--- title: "DORA names its critical suppliers: Europe’s financial sector runs on five clouds" description: "The first official DORA list of critical ICT providers — AWS, Google, Microsoft, Oracle, SAP — and the start of supervision in 2026: the concentration lesson." url: https://csidia.com/en/notes/dora-fornitori-ict-critici-concentrazione/ lang: en date: 2026-07-20 label: "Regulation" publisher: CSIDIA S.r.l. (https://csidia.com/) italiano: https://csidia.com/note-operative/dora-fornitori-ict-critici-concentrazione/ --- # DORA names its critical suppliers: Europe’s financial sector runs on five clouds On 18 November 2025 the European Supervisory Authorities (EBA, EIOPA, ESMA) published a list bound to spark debate: the **first critical ICT providers** designated under the DORA regulation. Nineteen names, and among the first — predictably — **AWS, Google Cloud, Microsoft, Oracle, SAP, Deutsche Telekom**. In plain terms: the European Union has put it in writing that the operational resilience of its own financial sector rests, to a significant degree, on a handful of providers, almost all of them non-European. Direct supervision of these entities begins in 2026. It is a banking-sector story, but the lesson — about **concentration risk** — applies to every company that has moved critical pieces of its operations onto a small number of suppliers. ## What DORA is, in brief The **Digital Operational Resilience Act** (Regulation (EU) 2022/2554) has been in force since January 2023 and applicable since **17 January 2025**. It imposes five families of obligations on banks, insurers and other financial entities: ICT risk management, incident reporting, resilience testing (up to threat-led penetration testing), **oversight of third-party providers** and intelligence sharing. The novelty of 2025-2026 is that DORA reaches **providers directly**: cloud providers, data centres, software vendors and system integrators serving the financial sector fall within its scope — and for those deemed “critical”, direct supervision by the authorities kicks in, with penalties of up to **1% of average daily worldwide turnover** for a maximum of six months. ## The point that matters for everyone: concentration is a risk, not a detail DORA formalises an uncomfortable insight: when an entire sector depends on the same three or four providers, the failure (or the decision) of just one becomes a systemic risk. The list of critical providers is, in effect, a map of that dependency. This is not only a banking problem: it is the same pattern that [the United Kingdom called an “unacceptable point of weakness” regarding a single supplier](https://csidia.com/en/notes/palantir-regno-unito-punto-di-debolezza), and it is the reason why [sovereignty is measured by the exit clause, not the slogan](https://csidia.com/en/notes/ai-sovrana-cosa-significa-per-aziende). Every company should ask itself the question DORA imposes on banks: **if my critical supplier stops tomorrow, what stops with it — and for how long?** ## The chain runs lower than you think There is an effect that is easy to miss: DORA does not only touch the large players. Financial entities must govern their own ICT supply chain, and this cascades **downstream** — onto their suppliers, and onto their suppliers’ suppliers. If you serve a bank, an insurer or one of their system integrators, it is likely that forthcoming tender specifications will include requirements derived from DORA: demonstrable operational continuity, incident management with defined timeframes, audit rights, exit plans. Whoever turns up with these documents already in place wins the contract; whoever discovers them during negotiation loses it. It is the same preparatory work [that NIS2 and the CRA already require](https://csidia.com/en/notes/nis2-aziende-settori-critici): inventory, visibility, a response process — done once, valid for all. ## What to do now (even outside the financial sector) 1. **Map your critical suppliers**, not just your contracts: which services, if they stop, stop you? Cloud, connectivity, core management systems. 2. **Measure your concentration**: how many vital processes depend on the same supplier? A single name appearing on too many lines is your systemic risk. 3. **Demand exit and continuity plans** in your contracts: not “if it happens”, but “how do we get out, in how much time, with which data”. 4. **If you serve the financial sector**, align now with the downstream DORA requirements: continuity, incident response, audit, reversibility. These will become the baseline for staying in the running. Resilience does not mean bringing everything in-house: it means **knowing who you depend on and having a plan B that works**. DORA imposes this on banks; common sense suggests it to everyone — and it is the first step of [every operational trial we build](https://csidia.com/en/approach): data and processes under your control, suppliers replaceable by design. *Want to measure your concentration on critical suppliers — and what a plan B would cost? [Half an hour with one of our experts](https://csidia.com/en/contact) for the first map.* ## Sources - [Regulation (EU) 2022/2554 (DORA) — official text (EUR-Lex)](https://eur-lex.europa.eu/eli/reg/2022/2554/oj) - [ESAs — designation of critical ICT third-party providers under DORA (18 November 2025)](https://www.eba.europa.eu/publications-and-media/press-releases) - [Banca d’Italia — DORA and digital operational resilience](https://www.bancaditalia.it/compiti/vigilanza/normativa/dora/) Note by CSIDIA S.r.l. (Vignola, MO, Italy): https://csidia.com/en/notes/dora-fornitori-ict-critici-concentrazione/ · Who we are and what we do: https://csidia.com/en/at-a-glance/ · engagement@csidia.com