DORA and ICT providers: what changes for those operating in Spain

For a long time, the relationship between a financial entity and its technology provider was managed like any other purchase: price, scope, an SLA and a confidentiality clause. The European Union's Digital Operational Resilience Act, known as DORA, changes that approach. The resilience of digital services becomes a regulatory obligation of the entity, and since much of that service is delivered by third parties, the requirements reach providers too.

This article summarizes what DORA is, what financial entities will ask of their IT providers, and how a provider delivering services in Spain can prepare, including those operating from Latin America.

What DORA is and when it applies

DORA is Regulation (EU) 2022/2554 on digital operational resilience for the financial sector. It has applied since 17 January 2025. As a regulation, it is directly applicable in every Member State, including Spain, with no need for transposition. It is supplemented by technical standards that detail many of its requirements.

It targets a broad set of financial entities (among others, credit institutions, payment institutions, investment firms and insurers) and is organized into five pillars:

• ICT risk management: a governance and control framework for technology risk, with accountability at the management body.
• ICT-related incident management, classification and reporting: detecting, classifying and reporting major incidents to the authority.
• Digital operational resilience testing: a proportionate testing program, which for some entities includes advanced threat-led testing.
• ICT third-party risk management: controlling the risks technology providers bring across the full contract lifecycle.
• Information sharing on cyber threats among entities.

DORA also creates an oversight framework for critical ICT third-party service providers. The European Supervisory Authorities can designate as critical those providers whose failure would affect many entities, and those providers become subject to direct oversight at European level.

Why it affects providers even if they are not financial entities

Most IT providers are not direct addressees of DORA. However, the financial entity remains fully responsible for compliance even when it outsources a service. That is why it will pass its obligations down through contracts, assessment questionnaires and periodic reviews.

In practice, this shows up in several ways: longer procurement processes, more questions about subcontracting and data location, requirements to take part in testing and incident management, and renegotiation of existing contracts to add new clauses. A provider that arrives prepared reduces friction and stands out; one that does not may be left out of selection processes.

This includes providers headquartered outside the European Union, such as Latin American companies delivering development, support or operations services to Spanish financial entities. The contractual requirements reach them just the same.

Considerations for providers operating from outside the EU

Delivering services to a Spanish entity from another country is entirely possible, but it raises questions worth settling before the questionnaire arrives:

• Location of data and staff. The entity will want to know from which countries its systems are accessed and where its data is stored or processed.
• Personal data protection. If the service involves processing personal data from outside the European Union, the General Data Protection Regulation rules on international transfers also apply, independently of DORA.
• Time zone coverage. Incident cooperation requires a response during the entity's hours. A time difference of several hours must be covered with agreed shifts or on-call rotations.
• Access for auditors and authorities. Audit and inspection rights also apply to facilities and processes outside the EU, and the provider must be able to facilitate them.
• Governing law and continuity. The entity will assess whether the legal framework in the provider's country could hinder access to data or an orderly exit.

What financial entities will ask of you

Without going into the detail of each article, these are the topics an IT provider should expect in its contracts and assessments:

Topic	What it usually means for the provider
Service description and service levels	A clear and complete description of the services, with precise, measurable service levels, especially if they support critical or important functions.
Location and subcontracting	Stating where services are delivered and data is processed, and which subcontractors are involved, with conditions on subcontracting.
Security and data protection	Measures for data availability, authenticity, integrity and confidentiality, and guarantees of access and return.
Incident cooperation	Assisting the entity when an ICT incident related to the service occurs, with timely information so it can classify and report it.
Resilience testing	Taking part in the entity's testing and, where applicable, in advanced threat-led testing.
Access, audit and inspection	Access, inspection and audit rights for the entity and for competent authorities.
Termination and exit strategy	Defined termination rights and a transition period that lets the entity migrate the service without disrupting its operations.
Training and awareness	Participation in the entity's ICT security awareness and resilience programs.

One point worth understanding well is the register of information. Financial entities must maintain a register of all their contractual arrangements with ICT service providers and make it available to the authority. To populate it, they will ask providers for structured data on the service, the provider entity, relevant subcontractors and locations. Having that information ready and up to date avoids back and forth.

How a provider prepares

A checklist to review before the next renewal or tender:

• A clear service catalog, with scope, service levels and measurement method per service.
• A map of subcontractors and locations: who is involved in each service, from where and with what access to data.
• A documented incident management process, with client communication times, report content and owners. Being able to deliver fast, accurate information is key so the entity can meet its own reporting deadlines.
• A service continuity and recovery plan, tested and with evidence of the tests.
• Readiness for joint testing: environments, windows and owners to take part in the client's exercises.
• An exit plan per service: how data is returned, which documentation is handed over and what support is provided during transition.
• Security evidence: current certifications (for example, ISO/IEC 27001), audit reports and up-to-date policies.
• A data template for the client's register of information, maintained by an internal owner.
• A contract or addendum template reviewed by your legal team that anticipates the usual clauses.

A common mistake is answering each client from scratch. It pays to prepare a standard package (service description, controls, incident plan, exit plan and register data) that is then tailored to each case.

Critical providers and proportionality

Only a small number of providers will be designated as critical at European level, typically large platforms that many entities depend on. For everyone else, the requirements arrive through contracts, but they are not minor: if your service supports a critical or important function of the entity, conditions will be stricter.

DORA also includes the principle of proportionality: requirements apply according to the size, risk profile and nature of the entity and its services. That means two clients may ask for different things for the same service. Ask the client how it has classified the contracted service, because that classification drives much of what will be required.

In Spain, compliance oversight lies with the financial authorities according to the type of entity. For the provider, the relationship remains with its client, but it should be ready for an authority to request information or access through that client.

This article is informational and does not constitute legal advice: validate how DORA applies to your contracts and services with your compliance team or legal counsel.