This content was originally published in 2024 and updated on October 22, 2026.
Verification Of Payee is a critical outsourced service, which puts your VOP provider inside the scope of your DORA assessment. This blog sets out the evidence SurePay gives you for that assessment: how the service is built to stay available, what sits in the contract, what remains yours to decide.
What are the requirements from DORA?
DORA has applied across the EU since January 17, 2025. It sets uniform requirements for ICT risk management, incident response, and the management of third-party providers, so that the financial sector stays resilient in the event of severe operational disruption.
Why VOP sits in scope
Since October 9, 2025, the Instant Payments Regulation has required Payment Service Providers in the euro area to offer Verification Of Payee. VOP helps prevent fraud and misdirected payments and it sits in the payment flow itself. That changes what an outage means. If your VOP service goes down, you cannot provide the verification the regulation requires and your payers lose the protection it exists to give them. Classifying critical or important functions is each bank’s own call under DORA, but for most banks this reasoning will put VOP on that list, along with the continuity and resilience requirements that come with it.
What this means for your assessment
DORA asks you to assess and manage risk of a critical outsourced service and reach a conclusion you can defend. Some banks conclude a single, well-governed provider is the right answer. Others conclude they need a second. Either can satisfy the assessment. What matters is the evidence behind it.
Responsibility for the assessment stays with you. That is deliberate in the regulation. Outsourcing a service does not outsource accountability for it.
What SurePay gives you
SurePay operates in national verification schemes across Europe and our ICT risk management is built around keeping that service continuously available.
We give you the evidence, in two parts: the resilience and controls behind the service, and the contractual commitments we include as standard.
How the service stays resilient
Your data is held and processed in a secure, controlled, and confidential environment. Our Information Security Management System (ISMS) covers:
- Standards, procedures, and measurements to identify, mitigate, monitor, report, and remediate security risks, documented and implemented in line with ISO 27001
- A security incident management system
- A disaster recovery plan that is tested
We test our business continuity and disaster recovery plans annually, across every service we offer, against the recovery times in our Service Level Agreement. SurePay maintains a SOC 2 Type II attestation report aligned to ISO/IEC 27001:2022. Your auditors can rely on these during their own annual account audits and we can answer their enquiries directly. Our Trust Center holds our certifications, security documentation, and policies.
Our critical services run across multiple availability zones (AZs) and multiple regions in Amazon Web Services (AWS) in EU with active-active setup. This matters to your assessment because it removes a single region as a point of failure without requiring anything of you.
We also hold our own supply chain to the same standard. We carry out comprehensive checks, security audits, and due diligence on all critical subcontractors, and vendors.
What sits in our contract
For critical functions, DORA expects both resilience evidence and documented exit arrangements. Our DORA Addendum sets out the ICT risk management, incident reporting, and audit rights provisions. Your contract with SurePay covers:
- your data returned in a defined format
- transition assistance
- your right to audit SurePay
- incident notification
You can read the DORA Addendum before you talk to us.
How SurePay works with you
Digital operational resilience is a chain responsibility. For our part, we provide evidence of our security standards when requested, support auditing requirements, and keep you fully informed if a security incident affects your service.
SurePay gives you the evidence. The conclusion is yours.
To see the evidence for your own assessment, schedule a meeting with our team.
