Lugano providers and Italian banks: the reach of DORA

Read the PDF edition (2 pages)

The rules on operational resilience have a cross-border dimension for Lugano. Some Ticino companies provide IT services, software or data processing to banks and financial institutions in Italy. Since 17 January 2025 these clients have been subject to the European Union's Digital Operational Resilience Act (DORA), which requires financial entities in the Union to manage their ICT third-party risk, to include specific provisions in their contracts with ICT service providers and to keep a register of information on all contractual arrangements.¹ A Lugano provider of ICT services to an Italian bank will therefore be asked to accept contractual terms on service levels, security, audit, termination and exit strategies that follow DORA, even though it is itself not subject to the regulation. If a provider were designated as a critical ICT thirdparty service provider at Union level, it would have to establish a subsidiary in the Union. This designation is reserved for large providers, but the contractual requirements reach every provider of a Union financial entity.

The combination of FINMA's outsourcing and resilience circulars, the Swiss reporting obligation for cyber attacks and DORA creates a dense set of requirements for every Lugano institution that uses or provides technology. It also creates a market: the documentation, testing and contractual work required by these rules is carried out by compliance consultants, law firms, audit firms and IT security companies, several of which are based in Ticino and serve clients on both sides of the border.

Essentials. Artificial intelligence supplied by third parties is subject to FINMA Circular 2018/3 on outsourcing when it supports a significant function. FINMA Circular 2023/1, in force since 1 January 2024, adds requirements on ICT and cyber risk, critical data, business continuity and operational resilience, with a deadline of 1 January 2026 for resilience. Since 1 April 2025 banks and other critical infrastructures must report cyber attacks within 24 hours under the Information Security Act. Lugano providers serving Italian banks must meet the contractual requirements of the EU's DORA.

Notes

Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector (DORA), OJ L 333, 27.12.2022, p. 1, applicable from 17 January 2025 (publication data and date confirmed at https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng). ↩

For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of October 2026.

English

Contact

Dr Alexander Ressos, TEP

Rechtsanwalt/Attorney-at-Law

I am a Swiss attorney-at-law and also admitted as a solicitor in Hong Kong and in England & Wales, with almost 25 years of experience.

Together with my multilingual team, including Chinese, Japanese, Korean, Russian, Ukrainian and French native speakers, I advise companies and their owners from around the world on the full range of banking, corporate, commercial and tax law matters in Switzerland, including international tax planning, fiduciary services, and legal family office services including immigration & relocation or real estate investments. My practice has a particular focus on clients from growth and frontier markets in Greater China, Central Asia and the Caucasus, the rest of Asia, the Middle East, Africa and Latin America, and I equally advise clients from Europe and North America. Through an affiliated Swiss trust company, we also take care of the incorporation and ongoing administration of their companies and other structures, including accounting, tax returns and corporate secretarial services, and I serve as a professional director where required. With the support of a network of first-class cooperation partners, I also implement solutions worldwide.

My approach is to act as a trusted advisor who works directly with decision-makers, on an equal footing: I start from what you want to achieve and shape every structure, contract and tax decision around your commercial goals and how it improves your after-tax return. As “lawyers who make it happen”, my team and I stay involved until your company is set up, your structure is in place and your transaction has closed, and we remain available for any follow-on work that may be required. You benefit from bespoke solutions and personal attention, and sound, friendly and practical advice. We are not the lowest-cost provider in the market, nor do we intend to be; our aim is to deliver well-founded, proper solutions and excellent value for money.

Get in touch →

Lugano providers and Italian banks: the reach of DORA

Notes

Setting up or expanding in Switzerland?