Regulation & Disputes / Germany & European Union
Financial-sector technology relationships require a specific operational-resilience assessment. We advise financial businesses and ICT suppliers on the contractual and governance interfaces under DORA.
Where we can help
ICT relationships
We assess the service, the parties and the function supported. DORA’s ICT third-party framework and existing sectoral outsourcing rules can apply alongside each other; they should not be treated as identical concepts.
Contract requirements
Negotiations may need to cover service descriptions, locations, incident assistance, access and audit, subcontracting, termination and exit. Requirements should be matched to the relevant function and risk, rather than copied indiscriminately into every supplier contract.
Operational evidence
A contract review should connect to the customer’s registers, risk decisions and supervision. Suppliers need a realistic account of the information and cooperation they can provide throughout the relationship.
From assessment to implementation
We establish the relevant role and legal framework, review the product and contractual documentation, and identify the decisions needed before launch or the next procedural step. The engagement can include a written assessment, revised agreements and support in negotiations or proceedings.
Four practical examples
Illustrative scenarios, not reports of client mandates. The appropriate response depends on the facts and applicable law.
Cloud supplier
A provider negotiates access and audit clauses with a regulated customer while protecting other customers’ confidentiality.
Payment platform
A business maps the ICT dependencies supporting payment operations and identifies contractual gaps.
Subcontracting change
A supplier proposes a new service location. The parties assess information, objection and risk-management requirements.
Exit from critical service
A financial business specifies a staged migration and continuity plan before exercising termination rights.
What to send us
Please describe the product or dispute, the countries involved, your role and any deadline. Relevant contracts, technical documentation, correspondence and a short chronology help us identify the next steps. Agree a secure transfer channel before sending sensitive records.
Discuss your next step
We can define the scope of a review, identify urgent measures and agree the work and fees before proceeding. A website enquiry alone does not establish a mandate.
Related: IT & AI services · Legal updates · Our attorneys
Legal framework and further reading: BaFin: DORA implementation guidance. Content reviewed: 12 November 2026.