DORA: legal and compliance workstreams – and the Swiss FINMA perspective

Short answer: DORA (Regulation (EU) 2022/2554), which has applied to financial entities in the EU since 17 January 2025, creates four recurring workstreams for legal and compliance: maintaining and submitting the register of information on all contracts with ICT third-party service providers every year (Art. 28(3)), bringing ICT contracts up to the minimum content required by Article 30, running the three-stage reporting process for major ICT-related incidents (Art. 19) and documenting governance. Swiss banks are not subject to DORA but to FINMA Circular 2023/1, whose transitional periods ended on 1 January 2026.

This guide is for heads of legal, heads of compliance and DORA programme leads at banks, insurers, asset managers and payment institutions in Germany and Switzerland. It explains the legal work behind the DORA register of information, the contractual requirements and incident reporting, and the capacity these tasks require.

DORA in five areas

BaFin, the German financial supervisor, groups DORA into five areas. Legal and compliance are involved in each of them, most heavily in third-party risk and the register of information.

• ICT risk management and ICT third-party risk management: framework, policies, contracts. Ultimate responsibility for ICT risk lies with the management body (Art. 5(2)(a) DORA).
• Oversight of critical ICT third-party providers: on 18 November 2025 the European Supervisory Authorities (ESAs) designated 19 critical ICT third-party providers, which are under direct EU oversight (Art. 31).
• Information sharing, crisis exercises and testing: testing programmes and, for mature institutions, threat-led penetration testing (TLPT) in which providers are expected to take part.
• ICT-related incidents: classification and reporting of major incidents.
• Register of information and notification duties: a complete overview of all ICT third-party contracts.

DORA register of information: content, reference date and submission

The DORA register of information records every contractual arrangement a financial entity has with ICT third-party service providers and is submitted to the competent authority (Art. 28(3) DORA). In Germany, that is BaFin.

Previous submissions to BaFin

• 2025: reference date 31 March 2025, submission by 28 April 2025 (originally 11 April 2025).
• 2026: reference date 31 December 2025. Test submissions from 4 February 2026, formal submission via the MVP portal from 9 to 30 March 2026, corrections until 24 April 2026. Formats: Excel/xlsm or xBRL-CSV.
• 2027 onwards: the register reflects the position as at 31 December of the previous year and must be submitted without errors by 31 March at the latest. BaFin announces on its website at the start of each year when it begins accepting registers. No taxonomy changes are planned for the 2027 cycle.

The legal work lies mainly in extracting data from contracts: which service is provided, where data is processed, which termination, access and audit rights exist, and which function the contract supports. Many legacy contracts lack this information or scatter it across documents. That turns the first population of the register into a classic contract review project, much like clearing a contract review backlog.

Contractual requirements for ICT third-party providers under Article 30

Under Article 30(2) DORA, contracts for ICT services must contain minimum provisions, including a full service description with the conditions for subcontracting, the locations where services are provided and data is processed, rules on data protection and on access to data on insolvency or termination, assistance with ICT incidents, cooperation with the authorities, and termination rights with minimum notice periods. For services supporting critical or important functions, Article 30(3) adds, among other things, precise performance targets, contingency plans, participation in TLPT, unrestricted access, inspection and audit rights, and exit strategies with a transition period.

How a contract remediation typically runs

1. Reconcile the inventory: match the contract portfolio against the register of information and the procurement database.
2. Classify functions: flag which contracts support critical or important functions.
3. Gap analysis: check each contract against an Article 30 checklist and log gaps clause by clause.
4. Negotiation playbook: set model clauses, fallback positions and escalation routes.
5. Negotiate addenda: prioritised by criticality, starting with large providers that offer their own DORA addenda.
6. Update the register: feed results back into the register of information and document the status.

Incident reporting: deadlines and the role of legal

Major ICT-related incidents are reported to BaFin in three stages via the MVP portal: an initial notification within 4 hours of classification and no later than 24 hours after becoming aware; an intermediate report within 72 hours of the initial notification; and a final report no later than one month after the last intermediate report (Art. 19 DORA; Art. 5(1) Delegated Regulation (EU) 2025/301).

Legal and compliance take on three tasks here. They define the classification criteria in the reporting process, check parallel obligations and align communications. If an incident involves personal data, the 72-hour deadline for notifying the data protection authority also runs (Art. 33 GDPR). In Switzerland, the controller notifies the Federal Data Protection and Information Commissioner (FDPIC) "as soon as possible" where a high risk is likely (Art. 24 FADP).

Switzerland: FINMA Circular 2023/1 and reporting duties

Instead of DORA, Swiss banks are subject to FINMA Circular 2023/1 "Operational risks and resilience – banks". It has been in force since 1 January 2024, replaces Circular 2008/21 and, since its transitional periods ended on 1 January 2026, must be fully implemented. Our guide to FINMA Circular 2023/1 covers the details.

• Cyber reports to FINMA: under FINMA Guidance 05/2020, material cyber attacks on critical functions must be reported (Art. 29(2) FINMASA): an initial report within 24 hours and a full report within 72 hours. Guidance 03/2024 clarifies the reporting duty and governs scenario-based cyber exercises.
• Focus on third parties: according to FINMA's Risk Monitor 2025, almost half of the reported cyber incidents involved third parties. FINMA calls for more robust controls over critical outsourcing.
• Groups with EU entities: EU entities of a Swiss group that qualify as financial entities under Art. 2 DORA apply DORA themselves. They keep the register of information at entity level and at sub-consolidated and consolidated level (Art. 28(3) DORA); the Swiss entities remain subject to FINMA requirements. How registers, contracts and responsibilities are aligned across the group has to be decided case by case.

Workstreams and capacity

A DORA programme ties up legal and compliance mainly at peaks: when populating the register before the submission window and during contract remediation. The table maps the workstreams to roles and deadlines.

Alpinum Solutions provides contract lawyers, compliance officers and regulatory counsel for such programmes through staff leasing or freelancing, part-time or full-time, individually or as a team. Under staff leasing, the institution directs the work; under freelancing, the professional works independently within the mandate. Selected profiles are usually available within 48 hours; the company and Alpinum agree the start date together. Our guide to building a legal and compliance taskforce shows how to set up such a team.

Limits and risks

Responsibility for ICT risk and timely reporting stays with the financial entity and its management body. Interim professionals prepare, review and negotiate on the institution's behalf. Interpretation questions, such as whether a service supports a critical or important function, are decided by the institution, with external counsel where needed. Alpinum is not a law firm. Access rights and confidentiality should be settled before the start.

Frequently asked questions about DORA

Does DORA apply to Swiss banks?

Not directly. DORA applies to financial entities in the EU. Swiss banks are subject to FINMA Circular 2023/1 on operational resilience, which has been fully applicable since 1 January 2026. Where a Swiss group has financial entities in the EU, DORA applies to those entities. Swiss ICT providers serving EU institutions feel DORA through their clients' contractual requirements.

When must the register of information be submitted?

The register is submitted to the competent authority every year. In Germany, the 2026 submission, with a reference date of 31 December 2025, ran from 9 to 30 March 2026 via the MVP portal, with corrections possible until 24 April 2026. As a rule, the reference date is 31 December of the previous year and the deadline is 31 March; BaFin announces the start of the submission window at the beginning of each year.

What is a critical ICT third-party provider?

Critical ICT third-party providers are providers that the European Supervisory Authorities designate under Article 31 DORA and oversee directly. On 18 November 2025, 19 such providers were designated. This does not change the individual institution's own duties: contracts, the register and exit strategies remain its responsibility.

How does DORA incident reporting relate to data breach notification?

Both duties apply side by side. A major ICT-related incident is reported to BaFin under Article 19 DORA. If personal data is affected, the data protection authority must also be notified within 72 hours (Art. 33 GDPR). A single reporting process with clear responsibilities prevents either deadline from being missed.

Can interim professionals handle contract remediation?

Yes. Gap analysis, drafting addenda and negotiating with providers are typical tasks for contract lawyers and senior legal counsel who join the team temporarily. The institution sets priorities, model clauses and approval routes. Responsibility stays with the institution while throughput increases.

Next step

Tell us the contract volume, deadlines and languages of your DORA programme. We will show you suitable profiles or a team set-up.

• Regulatory compliance and regulatory change
• Implementing FINMA Circular 2023/1
• Regulatory calendar for legal and compliance
• Discuss your requirements

Last updated: 30 October 2026.