What is DORA?
DORA has applied since January 17, 2025 to banks, insurers, investment firms and other financial entities in the EU. It covers ICT risk management, incident reporting, resilience testing and the management of ICT third-party providers. Financial institutions must put specific terms into contracts with their technology suppliers, so fintech and B2B software vendors selling to them feel DORA directly.
Who needs it
- Fintech and software startups selling to EU banks, insurers or asset managers
- Cloud and data providers serving the financial sector
What usually triggers it
- A bank sends you its DORA contract addendum
- A financial customer runs an ICT third-party risk assessment on you
How the process works
- Understand what your financial customers must ask of you
- Map your controls to their requirements
- Prepare for audits, exit plans and incident reporting duties
- Build on ISO 27001 or SOC 2 evidence where possible
How Holam helps
We work out whether DORA is what your customers actually need, and in what order alongside other frameworks. We then introduce you to a compliance platform and specialists that fit your stage, and stay involved until the result is in your hands. Holam receives a referral fee from providers we introduce when you engage them. You pay the provider directly, we add nothing to their price, and you remain free to choose another provider.
Frequently asked questions
Is DORA only for banks?
The obligations sit with financial entities, but they flow down to ICT providers through contracts and oversight.