Service level agreement
SLAAlso called service level schedule, service levels
A service level agreement (SLA) is the part of a contract that sets measurable performance targets for a provider, such as availability, response time and incident resolution. It also defines how performance is reported and what happens when targets are missed. Regulated firms use SLAs to monitor outsourced and critical third-party services.
How it works
A firm agrees quantitative targets with the provider, for example system uptime, ticket response times and recovery times after an outage. The provider reports against them monthly or quarterly. The vendor owner reviews breaches, applies service credits where the contract allows, and escalates repeated failures. SLA data feeds the firm's ongoing monitoring of the arrangement and its third-party risk reporting to senior management.
Regulators treat service levels as a control, not a commercial detail. DORA requires contracts for critical or important functions to include full service level descriptions with precise quantitative and qualitative targets. Recovery targets in an SLA also need to sit within the impact tolerances a UK firm sets for its important business services, or the firm cannot rely on the provider during disruption.
The rules
Article 30 requires ICT contracts for critical or important functions to include full service level descriptions with precise quantitative and qualitative performance targets.
EU financial entities and their ICT third-party service providersRequire agreements for critical or important functions to state service levels with precise quantitative and qualitative targets. EBA/GL/2026/09 will repeal them once it applies.
Credit institutions, investment firms, payment and e-money institutionsExpects written agreements for material outsourcing to define service levels and the reporting the firm needs to monitor performance.
Banks, building societies, PRA-designated investment firms and insurersCommon questions
What does an SLA usually measure?
Common measures are availability, response time to incidents, time to resolve faults, recovery time after an outage and accuracy of outputs. Each target has a defined measurement method and reporting period so both sides read performance the same way.
Are service credits enough if a provider fails?
Service credits compensate for missed targets but do not restore a service. Regulators expect firms to pair SLAs with business continuity plans, exit plans and termination rights for critical or important services.
How do SLAs link to operational resilience?
UK firms set impact tolerances for important business services. If a provider's agreed recovery time is longer than the tolerance, the firm needs other measures, such as a backup provider or internal workaround, to stay within it.
