DORA

DORA is the EU's answer to a simple observation: a bank can be perfectly solvent and still fail because a supplier's software stopped working. It sets operational resilience requirements for financial entities, and it reaches their vendors through what those entities are obliged to demand.

Why a vendor feels a regulation it is not subject to

The obligations sit on the financial entity. But an entity cannot meet them without imposing terms on its ICT third parties: register of information, contractual clauses, exit strategies, the right to audit, incident reporting timelines. A vendor that cannot sign those terms cannot be bought by that customer, regardless of how good the product is.

What it changes about selling to a European bank

The technical evaluation is no longer the last gate. A resilience and exit-plan review follows it, and a startup vendor typically fails that review on concentration risk and on the absence of a tested exit plan rather than on anything about the software.

Where Solidus stands

Nothing here is held. That is a statement about our paperwork, not about the architecture, and the two are separately fixable.