If a customer that is a financial entity asks us to accept DORA contract terms, then what do we do?

Start

A financial-entity customer wants us to accept DORA terms

DORA puts its contract duties on the financial entity. The customer must put certain terms in writing with its ICT providers and must collect information about them for its register, so it sends you terms. You do not run DORA's readiness assessment. You check the contract against the flow-down list (DR-22).

• Then: Are we a financial entity ourselves?

Decision

Are we a financial entity ourselves?

ICT third-party service providers are not financial entities, and DORA binds financial entities. Judgement: a financial entity can also sell ICT services to another, and then DORA binds it directly and the customer's terms are only one part of its position. If you cannot say what you are, take the first branch and settle it with the scope assessment.

• Yes, or not known: Run the scope assessment first
• No: Does the customer buy ICT services from us?

Outcome

Run the scope assessment first

Complete the scope assessment before negotiating (DR-01). It tells you which duties follow from what you are. Come back to the customer's terms once you know. Where your competent authority tells you something different from the assessment, its view stands.

Decision

Does the customer buy ICT services from us?

ICT services are digital and data services provided through ICT systems to one or more users on an ongoing basis, including hardware as a service, and excluding traditional analogue telephone services. The contract terms in this flow are written for those services. If you are unsure, take the first branch, which is the more cautious one.

• Yes, or not known: Ask the customer which services and functions it means
• No: Treat it as an ordinary contract request

Outcome

Treat it as an ordinary contract request

Judgement: if what you sell is not an ICT service, the DORA contract terms are not what the customer is relying on. Ask which provision it relies on, have Legal read the answer, and negotiate the request as an ordinary commercial term. If the answer shows that it is an ICT service after all, return to the first step.

Step

Ask the customer which services and functions it means

The customer decides whether a function is critical or important and records why (DR-09). Judgement: ask it which of your services support a function it treats that way, and which contracts are in scope. The answer decides whether the longer list of terms (FD-05 to FD-08) applies to you.

• Then: Read the request against FD-01 to FD-04

Step

Read the request against FD-01 to FD-04

These apply to every contract for ICT services. FD-01: a written contract describing the services, whether and how you may subcontract, the locations of service and data, and notice of change. FD-02: data security terms, and return of data on your insolvency or the end of the contract. FD-03: service levels and help in an incident. FD-04: cooperation with the authorities, termination rights and training.

• Then: Does the customer call the service critical or important?

Decision

Does the customer call the service critical or important?

If it does, or has not decided, add the longer list. A customer that uses the pack treats an unassessed function as critical or important until assessed (DR-10), which is its working rule and not a rule of DORA, so expect (judgement) the longer list from such a customer. Take the first branch if you do not know.

• Yes, or not known: Add FD-05 to FD-08 to the check
• No: Prepare the information the customer needs for its register

Step

Add FD-05 to FD-08 to the check

FD-05: full service levels with precise targets, notice and reporting duties, contingency plans and security measures you implement and test, and taking part in the customer's threat-led testing. FD-06: unrestricted access, inspection and audit rights for the customer and its authorities. FD-07: an exit strategy with a transition period. FD-08: subcontracting conditions and notice of material changes.

• Then: Prepare the information the customer needs for its register

Step

Prepare the information the customer needs for its register

FD-09: your legal name, a valid LEI or EUID, your ultimate parent, your headquarters country, and the same identifiers for the subcontractors behind a critical or important service. The register guide says providers take weeks to answer for identifiers, so collect your subcontractors' early. The customer's register needs them.

• Then: Are we on the ESAs' current list of critical providers?

Decision

Are we on the ESAs' current list of critical providers?

The ESAs designate critical ICT third-party service providers and update the list yearly. A designated provider is overseen by a Lead Overseer, and one established in a third country needs a subsidiary in the Union within 12 months (FD-10). Check the published list before you answer. If you are on it, or have not checked, take the second branch.

• Yes, or not checked: Check the list, and if you are on it take advice
• No: checked and not listed: List each term we cannot give as asked, against its FD number

Step

Check the list, and if you are on it take advice

Oversight by a Lead Overseer sits on top of the contract terms and is beyond what this flow covers. Ask Legal to read the designation and the duties that follow. Tell the customer, because it must check each provider against the list.

• Then: List each term we cannot give as asked, against its FD number

Step

List each term we cannot give as asked, against its FD number

The flow-down list has columns for where each term sits in your contracts or records and who owns it. Fill them in your own files. The terms you cannot match become your negotiating list, and, judgement, the filled list is a sound basis for your answer to the customer.

• Then: Can we give every term as the customer wrote it?

Decision

Can we give every term as the customer wrote it?

Compare the customer's wording with what you can perform, not with what is convenient. Judgement: a term you accept and then cannot perform is a breach of the contract and weakens the customer's own position. If you are not sure, take the second branch and test the wording.

• Yes: Sign, and keep the filled flow-down list with the contract
• No, or not sure: Offer equivalent wording, citing the FD item each covers

Step

Offer equivalent wording, citing the FD item each covers

Judgement: the library's advice for buyers is to accept equivalent wording that achieves the same outcome, comparing against what a term achieves rather than word for word. Apply the same test as a supplier. The customer decides what it accepts, because the duty is its own.

• Then: Is any term still one we cannot perform?

Decision

Is any term still one we cannot perform?

Terms for critical or important functions include unrestricted access and audit rights for the customer and its authorities, a transition period and taking part in the customer's testing (FD-05 to FD-07). If you cannot perform one, or do not know, take the first branch.

• Yes, or not known: Take it to leadership and Legal before signing
• No: Sign, and keep the filled flow-down list with the contract

Outcome

Take it to leadership and Legal before signing

Whether to refuse the term, change your service or lose the customer is a business decision for whoever your governance gives it to: the board, the management board or executive management. Judgement: expect the customer to decline a contract for a critical or important function without the terms it must have, and do not sign one you cannot perform.

Outcome

Sign, and keep the filled flow-down list with the contract

Sign once the customer has accepted any equivalent wording. Keep the filled list with the contract so you can show what you agreed and where each term sits. Signing does not make you or the customer compliant with DORA. The customer's duties stay its own and you remain a supplier. Review the list when the customer changes its request, when a contract changes or when the ESAs' list changes.