C5 attestation and DORA: what banks and insurers also need from cloud service providers

If you supply software or infrastructure as a cloud service to banks, insurers or payment service providers, you have been getting different questions since 2025. This page explains where they come from, what a C5 report contributes to answering them and where contract and operations have to do more. It is general information; which obligations apply in a given case needs a legal assessment.

Who DORA applies to and why cloud service providers are affected

Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA) has applied directly since 17 January 2025 (Article 64). Its obligations are addressed to financial entities. From their point of view, cloud service providers are ICT third-party service providers, and DORA requires financial entities to manage ICT third-party risk as part of their ICT risk management (Article 28(1)). The financial entity shall “at all times, remain fully responsible” for complying with its obligations, even when it uses a service (Article 28(1)(a)).

For the provider this means that DORA works through the contract and through the customer’s questions. Depending on whether your service supports a “critical or important function” of the customer, the requirements are stricter (Article 28(4)(a), Article 30(3)). The customer makes this classification, not you. Ask about it early, because it determines the scope of the contract negotiation. The risk-management and reporting obligations of the BSI Act do not apply to financial entities (Section 28(6) BSIG); your own NIS2 obligations as a cloud service provider remain unaffected, see C5 and NIS2.

Do DORA or BaFin require a C5 attestation?

DORA does not mention C5; according to our full-text search, it does not appear in the text of the Regulation (as of 1 November 2026). The Regulation requires financial entities to enter into contractual arrangements only with ICT third-party service providers “that comply with appropriate information security standards” and, for critical or important functions, to take due consideration of whether the provider uses “the most up-to-date and highest quality information security standards” (Article 28(5)). The Regulation does not specify which evidence demonstrates this.

In its supervisory notice on outsourcing to cloud service providers (“Aufsichtsmitteilung zu Auslagerungen an Cloud-Anbieter”, as of February 2024), BaFin, the German Federal Financial Supervisory Authority, names C5 as an example of evidence that supervised entities can use when assessing the suitability of a cloud service provider, alongside certifications according to ISO/IEC 2700X, SOC 2 reports and audit reports from recognised third parties. The notice describes itself as guidance without new requirements and dates from before DORA applied, which it treats as an outlook in separate boxes. It sets conditions for using such evidence: it must relate specifically to the services used, cover a relevant period and come from a suitable, independent auditor. The entity is expected to analyse the audit report; section V.4.2.3 states that the internal audit function may not rely on such reports alone for material outsourcing.

In practice this means: a C5 type 2 report is evidence that financial customers know from the BaFin notice and can classify. It replaces neither the contractual provisions under Article 30 nor the audit rights of the customer and the supervisory authority.

What a C5 report contributes to DORA obligations

The following table takes the contractual provisions under Article 30 and the pre-contract obligations under Article 28 and sets out next to them what a C5 report supplies. The mapping is our assessment; the wording of the Regulation as published in the Official Journal is binding.

The register of information that financial entities have to keep under Article 28(3) for all contractual arrangements on ICT services needs information from you. Much of it is already in the system description, such as services, locations and subservice organisations. Keep this information in a form you can hand over without the full report.

How to make the C5 report useful for financial customers

Our recommendation for providers with financial customers, in five points:

1. Align the scope with the customer. The report only helps if it covers the services and regions the customer uses. That is also the first condition in the BaFin notice. How to define the scope is covered on C5 scope.
2. Type 2 and periods without gaps. A type 2 report shows operating effectiveness over a period. For ongoing contracts, customers need the subsequent reports; plan the periods without gaps, see type 1 or type 2.
3. Be able to explain deviations. Deviations appear in the report even if the criterion as a whole is considered met. Prepare a short statement for each, with cause, measure and date.
4. Prepare a DORA contract annex. An annex that answers Article 30(2) and (3) point by point and refers to the relevant parts of the report shortens negotiations. Drafting the clauses is a legal question.
5. Organise audit rights. Decide how you carry out audits by customers, appointed third parties and supervisors without disclosing other customers’ data. The C5 report can be the basis on which auditors build their own questions.

Example: account opening as SaaS for regional banks

Fictitious example, not a client. A provider runs a platform for digital account opening with identity verification and document storage as SaaS on an IaaS platform. It has a C5 type 2 report for the platform in a German region. A regional bank classifies the service as supporting an important function.

The bank takes the information into its register of information and its risk assessment. Its internal audit function evaluates the report itself; according to the BaFin notice, it may not rely on the report alone for material outsourcing.

What this page does not settle

Whether your customer is a financial entity within the meaning of Article 2 DORA, whether your service supports a critical or important function and how contract clauses are drafted needs a legal assessment in each case. We have not evaluated further legal acts on DORA or supervisory publications for this page. We read the Regulation on 1 November 2026 as published in the Official Journal; check before making decisions whether it has been amended since.