Why African Financial Institutions Should Be Exploring DORA

Technology contracts have traditionally been viewed as commercial documents. They set out the services to be provided, allocate risk between the parties and establish the commercial framework for the relationship. Increasingly, however, that view is becoming outdated. As organisations become more reliant on cloud computing, SaaS platforms, managed service providers and AI technologies, technology contracts are evolving into one of the most important operational resilience tools available to a business.

This shift is perhaps best illustrated by the European Union's Digital Operational Resilience Act (“DORA”). When DORA became fully applicable in January 2025, many organisations outside Europe dismissed it as another piece of European regulation with little relevance beyond the EU. For African financial institutions, however, it would be a missed opportunity not to leverage the thinking, methodologies and precepts emanating from DORA. While DORA applies directly to EU financial entities, it signals a broader shift in how regulators, financial institutions and technology providers are approaching operational resilience. More importantly, it reflects where the global market is heading.

South Africa is by no means behind the curve. Through the Joint Standards on cyber security and cyber resilience (“the Joint Standards”) issued by the Prudential Authority and the Financial Sector Conduct Authority, financial institutions are already required to establish robust governance frameworks, implement cybersecurity controls, manage outsourcing risk, maintain business continuity capabilities and develop effective incident response processes. These requirements provide a strong regulatory foundation and, in many respects, align with international best practice. This is further enhanced by the Directives on Material Outsourcing as well as Cloud Computing and Offshoring of Data.

Where DORA distinguishes itself, however, is in recognising that operational resilience cannot be achieved through governance frameworks and internal policies alone. An organisation's resilience is often determined by the contractual obligations imposed on the third parties responsible for delivering critical technology services. If a cloud provider experiences a cyber incident, if a SaaS vendor suffers prolonged downtime or if a managed service provider fails to recover its systems within acceptable timeframes, the customer's ability to respond will often depend less on its internal policies than on the contractual rights it negotiated before the incident occurred.

Rather than simply requiring financial institutions to manage third-party risk, DORA places significant emphasis on the contractual mechanisms that support operational resilience. It contemplates detailed obligations relating to cybersecurity, operational resilience, incident notification, business continuity, disaster recovery, audit rights, subcontracting, regulatory cooperation, exit planning and transition assistance. In doing so, it reframes technology agreements as instruments that actively support resilience rather than documents that merely record commercial terms.

That distinction is becoming increasingly relevant for South African organisations. Technology supply chains are no longer confined to a single jurisdiction. Financial institutions routinely engage global cloud providers, software vendors, payment platforms, cybersecurity providers and AI service providers, many of whom already support customers subject to DORA. As these suppliers adapt their contracting practices to meet European requirements, many are beginning to incorporate DORA-inspired provisions into their global contractual frameworks. Consequently, even where DORA has no direct legal application, its influence is likely to be felt through the contractual standards adopted by multinational technology providers.

For African financial institutions, this presents an opportunity rather than an additional compliance burden. Instead of viewing cybersecurity, outsourcing governance and technology contracting as separate disciplines, organisations should be considering how these functions can work together to strengthen operational resilience. A well-drafted technology agreement should do far more than describe the services being provided. It should clearly allocate responsibility during a cyber incident, establish measurable resilience obligations, define governance structures, regulate subcontracting, provide meaningful audit rights and ensure that, if the relationship comes to an end, the organisation can transition its critical services without unnecessary disruption.

 The commercial benefits of this approach extend well beyond regulatory compliance. Clear contractual obligations reduce uncertainty before an incident occurs, improve accountability when one does, minimise disputes between customers and suppliers, and provide organisations with practical mechanisms to recover more quickly from operational disruptions. In an environment where technology underpins almost every critical business function, these contractual protections have become just as important as the technical controls supporting them.

Operational resilience is no longer measured solely by an organisation's internal capabilities. Increasingly, it is measured by the resilience of its technology ecosystem and by the contractual framework governing the suppliers that form part of that ecosystem. That is perhaps DORA's most significant contribution. Its real value lies not in its application as European legislation, but in its recognition that operational resilience begins long before a cyber incident occurs. It begins during procurement, is embedded during contract negotiations and is tested when those contractual commitments are called upon in practice.

As regulators around the world continue to strengthen expectations around cybersecurity, outsourcing and technology risk management, it would not be surprising to see greater focus placed on the contractual mechanisms that underpin those obligations. South Africa has already taken significant steps through its existing regulatory framework. The logical next step is ensuring that technology contracts evolve alongside those regulatory expectations.

Financial institutions that begin modernising their ICT agreements now will not only be better prepared for future regulatory developments but will also be better positioned to manage one of the most significant operational risks they face today: the resilience of their technology supply chain.

We work closely with financial institutions to review, negotiate and update technology agreements that meet African regulatory requirements while incorporating international best practice where appropriate. As operational resilience continues to evolve, organisations should view technology contracts not simply as legal documents, but as strategic tools that support governance, resilience and long-term business continuity.