DORA: Digital Operational Resilience for the Financial Sector

The Digital Operational Resilience Act (DORA) has applied in the Netherlands since January 2025, setting requirements for how financial institutions manage ICT risk, including continuity and provider dependency. A software license doesn’t cover the full scope of these requirements, even though it can look like it does.

Direct effect, no exceptions

DORA is Regulation (EU) 2022/2554, in force since January 2023 and applying since January 17, 2025. As a regulation rather than a directive, it took direct effect: there’s no Dutch implementing act, no national version, and no national guidance to fall back on.

Five pillars, one premise

DORA covers ICT risk management, response and recovery, incident reporting, resilience testing, and ICT third-party risk. All five assume disruption will happen. Article 11 requires a documented business continuity policy; Article 28(8) requires an exit strategy for any provider supporting a critical function. Neither works if execution depends on the very provider that failed.

Scope is about function, not size

A small pension fund or fintech falls in scope on the same terms as a large bank. Critical ICT third-party providers are supervised directly to, not just a vendor risk for their clients.

Where a license falls short

A license grants the right to use software, not the source code, build environment, or documentation needed to maintain it independently. If the licensor goes under, the right to use survives, the ability to maintain it doesn’t. That gap shows up across all five pillars: no visibility into dependencies, no independent recovery path, no way to establish root cause, nothing to test, and no real exit route.

Escrow makes it demonstrable

Three things turn an escrow arrangement into evidence: verification (confirming the deposit is complete, current, and buildable), precisely defined trigger events, and a neutral third party holding the materials. Supervisors don’t ask whether an agreement exists, they ask what it would deliver if relied on.

DORA requires continuity that works independently of the failed provider, and that continuity has to be verifiable, not just agreed on paper.

Want to know more? Our Legal Counsel Dorian will tell you all about it in our new series: Legal Insights.

Watch it here: https://www.escrow4all.com/en/knowledge/digital-operational-resilience-for-the-finance-sector/