Identify the business dependency
Choose a delivery that supports the customer’s operations and identify the teams on either side.
DORA · Operational resilience
DORA review for US service providers
When an EU financial customer reviews a US provider, use a specific file delivery to explain dependencies, incident contacts and recovery arrangements. Confirm the scope with the customer’s resilience team.
Walk through a disruption
Ask what happens if the recipient cannot collect the package by the agreed deadline.
Verify the recovery route
Agree who can authorize another route and how the receiving team confirms it has the current release.
Review a third-party delivery from end to end
Test the handoff using a representative package and a missed deadline. Keep evidence of the response with the service review.
- 01 / Before
Know the dependency.
Choose a scheduled delivery and identify the business activity that stops if the recipient cannot collect it.
- 02 / During
Control the handover.
Set a recipient, deadline and escalation contact before issuing the package.
- 03 / After
Plan for disruption.
Test how the owner will report a missed delivery and retrieve outstanding files during an interruption.
Separate customer and provider decisions
Record who owns the business impact assessment, who restores the service and who verifies receipt.
Discuss with MX
The service layer
- Recipient permissions and administration
- Available transfer and access records
- Data location and service dependencies
- Support, retrieval and exit arrangements
Own within your organization
The resilience program
- ICT risk assessment and governance
- Contract review and supplier oversight
- Incident classification and reporting
- Resilience testing and continuity plans
What happens when the usual route is unavailable?
Take a recurring supplier reporting pack and rehearse a missed handover. The exercise should reveal who makes the next decision, what information they need and how the team avoids creating an uncontrolled workaround.
The delivery window is approaching
Ask the process owner how long the receiving team can wait and who is responsible for escalating a missed deadline.
An alternative is proposed
Check the fallback against the original handling conditions before sending the package through another route.
The service is available again
Reconcile the recovered files with the release record and check whether either team holds a duplicate.
Turn the exercise into a review record.
Keep the outcome close to the business process it describes. A short, maintained record is easier to act on than a supplier questionnaire that nobody revisits. Capture the assumptions, evidence requested and decisions still waiting for an owner.
- Service dependency
- Name the exchange, the business owner and the teams affected by delay. Include any related services needed to complete the handover.
- Escalation route
- Record the internal contact, supplier contact and the circumstances in which the next person takes over.
- Recovery and exit
- Ask how files and relevant records can be retrieved, what support is available and how the process would move to another approved service.
Prepare for the conversation
- One recurring exchange
- A reporting pack, operational file or supplier deliverable, with a sample rather than live sensitive data.
- The people involved
- Include the process owner and someone who can discuss supplier risk, access and support.
- The unresolved decision
- Bring the question that matters most: delivery evidence, an interruption, retrieval or a change of provider.
Bring a real supplier workflow.
Start with one recurring exchange: a reporting pack, an operational file or a supplier deliverable. We can walk through the people, permissions and handoffs with your team.
Discuss your DORA workflowA few important
distinctions.
Does DORA apply directly to every US business?
No. DORA is EU legislation. US suppliers can face requirements through relationships with EU financial entities. Assess your role and contractual arrangements rather than assuming every US business is directly in scope.
Does using MX make an organization DORA compliant?
No. File sharing cannot establish compliance across governance, risk management, testing, incident reporting and third-party oversight. Review the service alongside your wider program.
What should we request during supplier due diligence?
Ask for evidence relevant to your workflow: service scope, data handling, access administration, support arrangements, subcontractor dependencies and exit options. Confirm contractual commitments with the supplier.
Can UK suppliers also be relevant to DORA?
Yes. An EU financial entity can rely on a non-EU provider. That relationship does not remove the financial entity’s responsibility for operational resilience.