Building Your DORA ICT Third-Party Risk Register for European Fintechs

The New Regulatory Reality: Beyond Cybersecurity Self-Assessment

For years, European financial technology companies, neo-banks, and Virtual Asset Service Providers (VASPs) operated under a fragmented patchwork of national IT outsourcing guidelines. A startup could host its primary settlement nodes on a single cloud account, route all transaction telemetry through a single RPC gateway provider, and satisfy auditors with a standard SOC 2 certificate and a high-level architecture diagram.

That era is permanently over.

With the entry into application of the Digital Operational Resilience Act (DORA - Regulation EU 2022/2554), the European Union has established an unforgiving, unified supervisory framework across all 27 member states. Jointly enforced by the European Supervisory Authorities—the European Banking Authority (EBA) and the European Securities and Markets Authority (ESMA)—DORA fundamentally shifts regulatory focus from passive disaster recovery policies to active operational resilience.

At the epicenter of this mandate is the DORA Register of Information on ICT Third-Party Providers. Financial entities are legally obligated to maintain an exhaustive, machine-readable inventory of every external software, cloud, and digital infrastructure dependency underpinning their operations.

DORA ICT THIRD-PARTY RISK REGISTER ARCHITECTURE MAPPING

• FINANCIAL ENTITY / VASP CORE BUSINESS SERVICES (Customer Facing Payments, Custodial Clearing, Settlement Engine)
• DORA REGISTER OF INFORMATION (TEMPLATES)
• RT.01.01: Entity Identification & Legal Entity Identifiers (LEI)
• RT.02.01: Mapping ICT Services to Critical Business Functions
• RT.05.01: ICT Subcontracting Supply Chain Dependencies
• CLOUD INFRASTRUCTURE: [WEB3 RPC PROVIDERS] [MPC CUSTODY API]
• AWS Ireland (Critical) Infura / Alchemy Fireblocks Core
• Subcontractor: DNS host Subcontractor: Cloudflare Subcontractor: HSM
• MANDATORY REQUIREMENT: Must demonstrate multi-region redundancy and formal, executable exit strategies without service disruption!

At WebXtek and across our institutional engineering engagements with Luso Digital Assets, we assist regulated fintechs in restructuring their digital asset tech stacks into auditable, DORA-compliant topologies.

The Web3 Dependency Matrix: Why Blockchain FinTechs Are Uniquely Exposed

While traditional banks must inventory mainframe providers and payment network connections, Web3 fintechs face an intricate web of decentralized and hybrid dependencies:

1. Remote Procedure Call (RPC) Gateways: Does your company run its own archival Ethereum nodes, or do your backend transaction broadcast daemons depend on centralized third-party endpoints like Infura or Alchemy? If that RPC gateway experiences an outage, can your customers move their funds? Under DORA, third-party RPCs are categorized as Critical ICT Services Supporting Critical Functions.
2. Key Custody and MPC Solutions: If your platform relies on SaaS-based Multi-Party Computation (MPC) architectures, where are the co-signing keys generated? What occurs if the custody vendor’s authentication API experiences downtime?
3. Decentralized Oracles: Price feed mechanisms that dictate collateral liquidation parameters represent systemic operational risks.
4. Cloud Concentration Risk: Hosting all validator nodes, database clusters, and signing orchestrators within a single AWS Availability Zone violates basic European concentration risk thresholds.

ANATOMY OF A DORA CRITICAL SERVICE ASSESSMENT

• ICT SERVICE IDENTIFIED: Third-Party Hosted Blockchain RPC Gateway
• VENDOR: Commercial Node Infrastructure SaaS Provider
• DORA EVALUATION CRITERIA: 1. Critical Function Impact?
• YES: Failure prevents users from executing withdrawals.
• 2. Substitutability Rating?
• HIGH RISK: Requires pre-configured multi-provider failover.
• 3. Subcontracting Chain Visibility?
• MANDATORY: Must document where vendor hosts underlying nodes.
• 4. Documented Exit Strategy?
• MANDATORY: Must have audited, tested script to switch to self-hosted fallback nodes in < 15 minutes.

Structure of the DORA Register of Information (The ESA Templates)

European authorities require the Register of Information to be formatted according to rigid Technical Standards (ITS) composed of linked tabular data models:

• Entity Tables (RT.01): Legal Entity Identifiers (LEI), corporate headquarters, and internal senior executive ownership for ICT operational risk.
• Contractual Arrangements (RT.02 / RT.03): Detailed contractual mapping specifying governing law, termination notice periods, data processing jurisdictions, and formal audit clauses.
• ICT Subcontractors (RT.05): Full supply-chain visibility into downstream subcontractors supporting critical services (e.g., if your custodian relies on a specific cloud hardware security module provider).
• Alternative Providers and Exit Strategies (RT.06): Concrete, validated plans detailing how the financial entity will migrate the service to an alternate vendor or insource the technology without degrading customer services.

Failure to maintain dynamic, up-to-date documentation across these tables exposes the enterprise to immediate sanction upon regulatory inspection.

Contractual Mandates: What Your Web3 Vendor Agreements Must Contain

Under DORA Chapter IV, financial institutions are legally prohibited from contracting with ICT vendors whose service agreements fail to include specific statutory guarantees. When licensing custody, cloud, or blockchain APIs, your legal counsel must ensure the contracts contain:

• Unrestricted Audit and Access Rights: The contract must guarantee that both your internal compliance officers and the relevant National Competent Authority (such as the Bank of Portugal or AMF) have the legal right to inspect vendor physical data centers and audit system logs.
• Service Level Agreements (SLAs) with Quantified Metrics: Vague promises of “best efforts uptime” are non-compliant. Agreements must define exact recovery time objectives (RTO) and recovery point objectives (RPO).
• Mandatory Incident Reporting Windows: Third-party providers must be contractually bound to inform your security response team of major ICT incidents within strict hourly timeframes.
• Termination and Transition Assistance: Vendors must commit to structured post-termination data migration support to facilitate seamless vendor transitions.

Our technical consulting practice works alongside corporate legal departments to conduct gap analyses on existing vendor contracts and remediate deficiencies.

Step-by-Step Implementation Roadmap for Fintech Executives

To construct and maintain an institutional-grade DORA ICT Register:

1. Perform an Enterprise ICT Dependency Discovery: Inventory all SaaS, cloud, RPC, indexing, and custody vendors across every engineering team.
2. Execute Criticality Triage: Categorize services into critical versus non-critical based on customer business impact, following the criteria set out by the European Banking Authority.
3. Deploy Multi-Provider Redundancy: Eliminate single points of failure. For example, replace single RPC dependencies with load-balanced node meshes deployed across self-hosted and multi-cloud environments via our web3 blockchain architecture services.
4. Populate ESA Standardized Data Templates: Compile the official ITS Excel/XML/XBRL data structures, ensuring all vendor Legal Entity Identifiers (LEIs) are validated.
5. Conduct Annual Vendor Tabletop Exercises: Formally test your documented exit strategies. Simulate the total failure of your primary cloud host or custody API, demonstrating to regulators that your fallback architecture maintains continuous operations.

By transforming regulatory compliance from a burdensome audit exercise into a resilient architectural standard, your fintech builds the institutional credibility required to win enterprise partnerships across the European Union.

In practice, we apply these exact architectural standards across specialized sectors including fintech startups (neobanks and crypto & web3 brokerage platforms. Whether you are modernizing core workflows through web3 & blockchain development and technical consulting before you build, connecting sector-specific requirements to disciplined execution is what turns technical theory into compounding commercial advantage.