Nearshoring in Portugal and DORA: Contract Before Team

Nearshoring · 4 min

For banks, insurers and other EU financial entities, a team in Portugal brings DORA clauses into play. Learn how to classify functions, fix locations and prepare the exit.

Nearshoring in Portugal and DORA: Contract Before Team

TL;DR

A nearshoring team providing ICT services to an EU financial entity may fall under DORA's rules on third-party providers, depending on the contractual model and the activities carried out.
Classifying first whether the service supports critical or important functions determines the level of contractual requirements.
Service delivery and data processing locations, as well as subcontracting, must be made explicit in the contract.
Measurable service levels, audit rights and data return make the relationship supervisable.
The exit strategy must be designed at the start, not at the end of the contract.

Choosing Portugal also means choosing a supervised contract

For a bank, an insurer or a payment institution in another Member State, assessing a nearshoring team in Portugal involves more than talent, cost and proximity. Since 17 January 2025, Regulation (EU) 2022/2554, known as DORA, has applied to EU financial entities and frames how they contract information and communication technology (ICT) services from third parties. Depending on the contractual model and the activities actually performed, an external team that develops, operates or supports a financial entity's systems may fall within a relationship with a third-party ICT service provider for DORA purposes. It is therefore important to distinguish the contracting of ICT services from the mere provision of human resources, assessing the specific framework of each relationship. In this scenario, the contract stops being just a commercial instrument and becomes part of risk management. The useful question for the decision-maker is how to design the agreement and the team so that compliance does not have to be rebuilt after kick-off.

Function classification defines the level of requirements

Article 30 of DORA sets out a number of minimum contractual provisions applicable to arrangements for the use of ICT services covered by the regulation, providing for additional requirements when those services support critical or important functions. A team maintaining low-impact internal tools and another operating the payments platform are not on the same level. This classification is the responsibility of the financial entity and should precede negotiation, because it shapes the clauses, the information to be recorded and the supervisory effort. It is good practice to align it with the nearshoring operating model, so that the division of responsibilities reflects the risk of each service.

Location and subcontracting must be put in writing

The contract must clearly identify the ICT functions and services provided, indicate whether subcontracting of services supporting critical or important functions, or material parts thereof, is permitted, and set out the conditions applicable under the regulatory framework. It must also identify the regions or countries where the services are provided and where data is processed and stored, providing for prior notification of changes to those locations. In nearshoring, this requires mapping more than the office address: remote work, the provider's other delivery centres, independent professionals and collaboration tools hosted in other territories. The fact that Portugal is part of the European Union may simplify the analysis of data protection obligations, but it does not remove the need for these clauses or for verifying the tools used by the team.

Service levels and audit make the relationship verifiable

For ICT services supporting critical or important functions, the regulation requires service level descriptions with precise quantitative and qualitative targets, obligations to report developments with a material impact, and rights of access, inspection and audit in favour of the financial entity, of third parties appointed by it and of the competent authorities, as applicable. In practice, a nearshoring team's metrics should measure outcomes and availability, not just billed hours. Access logs, evidence of controls and periodic reports facilitate supervision, in a line of reasoning close to what we advocate in evidence before scale.

The exit is prepared on day one

Contracts covered by Article 30 must provide for mechanisms ensuring access to, recovery of and return of personal and non-personal data, in an easily accessible format, in the event of insolvency, resolution or discontinuation of the ICT service provider's operations, or termination of the contractual arrangement. Where ICT services support critical or important functions, specific requirements on exit strategies also apply, including adequate transition periods that reduce the risk of service disruption. In addition, financial entities must maintain and update a register of information on contractual arrangements for the use of ICT services provided by third parties, making it available to the competent authorities under the applicable regulatory terms. For an external team, reversibility requires, among other things, documented knowledge: runbooks, architecture documentation, proper access management and mechanisms ensuring knowledge transfer and operational continuity. Those evaluating an IT outsourcing model can treat these elements as provider selection criteria.

Compliance by design, not added on

DORA does not prevent nearshoring in Portugal, but it conditions how it is contracted and operated. The level of requirements varies with the type of entity, the criticality of the functions, the principle of proportionality and the interpretation of the competent supervisory authority, so the clauses should be reviewed with the legal and compliance teams. Classifying functions, making locations explicit, measuring the service and preparing the exit from the outset can help reduce the risk of late and costly adjustments.