You run a UK software or services business, you supply a bank or a fintech, and a contract has just landed on your desk with clauses about operational resilience, incident reporting and audit rights that were not there last year. Put plainly: if you supply EU banks or fintechs, new contract clauses are coming, and if you cannot answer them the deal stalls. The reason is a piece of EU regulation called DORA. Even though your business is not directly regulated by it, DORA is reshaping what your financial-services customers must demand from their suppliers, and that pressure flows straight to you through contracts. This article explains what DORA is, who it binds, why UK SMEs feel it anyway, and the practical steps that keep you contract-ready.
What DORA is
DORA, the Digital Operational Resilience Act, is an EU regulation that sets common rules on how financial firms manage technology and cyber risk so that the sector can keep running through disruption. It entered into application on 17 January 2025 (ESMA) and now applies to some 20 types of EU financial entity — an estimated 22,000-plus financial entities and their ICT providers (PwC estimate). Crucially, it does not stop at the banks themselves. A large part of DORA is about the technology suppliers those firms depend on.
Who it binds, and why UK SMEs feel it
DORA directly binds EU financial entities: banks, insurers, investment firms, payment providers and more. UK firms are not directly caught by DORA; the UK runs its own operational resilience regime through the Bank of England, the PRA and the FCA (PwC UK). So on paper, a UK supplier is outside the regulation. (A small number of the very largest ICT providers can be formally designated Critical Third-Party Providers, or CTPPs, and supervised directly by the EU authorities under DORA’s Oversight Framework, but this does not apply to ordinary SMEs — for them, DORA is felt through customer contracts.)
In practice you are not. DORA requires those EU financial entities to manage the risk from their technology suppliers, wherever those suppliers are based, including outside the EU (EIOPA). If you provide ICT services to an EU financial firm, your customer is now obliged to hold you to DORA-shaped standards through the contract. You feel the regulation not because a regulator writes to you, but because your customer has to. That is why the clauses changed.
What the ICT third-party rules expect
DORA sets out specific expectations for how financial firms handle their technology suppliers, and these translate into the demands you are now seeing:
A register of information
Financial entities must keep a detailed register of every ICT contractual arrangement, including the supply chain and subcontractors, and submit it to regulators. First submissions were due by 30 April 2025, using a reference date of 31 March 2025, with earlier national collection deadlines through April 2025; it is an ongoing annual obligation, not a one-off (ESAs; CSSF). For you as a supplier, this is why customers now ask precise questions about where your service runs, where data is stored, and who you subcontract to.
Minimum contract terms
DORA tiers its contract requirements. Article 30(2) sets baseline terms that must appear in every ICT contract, whatever the service does: a clear description of the service, the locations where data is processed and stored, service levels, security requirements, and basic reporting. If your service does not support a critical or important function, this lighter set is broadly the ask you will face.
Article 30(3) then adds heavier terms, but only where the ICT service supports a critical or important function: full audit and access rights, documented exit strategies, and stricter conditions on subcontracting. A UK SME whose service does not underpin a critical or important function should expect the lighter 30(2) ask, not the full 30(3) set (McCann FitzGerald). These are the clauses appearing in your agreements.
Subcontractor discipline
Your customer must ensure your subcontractors meet the same standards. Expect to be asked to name material subcontractors, notify changes, and pass equivalent obligations down the chain (Sidley Data Matters).
Practical steps for a UK SME supplier
- Know which of your customers are EU financial entities. That tells you where DORA pressure will land first.
- Map your own supply chain. List the subcontractors and cloud services your product depends on, and where each processes data. You will be asked.
- Get your evidence in order: security policies, incident response plan, business continuity and disaster recovery arrangements, and proof they have been tested. At a minimum, restore one critical system from backup once and record how long it took, and run a 30-minute tabletop of a supplier-outage scenario — evidence beats intention.
- Be ready to support incident reporting. If you have an outage or security event that affects a financial customer, they have tight timelines, so agree in advance how and how fast you will notify them.
- Read the resilience clauses before you sign, and make sure you can actually meet the audit, exit and service-level terms you are agreeing to.
Where firms get caught out
The most common surprise is not a specific clause but the gap between what a contract promises and what a business can actually evidence. It is easy to sign up to an audit right, an incident-notification window or a service level. It is much harder to prove, months later, that you have a tested backup, a rehearsed incident plan and an accurate list of your subcontractors. A financial customer under DORA is expected to verify, not just take your word, so the terms you agree to are terms you may be asked to demonstrate. Sign only what you can stand behind.
A second trap is treating this as a one-off. DORA-driven oversight is continuous: registers are updated and resubmitted, and customers review their material suppliers on a cadence (Sidley Data Matters). A supplier that treats resilience as a form-filling exercise at contract signing, rather than an ongoing capability, tends to get found out at the first annual review.
This is an opportunity, not just a burden
It is easy to read all of this as pure cost. It is worth reframing. A UK SME that can answer resilience questions quickly, produce evidence on request and speak the language of operational resilience has a real advantage over competitors who cannot. In a market where your financial-services customers are obliged to scrutinise their suppliers, being the easy, credible one to work with wins and keeps contracts. The firms that treat DORA-driven demands as a chance to tidy up their security tend to find the exercise pays for itself.
How this maps to the TrustOps Maturity Model
Answering DORA-driven demands credibly is largely a Level 3 (Managed) and Level 4 (Measured) capability: policies that are live and monitored, a supplier list, an incident response plan that exists and has been rehearsed, and evidence you can produce on request. Firms stuck at Level 1 or 2 tend to stall deals while they scramble for evidence. A Framework Assessment locates you on the model and turns a stalled contract into a clear list of what to fix.
If you are not sure where you stand today, the honest first move is to find out. Our free 15-minute assessment scores you out of 100 against the same six functions, shows your top five gaps, and gives you a maturity level you can act on, whether or not we ever speak again. Start with the free assessment at trustops.co.uk.
Sources
ESMA – Digital Operational Resilience Act (DORA) (application from 17 January 2025): https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora
EIOPA – Digital Operational Resilience Act (DORA) (scope, including third-country ICT providers): https://www.eiopa.europa.eu/digital-operational-resilience-act-dora_en
PwC UK – DORA and its impact on UK financial entities and ICT service providers (source of the ~22,000-plus financial entities and ICT providers estimate; UK regime context): https://www.pwc.co.uk/industries/financial-services/insights/dora-and-its-impact-on-uk-financial-entities-and-ict-service-providers.html
Sidley (Data Matters) – Time to Register Your ICT Third-Party Service Providers under DORA (register of information and subcontractors; first submissions collected by national authorities in April 2025): https://datamatters.sidley.com/2025/04/15/financial-entities-in-the-eu-time-to-register-your-ict-third-party-service-providers-under-dora/
CSSF (Luxembourg) – Register of information under DORA (national submission of the register of information; reference date 31 March 2025, submission by 30 April 2025): https://www.cssf.lu/en/dora/
McCann FitzGerald – Delving into DORA: ICT Contractual Arrangements (Article 30 minimum terms): https://www.mccannfitzgerald.com/knowledge/data-privacy-and-cyber-risk/delving-into-dora-ict-contractual-arrangements
General information, current as of July 2026 — not legal or regulated compliance advice. Verify against current primary sources.
