IT Outsourcing in Regulated Sectors: BaFin, DORA and BSI

What applies to IT outsourcing in regulated sectors

IT outsourcing in regulated sectors is not just a commercial procurement. When a bank moves its core banking system to a cloud provider, or an insurer hands its claims platform to a service company, supervisory law demands that the regulated entity keeps control, that the supervisor keeps access, and that the business can survive the provider's failure. In Germany, three bodies of rules overlap: national supervisory statutes such as the Banking Act (Kreditwesengesetz, KWG) and the Insurance Supervision Act (Versicherungsaufsichtsgesetz, VAG); the EU's Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554); and, for entities outside finance, the NIS2 implementation in the BSI Act (BSIG).

The overall principle is the same in every layer: the regulated entity can delegate tasks but not responsibility. Management remains accountable, the outsourced activity must be integrated into risk management, and contracts must give the entity and the authorities the rights they need to monitor, audit and, if necessary, exit.

This article explains each layer, the contract terms that supervisors expect and the practical steps for an IT outsourcing project in a regulated German company in 2026.

Banking and insurance law: § 25b KWG and § 32 VAG

For credit and financial services institutions, § 25b KWG sets the national ground rules. An institution that outsources activities and processes that are material for its banking business must take appropriate precautions to avoid excessive additional risks. The outsourcing must not impair the proper conduct of business or the institution's organisation, and risk management must include the outsourced activities. Institutions must maintain an outsourcing register that records all material and non-material outsourcings (§ 25b(1) KWG). Responsibility of management cannot be transferred to the provider (§ 25b(2) KWG), and BaFin's information, audit and control rights must remain intact, including for providers located outside Germany (§ 25b(3) KWG).

Insurers are subject to a parallel regime. Under § 32 VAG, an insurer that outsources functions or insurance activities remains responsible for all supervisory requirements. The insurer must ensure that it, its auditors and the supervisor can access all data, that the provider cooperates with the supervisor and that the supervisor has access to the provider's premises. For important functions, the insurer must also avoid material deterioration in governance quality and excessive operational risk, and must secure contractual information and instruction rights.

BaFin's Minimum Requirements for Risk Management (MaRisk) for banks add detailed expectations on risk analysis, materiality assessment, contract content and exit planning, and BaFin has published supervisory notices on outsourcing to cloud providers. Those administrative documents interpret the statutes and are reviewed against DORA, so institutions should check the current version on the BaFin website before relying on any specific passage.

DORA requirements for ICT contracts

DORA has applied in Germany directly since 17 January 2025. It covers banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers, fund managers and other financial entities. Chapter V deals with ICT third-party risk. The financial entity remains fully responsible for compliance (Article 28(1)) and must maintain a register of information on all contractual arrangements for ICT services (Article 28(3)). For ICT services that support critical or important functions, it must have exit strategies (Article 28(8)).

Article 30 DORA prescribes minimum contract content. The full contract, including service levels, must be documented in one written document. The table summarises the main elements.

Implementing and delegated acts specify the templates for the register of information and the policy on ICT services supporting critical or important functions, including subcontracting. Providers designated as critical ICT third-party service providers are also subject to direct oversight by the European Supervisory Authorities.

BaFin guidance after DORA: what changed

Before DORA, BaFin's supervisory requirements for IT – the BAIT for banks, VAIT for insurers, KAIT for fund managers and ZAIT for payment institutions – were the main reference documents for IT outsourcing. According to the Deutsche Bundesbank's overview of BAIT and DORA, ZAIT, VAIT and KAIT were repealed at the end of 16 January 2025 to avoid double regulation.

Institutions that must apply DORA's ICT risk management framework are excluded from the BAIT's scope, and the BAIT will be fully repealed at the end of 31 December 2026. The Bundesbank also notes that, under the German DORA implementation act (FinmadiG), DORA applies to certain financial services institutions only from 1 January 2027.

In practice, this means that for most financial entities in 2026 the reference point for IT outsourcing contracts is DORA itself, read together with § 25b KWG or § 32 VAG and the remaining MaRisk outsourcing module. Entities that are not yet within DORA's scope should check whether the BAIT still applies to them until the end of 2026, and prepare for the switch.

NIS2, supply chain security and BSI C5

Outside the financial sector, IT outsourcing by "particularly important" and "important" entities is shaped by the BSI Act implementing NIS2. § 30 BSIG requires such entities to take appropriate, proportionate and effective technical and organisational measures that reflect the state of the art, and lists supply chain security – including security aspects of relationships with direct suppliers and service providers – among the minimum measures. Under § 38(1) BSIG, management must implement these measures and monitor their implementation, and managers who breach that duty can be liable to the entity. Contracts with IT providers therefore need security requirements, incident notification duties, audit rights and evidence of controls.

For cloud services, German buyers often rely on the BSI's Cloud Computing Compliance Criteria Catalogue (C5), which sets minimum security requirements. The BSI states that C5 was fundamentally revised in 2025/26 and recommends that customers obtain and evaluate the audit report initially and annually. Requesting a current C5 or comparable attestation, and making the controls contractually binding, is a pragmatic way to document supply chain diligence.

Healthcare, energy and telecoms companies may also be subject to sector rules, such as the security catalogues of the Federal Network Agency, which can affect where data may be processed and who may access systems.

Intra-group IT outsourcing and shared service centres

Many groups concentrate IT in a shared service company or rely on the parent's global platforms. Supervisory law does not exempt intra-group arrangements. The regulated subsidiary must still assess the arrangement, document it in its registers and secure contractual rights, although supervisors accept that risks may be lower where the group has effective control. Under DORA, intra-group ICT providers are ICT third-party service providers in their own right, so Article 30 applies to the intra-group contract as well.

In practice, intra-group arrangements often fail on documentation rather than substance. Service descriptions are vague, service levels are informal and audit rights exist only on paper. A German subsidiary of a foreign group should ensure that its management can actually obtain information, that data locations and subcontractors are known, and that the exit strategy addresses the scenario in which the subsidiary is sold or the group service is discontinued.

Groups also need to consider labour law and data protection. Transferring IT staff to a service company may be a transfer of undertaking under § 613a BGB, and works councils have information and co-determination rights when new monitoring-capable systems are introduced. Personal data moved within the group requires a legal basis and, where the provider is outside the EU, a transfer mechanism.

Structuring IT outsourcing contracts: a practical sequence

1. Classify the arrangement. Determine whether it is an outsourcing under § 25b KWG or § 32 VAG, an ICT service under DORA, and whether it supports a critical or important function.
2. Risk analysis. Document concentration risk, provider dependency, data location and subcontracting chains before signing.
3. Contract content. Map the draft against Article 30 DORA and the national provisions; add audit, information and termination rights.
4. Subcontracting. Require notice of and objection rights to material subcontractors, and flow-down of key obligations.
5. Exit plan. Prepare a tested exit strategy, transition support obligations and data return formats; align with the Data Act switching rules where relevant.
6. Notifications. Check whether the supervisor must be notified of the planned IT outsourcing and update the register of information.
7. Governance. Assign internal owners, set reporting lines and schedule periodic reviews.

Large cloud providers usually offer financial services addenda that address many DORA points. Entities should still review them line by line: standard addenda may limit audit rights to pooled audits or certifications, which is acceptable only within the limits supervisors allow, and may not cover every termination right DORA requires.

IT outsourcing renegotiation and disputes

Many existing IT outsourcing agreements were signed before DORA and need amendment. Providers are often willing to agree regulatory addenda but resist open-ended audit rights and cost-free incident assistance. A structured renegotiation that distinguishes mandatory terms from negotiable commercial points usually reaches agreement faster than an argument over every clause.

Disputes in IT outsourcing typically concern service failures, transition delays and exit costs. Detailed service levels, step-in rights for critical services and a clear dispute escalation – steering committee, expert determination, then courts or arbitration – reduce the risk that a regulatory problem becomes a commercial standoff. Where the provider is insolvent, the DORA requirement to secure access to and return of data becomes decisive, so data escrow and portability provisions deserve as much attention as pricing.

How TRW & Co helps

We advise banks, insurers, payment institutions, fund managers and NIS2-regulated companies on IT outsourcing and cloud arrangements. We classify arrangements under § 25b KWG, § 32 VAG and DORA, draft and negotiate contracts and regulatory addenda with providers, set up registers and exit strategies, and support communication with supervisors. For providers, we prepare DORA-compliant terms for financial sector customers. Our work connects with our financial regulation and cybersecurity and NIS2 practices and with our guide to SaaS and cloud contracts. Please contact us to discuss a project. This article is general information and not legal advice.