SLA (Service Level Agreement) is the part of a contract that sets measurable targets for a service, such as availability, response time and time to resolve incidents, and the remedy the customer receives when the provider misses them. In payments it governs merchants and gateways, PSPs and processors, and regulated firms and their technology vendors. Availability is the share of minutes the service was up: in a 30-day month, 99.9% allows 43.2 minutes of downtime and 99.99% about 4.3. The usual remedy is a service credit, often small next to lost sales. Under DORA, Article 30 requires service level descriptions in every ICT contract and precise performance targets for critical or important functions.
What does an SLA contain
A useful SLA defines each metric precisely: what counts as downtime, how it is measured, over what period, and which events are excluded. Typical metrics are availability of the API or processing platform, latency (for example, 95% of authorisation requests answered within 800 milliseconds), support response times by severity, and time to restore service after an incident. Exclusions usually cover scheduled maintenance with notice, customer-caused failures and force majeure.
How is SLA uptime calculated
Availability is the share of minutes in the period when the service was up. In a 30-day month of 43,200 minutes, 99.9% allows 43.2 minutes of downtime; 99.95% allows 21.6 minutes; 99.99% allows 4.3 minutes. Each extra nine cuts permitted downtime by a factor of ten and raises the provider's infrastructure cost accordingly.
SLA vs SLO
An SLO (service level objective) is an internal target, usually stricter than the SLA, that engineering teams aim for so that the contractual commitment is never at risk. A provider promising 99.95% externally might run to 99.99% internally and track it through provider health monitoring.
SLA service credits
The usual remedy is a service credit: a percentage of the monthly fee refunded when availability falls below a threshold. Credits are often small relative to the damage.
An illustrative case: a merchant pays a gateway €8,000 a month under a 99.95% SLA with a 10% credit below that level. A 90-minute outage during a sale costs the merchant €150,000 of lost payments, and the SLA pays €800. This is why merchants with high volume add a second provider and failover routing rather than relying on contract remedies.
SLAs under DORA
For EU financial entities, the Digital Operational Resilience Act makes SLA terms a legal requirement. Article 30(2)(e) requires every ICT services contract to include service level descriptions, including updates and revisions. Where the service supports a critical or important function, Article 30(3)(a) requires precise quantitative and qualitative performance targets that let the firm monitor the service and take corrective action. The same article requires notice and reporting obligations on the provider and exit strategies with a mandatory transition period.
SLAs in fintech due diligence
Buyers of a payment company should compare the SLAs it gives merchants with the SLAs it receives from its own processors, banks and cloud vendors. A firm promising 99.99% to merchants while relying on a processor contracted at 99.9% carries the gap itself. Historic availability reports, credit payouts and DORA Article 30 compliance of key vendor contracts are standard requests.