We supply banks, does DORA hit us?

DORA has applied since 17 January 2025. It targets financial entities, but via the critical ICT third-party regime and contract terms it cascades to suppliers.

Try this first

1. 1Confirm whether your customer is a financial entity under DORA: bank, insurer, investment firm, payment institution, credit institution. Then DORA reaches you contractually.
2. 2Expect contract updates: incident reporting within fixed windows, supervisor audit rights, exit strategy, transfer requirements.
3. 3Build incident detection and logging at a level where you can produce facts in hours, not days. SLA reporting alone is too slow.
4. 4Document concentration risk. If you use sub-suppliers for core function, your customer needs to know.
5. 5Keep test evidence. Pen tests, scenario tests, business-continuity drills will be requested.

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.