Cloud and Outsourcing Under DORA: What DACH Supervisors Now Expect

For a decade, every conversation between a fintech and a DACH supervisor eventually arrived at the same question: “And who actually runs this?” The answers — a hyperscaler here, a BPO provider there, a chain of sub-processors below — were governed by a patchwork of outsourcing circulars. Since January 2025, DORA has replaced the patchwork for ICT services with a single, directly applicable regime, and it has sharpened the question considerably; outsourcing without an ICT element, such as a classic BPO arrangement, remains under the existing outsourcing rules.

The Digital Operational Resilience Act treats ICT third-party risk as one of its five pillars, alongside risk management, incident reporting, resilience testing, and information sharing. The conceptual shift matters: outsourcing is no longer a procurement topic with a compliance annex; it is part of the firm's operational resilience posture, owned by the management body and evidenced continuously.

The Register of Information: Small Name, Large Project

Every financial entity must maintain a register of information covering all contractual arrangements with ICT third-party providers — mapped to the functions they support, flagged for criticality, and reported to supervisors. Firms that attempted this as a spreadsheet exercise discovered the real difficulty: the register forces an honest inventory of the estate, including the shadow contracts, the sub-outsourcing chains nobody documented, and the “temporary” tools that became load-bearing. In the DACH supervisory culture, an incomplete register is not a formality gap — it is evidence that the firm does not know its own dependencies.

The contractual layer follows from the register. DORA prescribes minimum contract content for ICT services — audit and access rights, termination rights, sub-contracting conditions, and, for critical functions, exit strategies that are actually executable. Legacy contracts written under older regimes rarely satisfy this out of the box; repapering programmes have been a defining workstream of 2025 and 2026.

Concentration Risk and the Hyperscaler Question

DACH supervisors have voiced concentration concerns about cloud infrastructure for years; DORA gives the concern teeth at two levels. At firm level, institutions must assess concentration before contracting — including the awkward question of what happens if the chosen provider fails, degrades, or becomes commercially hostile. At Union level, critical ICT third-party providers are designated under a dedicated oversight framework, with the European Supervisory Authorities empowered to examine the providers directly. For the first time, the hyperscalers are inside the supervisory perimeter rather than beyond it.

“

The cloud discussion in finance has matured from “is it allowed?” through “is it safe?” to the DORA question: “can you prove you would survive its failure?”

Exit Strategies: The Fiction Test

Nothing exposes the quality of an outsourcing framework like its exit strategy. Under DORA, exit plans for critical functions must be documented, tested against realistic scenarios, and free of the fiction that a core system migration happens in the notice period of a standard contract. Serious firms distinguish stressed exits (provider failure, supervisory order) from planned ones, quantify data portability in practical terms — formats, volumes, dependencies — and maintain sufficient internal knowledge to re-tender at all. Supervisors do not expect exits to be painless; they expect them to be real.

The DACH Layer on Top

DORA harmonises, but local texture persists. In Germany, BaFin's supervisory practice — shaped by years of MaRisk and BAIT enforcement — continues to influence how examinations run and what documentation depth is considered credible; the migration of BAIT into the DORA framework consolidates expectations rather than lowering them. Switzerland, outside DORA, runs its own operational-resilience track through FINMA's outsourcing and operational-risk rules, which converge in substance while differing in procedure — the recurring DACH pattern that multi-market firms must design for.

Sub-Outsourcing: The Chain Below the Contract

The provider you contract is rarely the provider who computes. Beneath every managed service sits a chain — the SaaS vendor on a hyperscaler, the KYC utility on another SaaS, the support function in a third country — and DORA obliges firms to know that chain for the services supporting critical functions, to constrain material sub-outsourcing contractually, and to receive notice before it changes. In practice this converts vendor management from bilateral relationship maintenance into supply-chain cartography, and it surfaces uncomfortable discoveries: chains that circle back to a single infrastructure provider, fourth parties in jurisdictions the risk appetite never contemplated, and notification clauses that existed only on paper.

The pragmatic posture is materiality-driven: map exhaustively where the function is critical, contract for transparency everywhere, and reserve genuine veto rights for the links whose failure would propagate. Perfection across the entire estate is neither expected nor achievable; ignorance about the critical chains is neither acceptable nor survivable in an examination.

When Things Break: Incidents Meet Outsourcing

DORA's incident regime and its outsourcing regime meet in the worst hour: a major ICT incident at a provider is the firm's incident, with the firm's classification duties and the firm's reporting deadlines. That has contractual consequences — providers must be bound to notify fast enough for the institution to meet its own clocks — and operational ones: playbooks that assume the provider's status page is a sufficient information channel fail the first real test. Firms that rehearse provider-outage scenarios jointly with their critical vendors convert a compliance requirement into genuine resilience; the rest discover during an outage that their escalation matrix contains a ticket queue.

A Working Checklist

1. 01Build the register of information as a living system with ownership, not as an annual spreadsheet.
2. 02Repaper critical ICT contracts against DORA minimum content — audit rights, exit terms, sub-outsourcing transparency.
3. 03Assess concentration honestly, including sub-provider chains that resolve to the same infrastructure.
4. 04Write exit strategies that name systems, data volumes, and timelines — then test them.
5. 05For Swiss operations, map FINMA expectations separately and reconcile the frameworks once.

Testing: From Tabletop to TLPT

Resilience testing under DORA scales with the institution: everyone tests their ICT tools and systems regularly, while significant entities face threat-led penetration testing — realistic attack simulations against live production systems, run under supervisory oversight and involving critical providers where relevant. Even firms below the TLPT threshold should read the direction: assumptions about provider failover, backup restoration times, and incident communication are claims until tested, and supervisory interviews increasingly distinguish between resilience frameworks that were exercised and those that were merely written.

Conclusion

DORA has turned outsourcing governance from a filing obligation into an engineering discipline with legal force. For market entrants, that is good news in disguise: a firm that arrives with a clean register, DORA-grade contracts, and tested exit plans signals operational maturity in the language DACH supervisors respect most. Aegiron Capital Group supports fintechs and their technology vendors in preparing for the outsourcing and resilience questions that banks and supervisors in the DACH region ask; legal advice and security assessments come from the law firm and specialists you engage.