Picture a Tuesday morning in February 2026. While Frankfurt traders still queue for their third espresso, a Joint Examination Team (JET)—six regulators from three countries and two continents—walks into a nondescript WeWork near the Schuman roundabout. Their mission: open the laptops of a U.S. hyperscaler and ask, “Show us your full dependency map of EU banks.”
This is no drill. This is DORA oversight, Year One, and the script was just published.

🚨 90-Second Drill for Non-EU Executives

• Who is targeted: Any ICT provider whose outage could freeze EU payments, trading or insurance.

• Threshold: Serve ≥10 % of EU financial entities or ≥10 % of total EU banking assets.

• Designation Day: October 2025 (public list, instant fee invoice).

• Inspection Start: Q1 2026, led by JETs—cross-border SWAT teams with document seizure rights.

• Price Tag: €1–1.5 m flat fee in 2025, risk-weighted afterwards. Refuse to cooperate? Daily fines and public naming.

🎯 The Four Horsemen of Criticality

The ESAs will run 11 sub-criteria distilled into four headline questions:

1. “If you sneeze, does Europe catch a cold?”
   (Systemic impact of a large-scale failure.)

2. “Do the giants rely on you?”
   (Share of G-SIIs or ≥3 O-SIIs using your service.)

3. “Are you the only needle in the haystack?”
   (≥10 % of banks say they have no substitute.)

4. “Could anyone move away in less than a year?”
   (Degree of substitutability and migration pain.)

Answer “yes” twice and you’re in.

🗓️ 2025 Survival Calendar

💸 Wallet, Reputation, Strategy

• Direct Cost: 2025 fee split equally among CTPPs; afterwards scaled by assets of EU clients. Expect a claw-back clause if you onboard new banks mid-year.

• Indirect Cost: If the JET finds “material deficiencies,” your EU clients may face capital add-ons—pressure that flows straight into renegotiated contracts.

• Opt-in Option: Feeling left out? Voluntary designation carries a €50 k non-refundable application fee.

🏢 Set Up Your Brussels “Embassy”

The ESAs’ slide deck is blunt: “We will not chase subsidiaries across time zones.”
Non-EU providers must stand up an EU hub with:

• Power of Attorney: Senior manager able to commit the global board.

• Data Room: Real-time access to all logs, source-code repositories and subcontractor SLAs.

• War Room: Physical space for 12 regulators for up to two weeks.

🔮 Early-Watch List (Unofficial, Based on Public Data)

*Source: ECB ICT outsourcing survey 2024, anonymised.

🎙️ Quote to Print on the Board Pack

“DORA moves oversight from national questionnaires to supranational raids. The JETs will be the new SWIFT inspectors—only with sharper teeth.”
— Petra Hielkema, Chair, EIOPA (14 May workshop)