What DORA asks for
DORA, Regulation (EU) 2022/2554, has applied since 17 January 2025. It covers banks, payment institutions, insurers, pension funds and most other financial entities.
Article 28(8) is short. For ICT services that support critical or important functions, you must have an exit strategy. You must be able to leave the provider without disrupting the business, without weakening compliance with regulatory requirements and without harming your customers. The exit plan must be comprehensive and documented. It must be sufficiently tested and reviewed regularly. And you must have identified the alternatives and drawn up a transition plan, so services and data can move to another provider or back in-house.
Article 30 puts the same into the contract. The agreement for critical or important services must include a mandatory, adequate transition period, during which the provider keeps delivering while you move.
On 18 November 2025 the European supervisory authorities designated 19 critical ICT providers to the financial sector. AWS, Google Cloud and Microsoft are on the list. The designation is built on the registers of ICT contracts that you reported yourselves. The supervisor knows who you depend on.
Why a document fails the test
The typical exit plan is a chapter in the outsourcing policy. It names an alternative provider, gives an estimate in months and appoints an owner. Nobody has run it.
In February and March 2026 Deloitte asked 50 financial entities in 13 European countries. 39 % had no documented exit plan yet for the ICT providers behind critical functions that they cannot replace. Asked how they test for a provider going insolvent or shutting the service down, the largest group, 36 %, said they have a plan on paper and no live test. 10 % simulate the move itself or a failover.
Three out of four move nothing when they test an exit
How financial entities test for a critical ICT provider going insolvent or shutting the service down.
- Nothing is moved
- 76 %
- Documented plan, no live test 36 % · Tabletop exercise with the provider 15 % · Independent review 14 % · Regulatory, legal and crisis communication exercise 11 %
- Data is moved
- 14 %
- Data portability test 14 %
- The system is moved
- 10 %
- Simulated migration or failover 10 %
An estimate without a run is a guess. The dependencies hide in the managed services: identity, queues, databases, key vault, monitoring. Every proprietary service in the critical path needs a substitute before you can move. The document rarely says which, or what the substitute is.
A review around a table tests the document. It does not test the move. The transition period in the contract only helps if you know what to use it for, and how long it takes.
Margrethe Vestager, EU competition commissioner until 2024, has put three questions to Danish IT chiefs. The last one is: “And what is my plan B?” She points to the banks herself, which must have backup systems: “They can’t just run on one technology and say they’re crossing their fingers and have good security.” An exit plan nobody has run is crossed fingers.
What a rehearsed exit is
Three things turn the exit plan into something that can be run.
Infrastructure as code. When the landscape is described in Terraform or OpenTofu, the move is a new, thin layer for the new provider. The rest is reused. If it was built by hand in a portal, the move starts with finding out what was built.
Open source in the critical path. Kubernetes, PostgreSQL, a standard for message queues, OpenTelemetry for monitoring. They run at every European provider, as a managed service or on your own machines. Where you use a proprietary service, its substitute is written down next to it.
A second provider and a measured number. Bring a real workload up at another European provider in a test environment. Record the hours, and what had to be rewritten. Repeat it once a year. That number is the core of the exit plan, and it is what the supervisor can read.
The Danish Agency for Labour Market and Recruitment (STAR) moved all of its core systems in nine months, from a Microsoft-dominated setup in its own operation to open source as code at Hetzner, 65–70 % cheaper than the hyperscalers. The agency also has contracts with Scaleway and OVHcloud, so all or part of its operation can move again. STAR is not covered by DORA. Even so, the setup is exactly what DORA asks for: an exit with two doors.
We have done the same on a smaller scale. Kvarters is a platform of eight applications in containers, built on Azure with Terraform. In 2026 we moved it to Scaleway in Amsterdam in five weeks without touching the applications.
Where to start
Find the critical or important functions in your register of ICT contracts, and pick one workload.
List the proprietary services in its critical path, and write a substitute next to each.
Describe the workload as code, if it is not already.
Bring it up at another European provider. Record the hours and what had to be rewritten.
Write the number into the exit plan, and repeat in a year.
This holds if you stay with the hyperscaler too. A rehearsed exit does not commit you to using it. It means the exit plan holds on the day you need it.