The verdict in three sentences
Since 17 January 2025, the DORA regulation makes a payment institution accountable for the resilience of its ICT vendors, including the agency that builds and maintains its app. A standard development contract is no longer enough: you need audit, exit, incident notification and testing clauses. Budget EUR 10,000 to 35,000 excl. VAT to upgrade the contract and the application, a small amount against the risk of regulatory sanctions.
The clauses DORA requires in the development contract
Article 30 of the regulation lists mandatory contractual provisions. For a critical or important function, such as a payment or account-opening app, the list is longer.
| DORA requirement | What the contract must state | Standard function | Critical function |
|---|---|---|---|
| Service description | Scope, location of data and processing | Yes | Yes, detailed |
| Audit right | Access for the fintech, its auditor and the regulator | Yes | Yes, unrestricted |
| Incident notification | Vendor alert lead time to the fintech | Yes | 4 h or less for initial alert |
| Exit strategy | Reversibility, transfer of code and data | Recommended | Mandatory, transition period |
| Resilience testing | Vendor participation in tests | Recommended | Mandatory, annual |
| Subcontracting | Prior information and approval | Yes | Yes, with right to object |
| Service levels | Quantified availability, RTO, RPO | Yes | Yes, with penalties |
The fintech must also keep a register of information covering all ICT vendors, submitted yearly to the authority. The development agency appears in it with its own subcontractors (hosting, email service, monitoring tool).
Cost of contractual and technical compliance
The work has two strands: rewriting contracts and adapting the app so the vendor can meet its commitments (logs, alerts, recovery procedures).
| Item | Content | Duration | Indicative 2026 cost excl. VAT |
|---|---|---|---|
| Contract review and amendment | Article 30 clauses, SLA annexes, exit plan | 2 to 4 weeks | EUR 3,000 to 8,000 (lawyer) |
| Register entry and mapping | Vendors, subcontractors, data, locations | 1 to 2 weeks | EUR 1,500 to 4,000 |
| Alerting and incident detection | Monitoring, thresholds, on-call able to alert within 4 h | 2 to 3 weeks | EUR 3,000 to 8,000 |
| Reversibility documentation | Architecture, deployment procedures, code access | 1 to 3 weeks | EUR 2,000 to 6,000 |
| Annual resilience test | Outage scenario, restore, report | 1 week | EUR 2,500 to 6,000 |
| Application pentest | External penetration test and fixes | 1 to 2 weeks | EUR 4,000 to 9,000 |
A small fintech with a recent app lands around EUR 10,000 to 15,000. An institution with several critical apps and documentation debt reaches EUR 30,000 to 35,000.
Questions to ask your vendor before signing
The vendor must answer in writing, with evidence. Ask: who is on call at night and on weekends, how long it takes to detect and report an incident, where code and backups are hosted, which subcontractors are involved, how a 3 to 6 month exit works. An agency that cannot document a full restore in under 4 h on a critical function is not fit for a DORA-regulated institution.
Mini case study
Camille, compliance director of a 45-employee payment institution in Paris, works with an agency on her money transfer app, classified as a critical function. The 2022 contract has no audit right, no alert deadline and no exit plan.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Plan: contract amendment (EUR 6,000 in legal fees), mapping and register (EUR 2,500), alerting within 4 h (EUR 5,500), reversibility documentation (EUR 4,000), resilience test (EUR 4,000), pentest (EUR 7,000). Total: EUR 29,000 excl. VAT over 10 weeks, then about EUR 9,000 a year for the annual test and pentest. With EUR 6M turnover, a sanction or an order to suspend service would cost far more: one week of downtime alone means roughly EUR 115,000 in lost revenue.
FAQ
Does DORA apply to small fintechs?
Yes, all licensed payment and e-money institutions are in scope, with a lighter regime for the smallest. The relief covers some advanced tests, not the contractual clauses or the register.
Does the 4 h deadline apply to the vendor or the fintech?
The fintech must notify the authority of a major incident within 4 h of classifying it and no later than 24 h after detection. The vendor must therefore alert it well before, in practice within 1 to 2 h.
Do we need to change vendors?
Rarely. In about 80% of observed cases, an amendment and a few weeks of technical adjustments are enough. A change is needed if the vendor refuses audits or cannot document its subcontracting.
What should an exit strategy contain?
A quantified transition period, often 3 to 6 months, handover of source code, data and documentation, and assistance from the outgoing vendor. Set aside EUR 5,000 to 20,000 for a potential transition.
What are the penalties for non-compliance?
National regulators can impose fines and injunctions. ICT providers designated as critical at EU level face periodic penalties of up to 1% of average daily worldwide turnover.
Let's scope your project. Share your current contract and app architecture: we price the DORA technical workstream (alerting, reversibility, testing), with an indicative budget and delivery in 6 to 10 weeks. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
