DORA Compliance for Dubai Software Vendors Selling to EU Banks (2026)

Short answer: DORA (Regulation (EU) 2022/2554) does not apply to you directly if your company sits in Dubai — it applies to the European bank, insurer, payment firm or asset manager that buys your software. But it reaches you through the contract. Any Dubai vendor supplying ICT services to an EU financial entity now has to accept Article 30 clauses, name its own subcontractors, support a four-hour incident notification clock, and appear as a row in a register the bank files with its regulator every year. There is no “we are not in the EU” exemption, only a slower and more painful discovery of the same obligations.

The numbers that make this a Dubai problem

First: in June 2026 the European Supervisory Authorities published the first annual picture of what DORA reporting actually produced. In 2025, EU financial entities reported 3,383 major ICT-related incidents, an average of 0.18 per in-scope entity. Around one third had cross-border impact, and — the number that should matter to every vendor reading this — almost one third originated from third-party failures, meaning ICT providers, other financial entities or infrastructure suppliers. System failures were the single largest driver at roughly 51% of major incidents, external events 27%, and payment-related incidents 18%.

Second: supervisors are not finding the data easy. In the ESAs’ 2024 dry run of the register of information, only 6.5% of nearly 1,000 firms passed all 116 data-quality checks, and 86% of all errors were simply missing mandatory information — overwhelmingly information that has to come from vendors. For the 2026 cycle, national authorities collected registers on a 31 December 2025 reference date and forwarded them to the ESAs by 31 March 2026, with validation now applied to more fields than in 2025. Luxembourg’s CSSF reported that as of 16 March 2026 only 40% of the firms required to submit had done so. A register accepted in 2025 can be rejected in 2026.

Third, the Dubai side of the ledger. DIFC crossed 10,018 active registered companies in H1 2026, up 30% year on year, with AI, FinTech and innovation firms at 1,933, up 39%, and regulated financial services firms at 1,134, up 16% — spanning 327 banks and capital markets firms, 165 insurance and reinsurance entities and 592 wealth and asset managers. Fintech took USD 1.03 billion, or 62%, of all MENA startup funding in Q3 2026. The population of Dubai software companies selling into European financial institutions is growing much faster than the population that has read Article 30.

Most Dubai software vendors get this wrong in one specific way. They treat the DORA clause pack their bank customer sends as legal’s problem, sign it with light edits, and only later discover that the clauses commit engineering to audit access, exit transition periods and a four-hour notification pipeline that nobody has built. The clauses are an engineering specification wearing a legal costume.

Why “we are not in the EU” is not a defence

DORA has applied since 17 January 2025 to more than 20 categories of financial entity. Its reach over providers is functional, not geographic: what matters is whether you supply ICT services to a financial entity operating in the Union, not where your trade licence was issued. A Dubai development shop, a DIFC-based SaaS platform and a Bangalore back office are all treated the same way as a Frankfurt vendor, because the obligation sits on the buyer and travels down the contract.

There is one place where DORA bites a non-EU provider directly. Under Article 31, the ESAs designate critical ICT third-party providers (CTPPs) and supervise them centrally. On 19 November 2025 the first 19 CTPPs were designated: Accenture, Amazon Web Services EMEA, Bloomberg, Capgemini, Colt Technology Services, Deutsche Telekom, Equinix (EMEA), Fidelity National Information Services, Google Cloud EMEA, IBM, InterXion Headquarters, Kyndryl, LSEG Data and Risk, Microsoft Ireland Operations, NTT DATA, Oracle Nederland, Orange, SAP and Tata Consultancy Services. The list is reviewed annually.

If a provider established in a third country is designated critical, Article 31(12) requires it to establish a subsidiary in the Union within 12 months of designation, and financial entities may only continue using it on that basis. Where a designated provider obstructs oversight, the Lead Overseer can impose a periodic penalty payment of up to 1% of its average daily worldwide turnover, charged daily after a 30-day remediation window and sustainable for up to six months, and can ultimately recommend that supervisors require banks to suspend or terminate the arrangement. No realistic Dubai SME will be designated a CTPP — the criteria are systemic reliance and substitutability — but the regime explains why your bank customer’s legal team is suddenly immovable on audit rights.

What your bank customer will put in the contract

Article 30 splits into a baseline that applies to every ICT contract and a heavier set for services supporting a critical or important function. If your product sits in a payment path, a core ledger, a KYC flow, a trading screen or a regulatory reporting pipeline, assume you are in the heavy tier and price accordingly.

Clause	What it means in engineering terms	Tier
Full service description	Named functions, scope boundaries, what is explicitly out of scope	All contracts
Locations of service and data processing	Region list per environment, including DR and support access from the UAE or India	All contracts
Data availability, access and return	Export formats, retention, machine-readable return on exit or insolvency	All contracts
Service levels with quantitative targets	Measurable uptime, latency and restore objectives, not “commercially reasonable efforts”	Critical / important
Unrestricted access, inspection and audit	Rights for the entity, its appointed auditor and the competent authority — on your systems	Critical / important
Incident assistance and notification	You feed the entity fast enough for it to hit its own four-hour clock	Critical / important
Exit strategy and transition period	You keep running the service while the customer migrates away from you	Critical / important
Subcontracting conditions	Disclosure, approval and change notice for your own supply chain	Critical / important

The two clauses that cost Dubai vendors the most money are audit access and exit. Audit access means a European supervisor can, in principle, inspect the environment your UAE team administers — so your access control, logging and segregation have to survive an outsider reading them. Exit means you contractually agree to keep serving a customer who is leaving. If your commercial model assumed lock-in, DORA deletes it. This is the same ground covered by a properly drafted SLA with service credits and by source code escrow, which is why mature vendors fold all three into one annex set instead of negotiating them three times.

The four-hour clock is now your clock

Under Articles 17 to 23, a financial entity that classifies an incident as major must send an initial notification to its competent authority as early as possible and within four hours of classification, and in no case later than 24 hours after becoming aware of the incident. An intermediate report follows within 72 hours, even if nothing has changed, and a final report within one month of the last intermediate report.

Read that as a vendor. If your platform degrades at 02:00 Gulf time and the customer is a Dutch payment institution, their four-hour clock starts when they classify — and they cannot classify without severity, scope, client impact and root-cause direction from you. A support model with a next-business-day first response is contractually incompatible with DORA. What the clause actually requires is a named on-call rotation, a severity matrix agreed in writing with the customer, and an incident record the customer can lift straight into a regulatory template. If you have never run that discipline, start with the incident response and postmortem basics before you sign.

Your subcontractors are now a disclosure

Commission Delegated Regulation (EU) 2025/532, the subcontracting RTS, was published in the Official Journal on 2 July 2025 and entered into force on 22 July 2025. It sets out what a financial entity must assess before its provider subcontracts any ICT service supporting a critical or important function — the length of the chain, the criticality of each link, due diligence on the subcontractor, monitoring rights, and the conditions under which the chain may change.

In practice this means a Dubai vendor has to be able to produce, on demand and accurately: every cloud region and provider it runs on, every SaaS tool inside the processing path (error tracking, analytics, email delivery, AI inference endpoints), every offshore or freelance team with production access, and the legal entity and country for each. Most agencies cannot produce that list in a week, which is exactly why 86% of register errors were missing fields. The vendors that win European financial work in 2027 are the ones that keep this inventory current as a build artefact, not as an annual fire drill.

You are a row in the register of information

Every in-scope financial entity maintains a register of information covering all contractual arrangements for ICT services, filed annually with its competent authority under the implementing standard. Your company appears in it: legal name, country, Legal Entity Identifier, the function you support, its criticality rating, contract dates, data locations, subcontracting chain. Three consequences follow.

One: if you do not have an LEI, get one. Missing identifiers are a top source of rejected registers, and a bank facing a resubmission deadline will escalate hard. Two: your criticality rating is assigned by the customer, not by you, and it determines which clause tier applies — worth asking about before contract drafting rather than after. Three: 46% of financial institutions name the register as the hardest part of DORA compliance, and 17% cite due diligence and risk assessments on ICT providers. A vendor that hands over a clean, pre-formatted data pack removes the single most irritating task on the buyer’s list. That is a sales advantage, not a compliance cost.

What this costs, in AED

Start with the buyer’s budget, because it sets the tone of the negotiation. Deloitte found 96% of institutions had estimated their DORA compliance cost, with most landing between EUR 2 million and EUR 5 million — roughly AED 8.5 million to AED 21.3 million at AED 4.26 to the euro — while a McKinsey estimate put planned spend at EUR 5 million to EUR 15 million, about AED 21 million to AED 64 million. Staffing is heavy too: 39% of entities dedicate five to seven full-time equivalents to DORA work and close to 40% dedicate more than seven. As of March 2026, roughly half of financial institutions considered themselves fully compliant. Your customer is spending real money and is behind schedule. They will not fund your learning curve.

Typical AED ranges we quote UAE software vendors and DIFC-based platforms:

Scope	What it includes	AED
DORA clause response pack	Article 30 gap review against your current MSA, agreed fallback positions, standard answer library for buyer questionnaires	22,000 – 45,000
Register of information data pack	LEI setup guidance, subcontractor and region inventory, criticality mapping, reusable per-customer export	15,000 – 30,000
Four-hour incident pipeline	Severity matrix, on-call rotation, customer notification templates, logging and evidence retention	45,000 – 95,000
Full vendor readiness programme	All of the above plus an audit-ready evidence room, exit and transition plan, escrow and an annual refresh	95,000 – 180,000

Now the cost of inaction, which for a vendor is not a fine. DORA’s penalties for financial entities are set nationally by each member state, so any single “DORA fine” figure quoted at you is unreliable — the only EU-level monetary measure is the CTPP periodic penalty of up to 1% of average daily worldwide turnover described above, and it does not apply to ordinary vendors. Your real exposure is commercial: a bank that cannot complete its register, cannot evidence audit rights or cannot get a four-hour notification out of you has a supervisory problem, and the cheapest fix available to it is replacing you. With almost a third of 2025’s major incidents already attributed to third parties, procurement teams are actively pruning. Being the vendor that makes the register easy is now a renewal strategy.

How Aquarius handles it

We build the software and the evidence in the same project. For UAE clients selling into European financial institutions, that means an Article 30 annex set drafted once and reused across customers, a subcontractor and region inventory generated from the actual deployment rather than from memory, an incident pipeline with a tested severity matrix, and a quarterly refresh so the data pack is never stale when a bank asks. If you also serve DIFC or ADGM-regulated clients, the same controls map onto local expectations — see our guide to fintech app development under DIFC and ADGM regulation. Fixed scope, fixed price, and the artefacts belong to you. Our pricing is published.

FAQ

Does DORA apply to a software company based in Dubai?

Not directly. DORA places obligations on EU financial entities, not on third-country vendors. But those entities must pass specified contractual requirements down to every ICT provider supporting their services, so a Dubai company supplying an EU bank, insurer, payment institution or asset manager will be required to accept Article 30 clauses, disclose subcontractors, support incident notification timelines and provide data for the customer’s register of information. The only direct obligation on a non-EU provider arises if the ESAs designate it a critical ICT third-party provider, which triggers the Article 31(12) requirement to establish an EU subsidiary within 12 months.

What are the DORA incident reporting deadlines?

For a major ICT-related incident: an initial notification within four hours of the incident being classified as major and no later than 24 hours after the entity became aware of it, an intermediate report within 72 hours of that notification, and a final report within one month of the last intermediate report. The four-hour clock starts at classification, not at detection — which is why vendors are asked for severity and impact data almost immediately.

What is the register of information, and why does my vendor data go in it?

It is the standardised inventory of every ICT contractual arrangement that each in-scope financial entity files with its national authority, which forwards it to the European Supervisory Authorities. It records provider identity and LEI, the function supported, criticality, data locations and the subcontracting chain. In the 2024 dry run only 6.5% of nearly 1,000 firms passed all 116 data-quality checks and 86% of errors were missing mandatory data, most of which must come from providers — so banks now ask vendors for it in a specified format.

How much does DORA readiness cost a UAE vendor?

Far less than it costs the bank. EU institutions mostly budget EUR 2 million to EUR 5 million, about AED 8.5 million to AED 21.3 million, for their own programmes. For a UAE software vendor, a clause response pack typically runs AED 22,000 to AED 45,000, a register data pack AED 15,000 to AED 30,000, and a four-hour incident pipeline AED 45,000 to AED 95,000, with a full readiness programme between AED 95,000 and AED 180,000 depending on how many environments and subcontractors are in scope.

Is ISO 27001 enough for DORA?

It is a strong head start and answers a large share of the security questionnaire, but it is not sufficient on its own. ISO 27001 does not deliver the Article 30 contractual rights, the unrestricted audit and inspection access for the customer’s competent authority, the exit and transition obligation, the subcontracting disclosure required under Delegated Regulation (EU) 2025/532, or the four-hour notification capability. Treat the certificate as evidence, not as compliance.

Selling software to a European financial institution from Dubai is a bigger opportunity in 2026 than it was in 2024, precisely because so many vendors cannot answer these questions. If you want the Article 30 pack, the subcontractor inventory and the incident pipeline built once and reused for every deal, talk to Aquarius and we will scope it in a single call.