Answering a DORA vendor questionnaire as a US SaaS company
For US and UK SaaS and ICT vendors whose EU bank, insurer or fintech clients send DORA due-diligence questionnaires. Why you get one, what the contract has to say, and the evidence that closes each question.
DORA (Regulation (EU) 2022/2554) has applied since January 17, 2025 to EU financial entities, not to their vendors. But Articles 28 to 30 make your client assess you, record your contract in a register of information, plan its exit, and put minimum clauses in your contract. The questionnaire is how it checks. Statements rarely close it: dated evidence does, such as a timed restore test, a real export of one client's data and a subcontractor register.
Why a US company gets a DORA questionnaire
The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied since January 17, 2025. It is addressed to EU financial entities: banks, insurers, investment firms, payment and e-money institutions and others. It is not addressed to you. But Article 28 says a financial entity that uses ICT services stays fully responsible for its own compliance, and gives it a list of things to do about its vendors. That list becomes your questionnaire.
Among other things, your client has to:
- assess you before signing, including information security and concentration risk (Article 28(4) and Article 29);
- keep a register of information on every contract for ICT services, flagging those that support critical or important functions, and report it to its supervisor (Article 28(3));
- have documented exit strategies for services that support critical or important functions, tested and reviewed periodically (Article 28(8));
- put the minimum clauses of Article 30 into your contract.
The detail of the contract policy is in Commission Delegated Regulation (EU) 2024/1773, the subcontracting conditions for critical functions in Delegated Regulation (EU) 2025/532, and the register template in Implementing Regulation (EU) 2024/2956. You don't need to read them cover to cover, but your client's legal team has, and their questions come from there.
The question that changes everything: critical or important?
Article 3 defines a critical or important function as one whose disruption would materially impair the financial entity's performance, the soundness or continuity of its services, or its regulatory compliance. If your service supports such a function, say a lending platform, a payments engine or a tool advisors use with clients, the stricter clauses of Article 30(3) apply on top of Article 30(2).
Your client makes that call, not you. Ask for it in writing at the start: it decides how much evidence you will be asked for.
What Article 30 puts in your contract
Every ICT contract (Article 30(2))
- a clear, complete description of the services, and whether subcontracting is allowed and on what terms;
- the countries or regions where services are provided and data is processed and stored, with notice before any change;
- provisions on the availability, authenticity, integrity and confidentiality of data;
- access, recovery and return of data in an easily accessible format, including on insolvency, wind-down or termination;
- service level descriptions;
- assistance during ICT incidents, at no extra cost or at a cost set in advance;
- full cooperation with the client's supervisors;
- termination rights and minimum notice periods;
- conditions for your participation in the client's security awareness and training programs.
On top, for critical or important functions (Article 30(3))
- precise quantitative and qualitative performance targets;
- notice periods and a duty to report anything that could affect your ability to deliver;
- a duty to implement and test business contingency plans and keep appropriate security measures;
- participation in the client's threat-led penetration testing where it applies;
- unrestricted rights of access, inspection and audit for the client, a third party it appoints, and its supervisor;
- exit strategies, including a mandatory, adequate transition period.
The usual questions, and the evidence that closes each one
Wording varies by institution, but most questionnaires follow Articles 28 and 30. What closes a question is rarely a statement. It is a dated document.
| Question | Evidence expected | How to produce it |
|---|---|---|
| Where is our data hosted and processed, including at subcontractors? | Countries and regions per service and per subcontractor | Inventory of cloud accounts, regions and managed services actually in use, cross-checked with contracts |
| Which subcontractors are involved in the service? | Dated register: name, role, country, data concerned | Built from billing, infrastructure code and SaaS dependencies |
| When did you last test your continuity plan, and with what result? | Dated test report with measured recovery time and data loss | Full restore into an isolated environment, timed end to end |
| What are your RTO and RPO? | Values measured in the last test, not only contractual targets | Same measurements as the restore test, compared with the contract |
| Can you return all our data at the end of the contract? | Export procedure, formats, timing, and a record of a real export | Full export of one client's data set, checked for completeness |
| Do you have an exit plan and a transition period? | Written exit plan, duration and content of assistance | Written from the export exercise, with durations from the tests |
| How and how fast will you tell us about an incident? | Incident procedure with timings, contacts and cost of assistance | Aligned with the client's own reporting deadlines, and rehearsed |
| Would you accept an audit or on-site inspection? | Audit clause and practical terms | Written audit procedure, plus existing reports shared up front |
Points that trip up US vendors
Data location answers have to include the US
If your support team, your logging provider or your analytics run in the US, say so, per service. A vague "data is hosted in the EU" answer falls apart as soon as your client looks at your subprocessor list. Answer by service and by subcontractor, with regions.
Your SOC 2 report helps, but it is not a DORA answer
A SOC 2 report or ISO/IEC 27001 certificate is useful supporting evidence, and you should attach it. It usually won't tell your client when you last restored everything from backup, how long it took, or whether you have ever exported a client's full data set. Those are the gaps a timed test fills.
Incident timing is measured in hours
Your client has its own incident reporting deadlines under DORA, and they are short. Ask the client how quickly it needs to hear from you, and write that number into your procedure instead of a generic "without undue delay".
"Unrestricted" audit rights
For critical or important functions, Article 30(3) requires unrestricted rights of access, inspection and audit. Pushing back on the right itself rarely works. Negotiate the practical terms instead: notice, scope, who attends, and which existing reports can be used first.
Identifiers
The register template identifies ICT providers by a code, such as an LEI (Legal Entity Identifier). If you don't have one, expect to be asked for it or for an alternative identifier.
Are you a "critical ICT third-party provider"?
Almost certainly not. On November 18, 2025, the European Supervisory Authorities published their first list of 19 critical ICT third-party providers, who are overseen directly. The list is mostly large cloud, data center, network and financial-technology providers. Your hyperscaler may be on it; a typical B2B SaaS vendor is not. You will still get the questionnaire.
Need the evidence, not just the answers? The DORA evidence pack runs a timed full restore, a full export of one client's data, and builds your subcontractor register and a dated evidence file. $3,200, or $5,400 with an exit exercise and written questionnaire answers.
Reprisa builds processes, tooling and evidence. It is not a law firm or an auditor, and this guide is not legal advice.
Frequently asked questions
Does DORA apply directly to US SaaS companies?
No, unless the company is designated as a critical ICT third-party provider. DORA applies to EU financial entities, which must pass requirements to their ICT vendors through contracts (Article 30) and due diligence (Article 28).
Is a SOC 2 report enough to answer a DORA questionnaire?
It helps as supporting evidence, but it usually doesn't show the date and measured result of a full restore test or a real data export, which DORA-driven questionnaires tend to ask for.
Who decides whether our service supports a critical or important function?
Your client, the financial entity. Ask for its classification early, because it decides whether the stricter clauses of Article 30(3) apply.
What is the register of information?
A register each financial entity keeps on all its ICT service contracts (Article 28(3)), using the template in Implementing Regulation (EU) 2024/2956, and reports to its supervisor. Some of its fields need data from you, such as your identifier, services, countries and subcontractors.
Sources
- Regulation (EU) 2022/2554 (DORA), Articles 3, 28, 29 and 30 — EUR-Lex.
- Commission Delegated Regulation (EU) 2024/1773, policy on contractual arrangements — EUR-Lex.
- Commission Implementing Regulation (EU) 2024/2956, register of information templates — EUR-Lex.
- Commission Delegated Regulation (EU) 2025/532, subcontracting of critical or important functions — EUR-Lex.
- ESMA: European Supervisory Authorities designate critical ICT third-party providers — November 18, 2025.
- Morgan Lewis: DORA, EU regulators announce list of critical ICT third-party providers — 19 providers designated.
Checked November 3, 2026. Only the text published in the Official Journal of the European Union is authentic.