The Digital Operational Resilience Act (DORA) came into force across the EU in January 2025. UK-headquartered firms with EU subsidiaries, EU-licensed entities or EU client-facing services are in scope — and the UK regulators (FCA, PRA) are aligning Operational Resilience to a substantially similar standard. Article 30 — the contractual provisions for ICT third-party services — is where many firms have the most work to do.
Who is in scope
DORA applies to "financial entities" — banks, investment firms, asset managers, payment institutions, e-money issuers, central counterparties, central securities depositories, trading venues and a long list of others. It also applies to "critical ICT third-party service providers" — the cloud hyperscalers and a small number of others designated by ESMA.
Even if you are a UK-only firm with no EU operations, the FCA's Operational Resilience regime (PS21/3) substantially mirrors DORA in intent. The contractual standards Article 30 sets out are increasingly being applied across the UK market regardless.
What Article 30 actually requires
Article 30 sets minimum contractual provisions for any ICT service contract. Some apply to all contracts. The fuller list applies to contracts supporting "critical or important" functions — and most firms find that the majority of their material ICT contracts fall into this bucket.
- •Clear description of services + service levels
- •Locations where services are performed + data processed/stored
- •Provisions for subcontracting (with proper oversight)
- •Service availability + accessibility of data
- •Personal data protection (alignment with GDPR Article 28)
- •Assistance with ICT incidents at no additional cost
- •Full cooperation with the financial entity's competent authorities
- •Termination rights + transition assistance + reasonable exit notice
- •Access, inspection and audit rights — for the financial entity AND for competent authorities
- •Service location restrictions + data location commitments
- •Reporting on the provider's ICT business continuity arrangements
- •Participation in the financial entity's threat-led penetration testing (TLPT) — for critical contracts
Where most UK firms have gaps
Almost every ICT contract written before 2024 lacks the TLPT cooperation clause. Many SaaS contracts have explicit audit-rights restrictions that conflict with Article 30. The big hyperscalers have updated their DORA addenda — but the long tail of niche SaaS suppliers has not.
Subcontracting oversight is the second biggest gap. Most contracts allow the supplier to subcontract freely. Article 30 requires the financial entity to have visibility of material subcontractors and (in some cases) consent rights.
Termination + exit assistance is the third. Many SaaS contracts permit termination but provide minimal assistance with data extraction or transition to a successor supplier. Article 30 explicitly requires "reasonable" assistance.
Building the third-party register
Article 28 requires every financial entity to maintain a "Register of Information" — a structured inventory of every ICT third-party arrangement. The technical standards (ITS / RTS) define ~80 data fields per arrangement.
Most firms have a partial register today (typically rolled up from procurement, vendor management and the IT asset database). Pulling these into a single DORA-compliant register, with criticality classification, contract location, subcontracting chains and data residency, is one of the biggest one-off DORA implementation costs.
How Servnet helps
We support FCA-regulated financial services firms across three areas of DORA work: contract review and remediation against Article 30, third-party register build / maintenance, and the technical TLPT preparation and execution that critical-contract holders need.
A typical DORA programme runs: 1) gap analysis across existing ICT contracts (3–4 weeks), 2) prioritised remediation plan (1 week), 3) supplier negotiation support and addenda drafting alongside your legal team (8–12 weeks for the material 20% of suppliers), 4) Register of Information build + ongoing maintenance tooling, 5) TLPT scoping if appropriate.