Selling SaaS to Banks: Passing DORA Vendor Due Diligence — From Article 30 Clauses to the Exit Plan

Since January 2025, a bank buying software is no longer just a customer. Under the Digital Operational Resilience Act, it is a regulated entity that must assess, contract, register, monitor, and be able to exit every ICT service it relies on. For SaaS vendors, this changes the sales cycle: the buyer's obligations become your questionnaire, your contract clauses, and — if you get it right — your competitive advantage.

DORA regulates financial entities, not their vendors. Most SaaS providers are not directly supervised — unless they are among the critical ICT third-party providers the European Supervisory Authorities designated for the first time in November 2025. But DORA reaches every vendor indirectly, because financial entities may only use ICT services on terms that let them meet their own obligations.

What the Customer Must Do — and Therefore Asks You

• Pre-contract assessment (Art. 28): due diligence on the vendor's suitability, security, and risks — including whether the service supports a critical or important function.
• Register of information: every ICT contract is recorded in a register that supervisors collect — including your subcontractors for critical services.
• Concentration risk (Art. 29): the customer must assess dependency on single providers and substitutability.
• Contract content (Art. 30): mandatory clauses for all ICT services, and extended ones for services supporting critical or important functions.
• Exit strategy: documented, tested plans to leave the vendor without disrupting the business.

The Article 30 Clauses Vendors Must Accept

For all ICT services, contracts must cover among other things a clear service description, the locations where data is processed, data protection and security, access to and return of data on termination or insolvency, service levels, assistance with ICT incidents, cooperation with supervisors, and termination rights. For services supporting critical or important functions, DORA adds quantitative performance targets, notice and reporting obligations, business continuity plans, participation in the customer's threat-led penetration testing, unrestricted rights of access, inspection, and audit — also for the supervisor — and exit strategies with an adequate transition period. Detailed technical standards specify the contractual policy and the conditions for subcontracting critical functions.

“

Under DORA, the vendor contract is part of the bank's supervisory file. Clauses that look like negotiable preferences are often regulatory requirements.

What Due Diligence Looks Like in Practice

• Security evidence: ISO 27001, BSI C5, or SOC 2 reports, penetration test summaries, and vulnerability management.
• Incident notification: fixed hours for notifying the customer — banks have their own tight timelines for major ICT incidents.
• Subcontracting chain: a complete list of subcontractors supporting the service, including hosting, with change notification and objection rights.
• Business continuity: tested recovery objectives and evidence of failover and backup tests.
• Exit support: export formats, transition assistance, and a cost model — reinforced since 2025 by the EU Data Act's cloud-switching rights.
• Financial stability: the customer must assess whether you will still be there in three years.

How SaaS Vendors Prepare

1. 01Build a DORA addendum that already contains the Article 30 clauses — customers accept a vendor's compliant template faster than they draft their own.
2. 02Prepare register-ready information: legal entity identifiers, service descriptions, data locations, and subcontractors in the format banks need for their register.
3. 03Offer audit options that work at scale: pooled audits, certifications, and a defined process for on-site audits, including by supervisors.
4. 04Document an exit plan per product: data export, transition period, assistance, and cost.
5. 05Align incident notification with your security operations — a promise of four hours is worthless without the on-call process behind it.
6. 06Use a self-assessment — such as the DORA vendor check on this website — to identify gaps before the first bank questionnaire arrives.

Conclusion

DORA vendor due diligence rewards preparation. SaaS providers that arrive with a compliant addendum, register-ready data, audit options, and a documented exit plan can shorten bank procurement noticeably — and stand out against competitors who negotiate every clause from scratch. Aegiron Capital Group supports technology vendors in preparing for DORA-driven procurement in the DACH region; legal advice comes from the law firm you engage.