DORA looks beyond the bank

A technology supplier can become important to the financial system without accepting a deposit or making a loan. If many institutions depend on its services, a problem at that supplier may reach across businesses that otherwise compete with one another. Europe’s Digital Operational Resilience Act, or DORA, brings that shared dependence into the supervisory picture.

The European supervisory authorities published their first list of designated critical technology providers on November 18th 2025. The assessment drew on financial firms’ registers of technology contracts and considered the providers’ systemic importance, the functions they supported and how readily their services could be replaced. Designation indicates systemic importance; it is not an allegation of misconduct.

That November 2025 list names 19 entities. It includes Amazon Web Services’ EMEA entity, Google Cloud EMEA and Microsoft Ireland Operations, but also Bloomberg, LSEG Data and Risk, telecommunications businesses and technology-service groups. The infrastructure supporting finance includes data, connections, applications and operational services, as well as the computing capacity usually associated with the cloud.

What a bank’s contract leaves out

DORA began applying on January 17th 2025. Its wider framework covers technology-risk management, incident reporting, testing, third-party arrangements and information sharing. Oversight of designated suppliers is one component of that system, rather than a substitute for the obligations of banks, insurers and other financial entities.

A bank assessing a supplier starts with its own contract, services and customers. A sector-wide overseer can also consider the consequence of many institutions relying on the same service. Each relationship might appear manageable separately while the combined exposure warrants closer examination.

EIOPA’s description of the regime says a lead overseer is supported by a joint examination team. The oversight process includes risk assessment, planning, examinations, recommendations and follow-up. It explicitly preserves financial entities’ own responsibility to manage technology risk and the role of their existing supervisors. Designation adds scrutiny; it does not transfer a bank’s operational accountability to an outside authority.

That leaves a practical challenge for financial firms. Knowing that an important supplier is supervised does not establish which of the bank’s services depends on it, what happens if access is disrupted or whether another provider could take over quickly. Those answers depend on the bank’s own systems and contracts. They are also what turns a broad warning about supplier concentration into a practical continuity plan.

A shared supplier, separate jurisdictions

The geographic reach of suppliers also demands cooperation. On January 14th 2026, British and European regulators announced an agreement to coordinate oversight and share information about critical third parties. The Financial Conduct Authority described a framework covering routine oversight and incidents, with the aim of reducing duplication as well as strengthening resilience. The agreement links the British regime with DORA; it does not merge them into one jurisdiction.

A service delivered through common technology can affect customers on both sides of a border, while the relevant supervisors retain separate legal responsibilities. Information-sharing arrangements can help them understand the same problem without demanding incompatible accounts of it. The memorandum supplies a process for cooperation. Its practical value will depend on how promptly information reaches the authorities that need it during an incident.

Nor do the published designations provide a performance scorecard. They establish whom the authorities selected and how the framework operates. They do not demonstrate how much disruption has been prevented, whether every recommendation has been completed or which supplier is safest. Converting oversight into a marketing badge would confuse importance with quality.

The useful connection is between sector-wide oversight and the bank’s own preparation. Supervisors can examine a supplier on which many firms depend; each firm must still work out how a disruption would affect the service it promises customers. Effective follow-through requires those two views to inform one another. A better picture of shared exposure is valuable only if it improves the decisions institutions make about their own dependence.