DORA RTS - Third-Party Risk Management (2024/1773 & 2025/532)

What is an "ICT third-party service provider"?

DORA Definition: Any company providing ICT services, including:

☁️ Cloud providers: IaaS, PaaS, SaaS (AWS, Azure, Google Cloud, etc.)
💾 Hosting: Datacenters, colocation, managed hosting
🔐 Security: Antivirus, firewall, SIEM, managed SOC
📊 Software-as-a-Service: Core banking, CRM, ERP, analytics
🌐 Networks: Connectivity, telecommunications, CDN
💳 Payments: Processors, acquirers, gateways
🛠️ Support and maintenance: Managed IT services, application support
🔄 Backup and DRP: Backup and recovery solutions

ICT Services vs. Non-ICT Services

Service Type	Subject to DORA?	Examples
ICT Services	YES - DORA applicable	• Cloud computing • Software licensing • Infrastructure management • Cybersecurity services
Business services with ICT component	PARTIAL - Analysis required	• Business Process Outsourcing (BPO) with IT support • Consulting with IT deliverables • Audit with software tools
Pure business services	NO - Out of scope	• Strategic consulting • Legal services • Cleaning, physical security • Non-IT training

⚠️ ABSOLUTE OBLIGATION: All contracts with ICT providers supporting critical or important functions MUST include the following clauses. Their absence renders the contract non-compliant with DORA.

1. Complete Service Description (Article 3)

Mandatory clause:

✅ Detailed and precise description of ICT services provided
✅ Geographic location of datacenters and data processing
✅ Expected service level (SLA) with measurable metrics:
- Availability (uptime %)
- Performance (response time)
- Support (response/resolution times)
✅ Financial entity's business functions supported by the service
✅ Service criticality (critical / important / standard)

💡 Practical example (Cloud Computing):

"The Provider supplies cloud infrastructure services (IaaS) to host the Bank's core banking application. Virtual servers are located in the Provider's datacenters in Paris (France) and Frankfurt (Germany). The guaranteed SLA is 99.95% monthly availability, with API response time <100ms for 95% of requests. This service supports the Bank's critical function 'Banking Transaction Processing'."

2. Access and Audit Rights (Article 4)

Mandatory clause:

✅ Full and unlimited access rights for the financial entity:
- To provider's premises
- To systems and infrastructure used
- To data and logs
✅ Audit rights by the financial entity or appointed third parties
✅ Audit rights by supervisory authorities
✅ Reasonable notice (typically 15-30 days)
✅ Possibility of unannounced audits in case of incident or suspicion
✅ Provider's obligation to cooperate and provide all required information
✅ Audit costs borne by the entity (except regulatory audits)

⚠️ WARNING - Audit refusal: If a provider refuses to include these clauses, the contract CANNOT be signed for critical or important functions.

Example contractual wording:

"The Provider grants the Client and any third party appointed by the Client (including external auditors and supervisory authorities), full access to the Provider's premises, systems, data and personnel, upon 30 calendar days' notice, to conduct compliance, security and operational audits. In case of major security incident or suspected non-compliance, the Client may demand immediate audit without notice. The Provider commits to cooperate fully and provide all required documents, logs and information within 48 hours."

3. Data Location and Sovereignty (Article 5)

Mandatory clause:

✅ Precise geographic location of ALL data:
- Production data (active)
- Backups
- Archives
- Log and audit data
✅ Commitment NOT to transfer data outside EU/EEA without prior written authorization
✅ If non-EU transfer necessary: GDPR mechanisms (standard contractual clauses, adequacy decision)
✅ Mandatory notification minimum 30 days before any location change
✅ Financial entity's right to refuse location change

💡 Special case: Sovereign Cloud vs. Cloud Hyperscalers

Cloud Type	Advantages	Constraints
EU Sovereign Cloud (OVH, Scaleway, T-Systems)	• 100% data in EU • EU law applicable • Native DORA compliance	• Sometimes limited features • Often higher cost
Hyperscalers (AWS, Azure, GCP)	• Advanced services • Global network • Economies of scale	• Complex DORA clause negotiation • Risk of law conflicts (US CLOUD Act) • Possible direct ESA supervision

4. Security and Data Protection (Article 6)

Mandatory clause:

✅ Obligation to maintain security measures compliant with standards:
- ISO/IEC 27001 (certification desirable)
- SOC 2 Type II
- Or recognized equivalent
✅ Data encryption:
- At rest: AES-256 minimum
- In transit: TLS 1.2+ only
✅ Access controls:
- Multi-factor authentication (MFA) mandatory
- Principle of least privilege
- Data segregation between clients
✅ Monitoring and logging:
- Security logs retained minimum 1 year
- Intrusion detection (IDS/IPS)
- Real-time alerts on security incidents
✅ Security testing:
- Annual penetration tests minimum
- Continuous vulnerability scanning
- Test reports shared with client

📜 Certifications to require from provider:

✅ ISO 27001: Security management system certification
✅ SOC 2 Type II: Operational controls audit over 6-12 months
✅ PCI-DSS: If processing card data
✅ HDS (France): If hosting health data
✅ C5 (Germany): BSI Cloud Security Standard

5. Incident Notification (Article 7)

Mandatory clause:

✅ Notification of ALL ICT incidents affecting provided services
✅ Notification timelines:
- Major incident: 2 hours maximum
- Significant incident: 24 hours maximum
- Other incidents: 72 hours maximum
✅ Notification content:
- Nature of incident
- Affected services
- Impacted clients (estimate)
- Cause (if known)
- Remediation actions
- Estimated resolution timeline
✅ Detailed post-incident report within 5 business days

⚠️ IMPORTANT: Provider-to-client notification timelines (2h) are SHORTER than DORA client-to-supervisor timelines (4h), allowing the client to analyze and classify the incident before regulatory notification.

6. Termination and Exit Rights (Article 8-9)

Mandatory clause:

✅ Termination for legitimate cause without penalty:
- SLA breach for X consecutive months
- Major security incident attributable to provider
- Change of provider control (acquisition, merger)
- Non-cooperation during audits
- Regulatory requirement from supervisory authority
✅ Termination notice:
- Minimum 3-6 months (depending on criticality)
- For critical functions: 6-12 months recommended
- Immediate termination possible in case of serious incident
✅ Mandatory Exit Plan:
- Documented transition procedure
- Exportable data format (open formats)
- Provider assistance during transition
- Data recovery timeframe: 30-90 days
- Secure data destruction after transfer
✅ Service continuity during transition:
- Service maintained at same level during notice period
- Technical support for migration
- No punitive price increases

💡 Exit Plan checklist:

Element	Required Details
Data inventory	Exhaustive list of all stored data, format, volume
Extraction procedure	Technical export method (API, DB dumps, file transfer)
Export format	Open and documented formats (CSV, JSON, XML, SQL)
Timeline	Detailed transition schedule over X weeks/months
Migration tests	Export testing procedure before production
Support	Provider resources dedicated to transition
Data destruction	GDPR-compliant secure destruction certificate

7. Subcontracting (Article 10) - Link to RTS 2025/532

Mandatory clause:

✅ Mandatory prior notification:
- Provider MUST notify minimum 30 days before any subcontracting
- Required information: subcontractor name, subcontracted services, location
✅ Financial entity's objection right:
- Entity may refuse subcontracting
- Response time: 15-30 days
- No response ≠ tacit acceptance
✅ Cascading obligations:
- Subcontractor must comply with ALL same DORA clauses
- Audit rights apply to subcontractors too
- Primary provider's liability maintained
✅ Subcontractor register:
- Provider must maintain up-to-date list of all subcontractors
- Accessible to client upon request
- Quarterly update minimum

⚠️ See RTS 2025/532 below for complete subcontracting details

8. Risk Concentration (Article 11)

Mandatory clause:

✅ Provider obligation to inform about its own dependence on critical suppliers
✅ Information on other major financial clients (sector concentration risk)
✅ Notification if provider becomes "systemic" for the sector

💡 Managing concentration risk:

📊 Multi-cloud strategy: Distribute workloads across multiple clouds
🔄 Portability: Cloud-agnostic application architecture
🎯 Limitation per provider: Internal rule (e.g., max 30% of services from single supplier)
📋 Dependency mapping: Complete ICT supply chain cartography

Objective: Strictly regulate cascading subcontracting to avoid loss of control and ensure ICT supply chain traceability.

Elements to Assess Before Authorizing Subcontracting (Article 3)

Assessment Criterion	Questions to Ask	Risk Level
1. Subcontractor competencies	• Does it have required technical expertise? • Does it hold certifications (ISO, SOC2)? • Similar client references?	✅ Valid certifications ⚠️ Limited experience 🚫 No references
2. Financial stability	• Healthy financial situation? • Profitability history? • Bankruptcy risk?	✅ Strong finances ⚠️ Recent losses 🚫 Financial difficulties
3. Security and compliance	• Adequate security measures? • GDPR compliance? • Incident history?	✅ ISO 27001 + SOC2 ⚠️ Minor past incidents 🚫 Recent breaches
4. Geographic location	• Data remains in EU/EEA? • Compatible applicable laws? • Geopolitical stability?	✅ EU/EEA only ⚠️ Country with Adequacy Decision 🚫 High-risk jurisdictions
5. Subcontracted service criticality	• Impact if subcontractor fails? • Alternatives available? • Replacement time?	✅ Non-critical service ⚠️ Important service 🚫 Critical service without plan B
6. Risk concentration	• What % of our activity via this subcontractor? • How many financial entities use it? • Systemic risk?	✅ Sufficient diversification ⚠️ Moderate dependency 🚫 Critical dependency

Subcontracting Validation Process

D0: Provider notifies intent to subcontract (structured form)
D0 to D7: Financial entity requests additional information if necessary
D7 to D21: Internal risk analysis:
- Assessment per RTS 2025/532 criteria
- Due diligence on subcontractor
- Risk Management + Compliance + IT opinion
D21 to D30: Formal decision:
- ✅ Approval (with or without conditions)
- 🚫 Motivated refusal
- ⏸️ Request for additional information (resets timeline)
Post-approval: Addition to subcontractor register + continuous monitoring

Subcontracting Limits

⚠️ PROHIBITIONS:

🚫 Subcontracting of critical function beyond 2 levels of depth
🚫 Subcontracting to jurisdiction without equivalent protection level (outside EU/EEA without Adequacy)
🚫 Subcontracting without written contract including ALL DORA clauses
🚫 Subcontracting without prior notification and client approval

Example subcontracting chain:

✅ Level 1 (OK): Bank → ICT Provider A (core banking SaaS)
✅ Level 2 (OK): Provider A → Cloud Provider B (infrastructure)
🚫 Level 3 (PROHIBITED for critical function): Cloud Provider B → Datacenter C

DORA Obligation: All financial entities must maintain an exhaustive register of all their third-party ICT providers.

Information to Record for Each Provider:

Category	Required Data
Identification	• Full legal name • LEI code (if applicable) • Registered office address • Country of registration
Service Provided	• Detailed ICT service description • Supported business function(s) • Classification: critical / important / standard • Contract start date • End / renewal date
Data Location	• Countries where data is stored • Countries where data is processed • Datacenter locations • Backup locations
Subcontracting	• List of authorized subcontractors • Subcontracted services • Subcontracting level (1, 2)
Compliance	• Certifications (ISO 27001, SOC2, etc.) • Last audit date • Last audit result • Incidents occurred (last 12 months)

⏰ Register Reporting Obligations:

📅 April 30, 2025: First complete register transmission to authorities
📅 Then annually: Complete update each year
📅 Ad-hoc: Notification within 30 days of any new critical provider

Phase	Actions	Priority	Deadline
Phase 1: Inventory	☐ Inventory ALL current ICT providers ☐ Classify by criticality (critical/important/standard) ☐ Identify non-DORA compliant contracts	URGENT	Immediate
Phase 2: Contract Analysis	☐ Legal review of each contract ☐ Gap analysis vs. RTS 2024/1773 clauses ☐ Prioritize renegotiations (critical functions first)	URGENT	Q1 2025
Phase 3: Renegotiation	☐ Contact each provider ☐ Negotiate contract amendments ☐ Obtain signatures on compliant contracts ☐ Plan B if refusal (change provider)	HIGH	Q2-Q3 2025
Phase 4: Register	☐ Create computerized register ☐ Fill all required data ☐ Validate with Compliance/Risk ☐ Submit to authorities (April 30, 2025)	URGENT	April 30, 2025
Phase 5: Continuous Monitoring	☐ Due diligence process for new providers ☐ Annual review of each provider ☐ Subcontracting notification management ☐ Register update (quarterly)	ONGOING	Permanent

Tactics by Provider Type

1. Hyperscalers (AWS, Azure, Google Cloud, etc.)

Challenge: Standardized contracts, limited flexibility

Strategies:

🤝 Sector coalition: Negotiate collectively via banking associations
📜 DORA Addendums: Many now offer pre-formatted addendums
🔧 Technical configurations: Use offering options to maximize compliance (e.g., AWS EU Sovereign Cloud, Azure Germany, etc.)
⚖️ Escalation: If refusal, alert authorities (ESAs closely monitor hyperscalers)

2. Niche Providers / SMEs

Challenge: Lack of resources for complex compliance

Strategies:

📚 Education: Provide DORA clause templates
🤝 Assistance: Help with compliance implementation (mutually beneficial)
💰 Cost sharing: Fund compliance audits
⏰ Realistic timeline: Grant reasonable implementation deadlines

What to Do if a Provider Refuses?

Hierarchical escalation: C-level on both sides
Authority notification: Inform supervisor of blockage
Migration plan: Prepare provider change
- Timeline: 6-18 months depending on criticality
- Budget: Anticipate migration costs
- Operational risk: Manage transition without interruption
Last option: Maintain service but downgrade it (change from "critical" to "important" by modifying architecture)

RTS 2024/1773: Complete text of contractual clauses (EUR-Lex)
RTS 2025/532: Subcontracting details (EUR-Lex)
ITS 2024/2956: Provider register template
EBA Guidelines: Examples of contractual wording by service type
DORA Article 28-30: Legal basis for third-party management

🤝 RTS on Third-Party Risk Management

📋 Executive Summary

🎯 Scope of Application

What is an "ICT third-party service provider"?

ICT Services vs. Non-ICT Services

📝 RTS 2024/1773: Mandatory Contractual Clauses

1. Complete Service Description (Article 3)

2. Access and Audit Rights (Article 4)

3. Data Location and Sovereignty (Article 5)

4. Security and Data Protection (Article 6)

5. Incident Notification (Article 7)

6. Termination and Exit Rights (Article 8-9)

7. Subcontracting (Article 10) - Link to RTS 2025/532

8. Risk Concentration (Article 11)

🔄 RTS 2025/532: Subcontracting Rules

Elements to Assess Before Authorizing Subcontracting (Article 3)

Subcontracting Validation Process

Subcontracting Limits

📊 ICT Provider Register (ITS 2024/2956)

Information to Record for Each Provider:

⏰ Register Reporting Obligations:

✅ Compliance Checklist

💡 Negotiation Strategies with Providers

Tactics by Provider Type

1. Hyperscalers (AWS, Azure, Google Cloud, etc.)

2. Niche Providers / SMEs

What to Do if a Provider Refuses?

📚 Resources and Templates