Software as a Service (SaaS) is a delivery model in which the provider runs an application on its own infrastructure and customers use it over the internet for a recurring fee, without installing or maintaining it. The provider handles hosting, updates, security patches and backups; the customer configures the software and owns its data. Licensed fintechs run core banking, KYC, transaction monitoring, sanctions screening and card processing this way, so vendor failure becomes operational risk: if screening goes down, onboarding stops. Under DORA, Article 30 requires service levels, data location terms and, for critical functions, exit strategies, which click-through terms rarely meet. SaaS businesses are valued on ARR, net revenue retention and gross margin.
SaaS vs PaaS vs IaaS
The three cloud computing models differ in how much the customer manages. With infrastructure as a service, the customer rents servers, storage and networking and runs everything above them. With platform as a service, the provider also manages the operating system and runtime, and the customer deploys its own code. With SaaS, the customer only uses the finished application.
SaaS in fintech
Most licensed fintechs run their core functions on SaaS: core banking and ledger systems, KYC and identity verification, transaction monitoring, sanctions screening, card issuing processors, CRM and customer support. A newly licensed EMI can run almost every regulated process on third-party SaaS before it writes its own code. This lets a small team launch quickly but makes vendor failure a direct operational risk: if the screening provider goes down, onboarding stops.
SaaS contracts under DORA
For EU financial entities, SaaS vendors are ICT third-party service providers under the Digital Operational Resilience Act (DORA). Article 30 requires every ICT services contract to include service level descriptions and data location and access terms. Where the service supports a critical or important function, the contract must also set precise quantitative and qualitative performance targets, notice and reporting obligations on the vendor, and exit strategies with a mandatory transition period. Standard click-through SaaS terms rarely meet this, so firms negotiate DORA addenda or replace vendors.
SaaS pricing and valuation
SaaS businesses are valued on recurring revenue. Annual recurring revenue (ARR), net revenue retention (NRR) and gross margin carry most of the weight because they show how predictable revenue is and how much each customer grows.
An illustrative case: a compliance SaaS provider with €6m ARR, 115% NRR and 80% gross margin will usually be valued on a multiple of ARR. The same €6m earned from one-off implementation projects would be valued on earnings, at a much lower figure, because none of it repeats automatically next year.
SaaS dependencies in fintech acquisitions
When buying a licensed fintech, the SaaS stack transfers with the company, and so do its contracts. Buyers should check change-of-control clauses that let a vendor terminate on acquisition, price escalators at renewal, whether critical vendors are documented in the DORA register of information, and whether data can be exported in a usable format. A target whose core ledger sits on a SaaS contract expiring three months after completion carries a migration risk the buyer will price.