DORA for SMB Suppliers to Financial Institutions

From January 2025, every bank, insurer, or investment fund expects its suppliers to be DORA-compliant. As an SMB supplier, those requirements will land in your contracts.

DORA (Digital Operational Resilience Act) is an EU regulation that requires banks, insurers, investment funds, and payment service providers to meet stricter IT-resilience standards. If you supply software to that sector as an SMB, those requirements will flow down to you through your contracts.

What does this mean in practice for suppliers?

• Contractual security requirements are getting stricter. Clients in the sector will ask for ISO 27001 or SOC 2 Type II certification, plus additional clauses.
• Incident reporting obligations: you must report incidents to your financial clients within fixed timeframes.
• Risk management covering third-party suppliers — including you as a vendor — must be explicit.
• Testing regime: your clients may expect the right to conduct penetration tests or resilience tests against your systems.

Action steps

1. ISO 27001 as your foundation (pillar).
2. An incident reporting procedure that distinguishes between general notification obligations and the sector-specific DORA reporting obligation.
3. A subcontractor register — which of your own suppliers indirectly touches your financial clients.
4. Review your contract templates for financial clients.

Related topics: ISO vs SOC 2 and processing register.