key takeaways
- DORA does not directly regulate every ICT vendor a fintech uses — but it imposes obligations on the financial entity that flow down contractually to vendors supporting critical or important functions, so the practical answer is usually “your vendor is affected even if DORA doesn’t apply to them directly”
- Common gap: fintechs assume that because a vendor isn’t itself a “financial entity,” DORA is irrelevant to that relationship – in practice, DORA requires the fintech to impose specific contractual terms on vendors and maintain oversight regardless of the vendor’s own regulatory status
- Critical ICT third-party providers (a narrower category designated by EU authorities, typically large cloud and infrastructure providers) are subject to direct EU-level oversight – but most fintech vendors fall outside this category and are instead managed through the fintech’s own DORA compliance obligations
- Every vendor supporting a critical or important function needs to be captured in the fintech’s Article 28 register of information, with contractual terms covering audit rights, termination rights, sub-outsourcing notification, and exit assistance
- Common gap: cloud and SaaS agreements signed before DORA became enforceable often lack these required terms entirely – a live contract review against DORA’s Article 30 minimum contractual provisions is usually necessary, not optional
As a fintech lawyer in Poland advising payment institutions, EMIs and crypto-asset businesses on DORA compliance, “does DORA apply to our vendor?” is a question I hear constantly – usually from a fintech that has just realised its cloud provider, core banking software vendor or fraud-detection tool provider isn’t itself DORA-regulated, and isn’t sure what that means for them.
DORA Fintech Vendor: Two Different Questions
There are actually two separate questions hiding inside “does DORA apply to my vendor”:
| Question | Answer |
|---|---|
| Is the vendor itself directly regulated by DORA? | Usually no, unless it is separately a financial entity or has been formally designated a “critical ICT third-party provider” by EU authorities |
| Does DORA affect the relationship between the fintech and the vendor? | Almost always yes, if the vendor supports a function the fintech has assessed as critical or important |
The second question is the one that actually matters operationally for most fintechs, because DORA places the compliance burden on the financial entity to manage its ICT third-party risk – including flowing specific contractual requirements down to vendors, regardless of the vendor’s own regulatory status.
What DORA Requires in Vendor Contracts
Under DORA’s third-party risk management provisions, contracts with ICT providers supporting critical or important functions need to include specific minimum terms, commonly covering:
- A clear description of the services provided, including whether sub-outsourcing is permitted and under what conditions
- Audit and access rights, allowing the financial entity (and relevant authorities) to inspect the vendor’s performance and controls
- Data location and processing terms, including where data is stored and processed
- Incident notification obligations, so the financial entity can meet its own DORA incident reporting timelines
- Termination rights and exit assistance, ensuring the fintech can transition away from the vendor without unacceptable service disruption
- Service level commitments tied to the criticality of the function supported
Common gap: many existing SaaS and cloud contracts – particularly ones signed before the fintech became fully DORA-aware – are missing several of these terms entirely, most commonly audit rights and structured exit assistance.
How to Assess Whether a Vendor Supports a “Critical or Important Function”
This classification sits with the fintech, not the vendor, and should consider:
- Would a failure of this vendor materially disrupt the fintech’s ability to provide its regulated services?
- Does the vendor process, store or have access to data essential to the fintech’s core operations?
- How readily could the function be substituted with an alternative provider if needed?
- Is the function subject to specific regulatory expectations (e.g. core payment processing, KYC/AML screening tools)?
Common gap: fintechs classify only their most obvious infrastructure vendors (cloud hosting) as critical, while overlooking smaller but operationally essential vendors – such as a KYC/AML screening API or a fraud-scoring tool – that would just as clearly disrupt operations if they failed.
Frequently Asked Questions
If our vendor says “we’re DORA compliant,” does that cover us?
Not automatically. A vendor’s own DORA-readiness (if it happens to be a regulated entity itself) doesn’t substitute for the specific contractual terms DORA requires the fintech, as the financial entity, to have in place with that vendor.
Do small or niche fintech vendors need to worry about DORA at all?
They aren’t directly regulated by DORA unless separately in scope as a financial entity, but they should expect fintech clients to request the contractual terms DORA requires — vendors that can’t accommodate audit rights, incident notification and exit assistance may become harder to work with as clients tighten their DORA compliance.
What is a “critical ICT third-party provider” and is our vendor one?
This is a narrower, formally designated category applied by EU authorities to a limited number of large, systemically significant providers (predominantly major cloud and infrastructure providers). Most fintech vendors – including most SaaS and specialist tooling providers – fall outside this designation and are managed instead through the fintech’s own vendor risk management obligations.
How often should vendor contracts be reviewed for DORA compliance?
At minimum, whenever a new vendor is onboarded for a critical or important function, and as part of a one-off review of existing contracts signed before the fintech’s DORA compliance programme was in place — ongoing contracts are not automatically grandfathered out of DORA’s requirements.
What to Do Now
- Classify which vendors support critical or important functions, not just the obviously large infrastructure providers
- Audit existing vendor contracts against DORA’s minimum required terms, prioritising the highest-criticality relationships
- Update the Article 28 register of information to reflect the current, actual vendor landscape
- Build DORA-compliant contractual terms into the standard procurement process for any new critical or important vendor
If you need help assessing your fintech’s vendor contracts against DORA, get in touch. For more see IT Contracts in Poland: A Technology Lawyer’s Guide to SaaS, Cloud and Outsourcing Agreements and Cybersecurity page.
Related posts:
- IT Contracts in Poland: A Technology Lawyer’s Guide to SaaS, Cloud and Outsourcing Agreements
- KNF Licensing in Poland: A Practical Guide for Fintech Companies
Katarzyna Szczudlik is a Partner at Schoenherr in Warsaw and a fintech lawyer in Poland, ranked by Chambers & Partners and Legal 500. She advises payment institutions, EMIs and crypto-asset businesses on DORA compliance and ICT vendor risk management in Poland and the EU. Get in t
