Name the dependent service
Link a scheduled delivery to the financial entity’s process and the supplier responsible for it.
DORA · Operational resilience
File exchange in a DORA resilience review
For a UK supplier working with an EU financial entity, start with one delivery the customer depends on. Identify what happens to that business process if the file cannot arrive on time.
Test a missed delivery
Use a fictional interruption to identify who notices the missed file and who informs the customer.
Agree how to recover
Record the authorised fallback route and who reconciles the files after service resumes.
Trace a critical file delivery
Follow one package from issue to receipt. Record the dependency, escalation contact and evidence needed to confirm recovery.
- 01 / Before
Know the dependency.
Choose a scheduled delivery and identify the business activity that stops if the recipient cannot collect it.
- 02 / During
Control the handover.
Set a recipient, deadline and escalation contact before issuing the package.
- 03 / After
Plan for disruption.
Test how the owner will report a missed delivery and retrieve outstanding files during an interruption.
Assign responsibility before an incident
Have the financial entity, ICT provider and receiving team each confirm their decisions and handover points.
Discuss with MX
The service layer
- Recipient permissions and administration
- Available transfer and access records
- Data location and service dependencies
- Support, retrieval and exit arrangements
Own within your organisation
The resilience programme
- ICT risk assessment and governance
- Contract review and supplier oversight
- Incident classification and reporting
- Resilience testing and continuity plans
What happens when the usual route is unavailable?
Take a recurring supplier reporting pack and rehearse a missed handover. The exercise should reveal who makes the next decision, what information they need and how the team avoids creating an uncontrolled workaround.
The delivery window is approaching
Ask the process owner how long the receiving team can wait and who is responsible for escalating a missed deadline.
An alternative is proposed
Check the fallback against the original handling conditions before sending the package through another route.
The service is available again
Reconcile the recovered files with the release record and check whether either team holds a duplicate.
Turn the exercise into a review record.
Keep the outcome close to the business process it describes. A short, maintained record is easier to act on than a supplier questionnaire that nobody revisits. Capture the assumptions, evidence requested and decisions still waiting for an owner.
- Service dependency
- Name the exchange, the business owner and the teams affected by delay. Include any related services needed to complete the handover.
- Escalation route
- Record the internal contact, supplier contact and the circumstances in which the next person takes over.
- Recovery and exit
- Ask how files and relevant records can be retrieved, what support is available and how the process would move to another approved service.
Prepare for the conversation
- One recurring exchange
- A reporting pack, operational file or supplier deliverable, with a sample rather than live sensitive data.
- The people involved
- Include the process owner and someone who can discuss supplier risk, access and support.
- The unresolved decision
- Bring the question that matters most: delivery evidence, an interruption, retrieval or a change of provider.
Bring a real supplier workflow.
Start with one recurring exchange: a reporting pack, an operational file or a supplier deliverable. We can walk through the people, permissions and handoffs with your team.
Discuss your DORA workflowA few important
distinctions.
Does DORA apply directly to every UK business?
No. DORA is EU legislation. UK suppliers can face requirements through relationships with EU financial entities. Assess your role and contractual arrangements rather than assuming every UK business is directly in scope.
Does using MX make an organisation DORA compliant?
No. File sharing cannot establish compliance across governance, risk management, testing, incident reporting and third-party oversight. Review the service alongside your wider programme.
What should we request during supplier due diligence?
Ask for evidence relevant to your workflow: service scope, data handling, access administration, support arrangements, subcontractor dependencies and exit options. Confirm contractual commitments with the supplier.
Can US suppliers also be relevant to DORA?
Yes. An EU financial entity can rely on a non-EU provider. That relationship does not remove the financial entity’s responsibility for operational resilience.