary simulation exercises (based on the TIBER-EU framework) at least every three years, performed by qualified independent testers covering critical ICT systems.

Impact on SaaS providers: If your service supports critical functions for a financial entity, you may be directly included in their TLPT scope. Your infrastructure and operations may be subject to penetration testing directed by your financial entity customers.

Pillar 4: ICT Third-Party Risk Management

This pillar has the most direct impact on technology providers. DORA imposes detailed requirements on how financial entities manage their ICT third-party relationships:

Pre-contractual assessment. Before entering into ICT service arrangements, financial entities must assess whether the arrangement covers critical or important functions, evaluate concentration risk, conduct due diligence on the provider, and identify conflicts of interest.

Mandatory contractual provisions. DORA Article 30 specifies minimum contractual terms that must be included in ICT service agreements. These are not negotiable. They include:

Clear description of all functions and services, including quantitative and qualitative performance targets
Provisions on availability, authenticity, integrity, and confidentiality of data
Provisions on data access, recovery, and return in case of insolvency, resolution, or discontinuation of operations
Service level descriptions with precise quantitative and qualitative targets
Reporting obligations of the provider, including notification of ICT incidents
The right of the financial entity (and its competent authority) to audit and inspect the provider
Exit strategies with adequate transition periods and data portability guarantees
Requirements for the provider to participate in the financial entity's ICT security awareness programs
Provisions on subcontracting, including conditions for sub-outsourcing and notification requirements

Register of information. Financial entities must maintain a detailed register of all ICT third-party arrangements, including the nature of services provided, the criticality assessment, and the contractual terms. This register must be available to competent authorities upon request.

Impact on SaaS providers: Your standard terms of service will almost certainly not satisfy DORA's mandatory contractual provisions. Financial entity customers will present you with DORA-compliant contract addenda or entirely new agreements. You must be prepared to accept audit rights, provide detailed incident notification, support exit and transition planning, and disclose your subcontractor chain.

DORA encourages financial entities to participate in information-sharing arrangements for cyber threat intelligence and information. Participation is voluntary, but entities that do participate must establish processes for handling shared information securely and in compliance with data protection rules.

Impact on SaaS providers: You may be asked to participate in or provide inputs to threat intelligence sharing arrangements. Your contracts may include provisions for sharing anonymized incident data or threat indicators with industry groups or regulators.

Compliance Timeline and Enforcement

DORA became applicable on January 17, 2025. Financial entities and their critical ICT third-party service providers are expected to be compliant. The regulation is directly applicable in all EU member states -- it does not require national transposition.

Enforcement is handled at two levels:

Financial entities are supervised by their existing competent authorities (national financial regulators), who can impose administrative penalties and remedial measures. The specific penalty amounts are defined by member state legislation transposing the DORA framework.

Critical ICT third-party service providers are subject to direct oversight by a Lead Overseer (one of the ESAs). The Lead Overseer can conduct inspections, issue recommendations, and -- if recommendations are not followed -- request that financial entities suspend or terminate arrangements with the provider. The Lead Overseer can also impose periodic penalty payments on critical providers that fail to comply with oversight measures.

How SaaS Companies Serving EU Financial Institutions Are Affected

Even if your company is not designated as a critical ICT third-party service provider, DORA affects you through your financial entity customers' compliance obligations. Here is what to expect:

New contractual requirements. Financial entity customers will require DORA-compliant contract terms. Prepare template addenda that address Article 30 requirements, including audit rights, incident notification timelines, exit strategies, and subcontractor transparency.

Enhanced due diligence questionnaires. Expect questionnaires that are more detailed than SOC 2 or ISO 27001 assessments. DORA-specific questionnaires cover ICT risk management governance, asset classification, resilience testing, incident response maturity, business continuity, and subcontractor management.

Audit and inspection obligations. Financial entities and their regulators have the right to audit your operations. This includes on-site inspections. Consider whether pooled audit arrangements (where multiple financial entity customers share a single audit) are feasible to reduce operational burden.

Incident notification acceleration. DORA's incident reporting timelines are aggressive. Your incident detection, classification, and customer notification processes must operate within hours, not days. Ensure your incident response runbooks include DORA-specific notification procedures for financial entity customers.

Exit planning and data portability. You must demonstrate that financial entity customers can transition away from your service without disruption, data loss, or reduction in compliance posture. This requires documented exit plans, data export capabilities, and defined transition support periods.

Subcontractor transparency. If you use sub-processors, hosting providers, or other third-party services as part of your delivery, you must disclose these to financial entity customers and ensure they meet DORA-compatible standards. Changes to subcontractors may require advance notification and approval.

Where QuickTrust Fits

QuickTrust helps SaaS companies and technology providers build DORA-compatible compliance programs that satisfy European financial entity customers without derailing product roadmaps. The platform maps DORA requirements to specific controls, identifies gaps against your existing SOC 2 or ISO 27001 certifications, and provides engineering implementation for technical controls -- resilience testing infrastructure, incident response automation, asset classification, and audit evidence management.

Our team of Big 4-trained security experts and DevOps engineers implement the technical and operational changes required for DORA compliance, reducing internal engineering drain to approximately two hours per week. With a 100% audit pass rate across 100+ engagements, QuickTrust turns DORA compliance from a customer retention risk into a competitive advantage in the European financial services market.

Schedule a 20-minute readiness call to assess your DORA exposure and map a compliance timeline that aligns with your financial entity customers' requirements.

DORA Compliance: The Complete Guide to the Digital Operational Resilience Act for Financial Services and Their Tech Providers