My customer is a bank. Does DORA apply to my IT company?

Why DORA reaches you anyway

DORA lists ICT third-party service providers in its scope (Article 2(1)(u)), but the duties to manage ICT risk sit with the 20 kinds of financial entity in points (a) to (t). Article 28(1)(a) then closes the door on outsourcing the problem: the financial entity "shall, at all times, remain fully responsible" for complying with DORA.

A bank cannot meet that standard with a contract that leaves you free to change data centres without notice or to refuse an audit. So Article 30 lists the clauses every ICT contract must contain, and a longer list for contracts that support a critical or important function. The whole contract, service levels included, must sit in one written document.

What the bank will ask you for

Expect a request for your LEI. Every financial entity keeps a register of all its ICT contracts (Article 28(3)) and files it with DNB or the AFM once a year. Implementing Regulation (EU) 2024/2956 requires a valid and active Legal Entity Identifier or a European Unique Identifier (EUID) for every provider that is a legal person. A provider established outside the EU can only use an LEI. The same regulation asks for identifiers of your subcontractors that support the bank's critical or important functions, collected through you (Article 3(6)). If you do not know your own supply chain to that depth, the bank will find out when it fills in the register.

Your subcontractors are part of the deal

Delegated Regulation (EU) 2025/532 has applied to subcontracting since 22 July 2025. It requires you to monitor every subcontracted service that supports a critical or important function, and to pass the bank's audit and access rights down to your subcontractors. The bank must get a reasonable notice period to object to material changes. Subcontracting something the contract does not explicitly permit gives the bank a right to terminate (Article 6(c)).

Can DORA apply to you directly?

Only if you are designated.

On 18 November 2025 the European supervisors published the first list of 19 critical ICT third-party service providers, drawn from the registers banks filed. Those providers are overseen directly by the EBA, ESMA or EIOPA (Article 31). A provider not on the list may ask to be designated (Article 31(11)). Intra-group providers, and providers serving only financial entities in their own Member State, are exempt from designation (Article 31(8)).

The Cyberbeveiligingswet is a separate question

The Dutch implementation of NIS2 applies by sector and size, not by who your customers are. Managed service providers and managed security service providers form a sector of their own, and cloud and data centre services sit under digital infrastructure. At medium size or above you are at least a belangrijke entiteit.

Banks escape most of the Act because DORA covers the same ground.

Articles 22 and 31 of the Cyberbeveiligingswet switch off the duty of care and the incident reporting duty "op die entiteit": on the bank, not on you. A medium-sized managed service provider with only bank customers registers with the NCSC through mijn.ncsc.nl (Article 44) and reports significant incidents to the NCSC within 24 and 72 hours (Articles 26 and 27). Its supervisor is the RDI.