How-to guide: DORA requirements for financial entities and ICT third-party service providers (EU)

Financial entities are required to have in place an internal governance and control framework that ensures an ‘effective and prudent’ management of ICT risk. This extends to the use of services offered by ICT third-party service providers.

Responsibility for defining, approving, overseeing and implementing all ICT risk management arrangements ultimately resides with the management body (often the board or senior management) of the financial entity (see article 5(2) DORA).

The management body must set and approve the digital operational resilience strategy including determining the risk tolerance level; set clear roles and responsibilities for all ICT-related functions and establish governance arrangements and reporting channels; approve, oversee and periodically review policies on business continuity, response and recovery plans and third-party ICT service arrangements; and approve and periodically review the financial entity’s ICT internal audit plans and ICT audits including material changes to them.

With an exception for microenterprises (as defined under article 3 DORA as a financial entity, other than a trading venue, a central counterparty, a trade repository or a central securities depository, which employs fewer than 10 persons and has an annual turnover and/or annual balance sheet total that does not exceed EUR 2 million), the management body must establish a role to monitor arrangements concluded with ICT third-party service providers on the use of ICT services or delegate the role to a senior manager to allocate responsibility for related risk exposure and documentation.

DORA imposes specific training obligations to ensure senior managers are well equipped with sufficient knowledge and skills to manage ICT risks and stay updated on the latest threats and industry best practice. Training should be on a regular basis, commensurate with the ICT risk being managed.

Senior managers must approve sufficient budgets to support implementation and ongoing maintenance of the ICT risk management framework (as referred to in article 6(1)) , including relevant ICT security awareness programmes and digital operational resilience training (article 13(6)) and these should be reviewed periodically.

Chapter II, article 5.

See Quick view: DORA compliance – regulatory requirements, technical standards and guidelines.

Firms will be expected to have a sound, comprehensive and well-documented ICT risk management framework as part of their overall risk management system.

This framework should include, at the least, strategies, policies, procedures, ICT protocols and tools that are necessary to duly and adequately protect all information and ICT assets, including computer software, hardware, servers, as well as physical infrastructures such as premises, data centres and sensitive designated areas.

DORA sets out prescriptive obligations with respect to risk management activities: financial entities should use and maintain updated ICT systems, protocols and tools as well as identify and document all ICT-supported business functions, roles and responsibilities, and the information assets and ICT assets supporting those functions.

Financial entities, other than microenterprises, shall assign the responsibility for managing and overseeing ICT risk to a control function and ensure an appropriate level of independence of this control function to avoid conflicts of interest.

Firms must identify and document all sources of ICT risks and dependencies (and identify those supporting critical or important functions), implement measures to protect ICT systems and assets from risks, and detect unusual activities (eg, ICT network performance or ICT-related incidents). Financial entities must maintain an inventory and update it periodically or in any time there is a major change as identified at article 8(3).

Establish plans to manage communications for internal and external stakeholders, including clients and counterparties and crisis communication plans.

Firms must continuously improve the framework based on lessons learned from external events and the entity’s own IT-related incidents and in most instances this must be reviewed at least annually.

Note regulators can request information and therefore record-keeping and documents should be carefully managed.

Chapter II, article 6 to 16.

See Quick view: DORA compliance – regulatory requirements, technical standards and guidelines.

Promotes and encourages collaboration and the exchange of cyber threat information and intelligence to raise awareness about cyber threats, stay informed, enhance detection and response capabilities and mitigate risks.

Types of information shared can include:

• indicators of compromise such as unusual network traffic patterns;
• tactics, techniques and procedures;
• cybersecurity alerts; and
• configuration tools used to configure systems securely.

Financial entities may voluntarily participate in an exchange of information concerning cyber threats and information within trusted communities to protect the integrity of data shared, and that confidentiality and data protection laws are adhered to so that the information is used appropriately.

Financial entities must notify competent authorities of their participation in information sharing arrangements or of the cessation of their cooperation.

Chapter VI, article 45.

See Quick view: DORA compliance – regulatory requirements, technical standards and guidelines.

DORA applies directly to third-party service providers designated as ‘critical’ by the ESAs. Although no designations have been made yet, DORA outlines a structured approach for categorising these providers.

This approach includes the assessment of several factors as outlined in article 31(2)(a)-(d) DORA including:

• systemic impact and importance – impact of the service provider experiencing a failure or operational failure on the financial entity it is providing services to and the importance of the EU financial entities that rely on the relevant ICT third-party service provider, assessed according to the number of global systemically important institutions (G-SIIs) or other systematically important institutions (O-SIIs);
• reliance – the extent of entity reliance on provision of those services for critical or important functions; and
• degree of substitutability – the ease with which the services and workstreams can be replaced by alternative providers.

Criticality is assessed following a two-step approach. Further detail on the indicators and methods to be used and minimum relevance thresholds is set out here.

ICT service providers may opt in to the oversight regime. The ESAs are advancing in the implementation of this pan-oversight framework with the objective to designate and start the oversight engagement this year. To provide clarity to the market on preparatory activities, the designation process and on the ESA’s oversight approach, the ESA’s plan to organise an online workshop with ICT third-party service providers in the second quarter of 2025 – see roadmap.

Chapter V, section II, articles 31 to 44.

See Quick view: DORA compliance – regulatory requirements, technical standards and guidelines.

For details on the amount of oversight fees to be charged and the way in which those fees are paid

see Quick view: DORA compliance – regulatory requirements, technical standards and guidelines.

New direct oversight framework on a pan-European scale for ICT third-party service providers that are designated, which is a first for EU financial services regulation as these providers are not subject to financial regulatory supervision.

The oversight framework consists of the Oversight Forum (composed of various EU representatives including those from the ESAs, European Commission and member states).

A non-EU provider providing services to financial entities would become subject to DORA and direct financial regulatory supervision if designated as critical and must establish an EU subsidiary if not already established in the EU within 12 months of critical status designation and notify all financial entities it provides services to of the critical designation.

Once an ICT third-party service provider is designated as critical, one of the ESAs will be appointed as Lead Overseer and will be responsible for supervision and oversight of that provider. The ESA acts as Lead Overseer to ensure critical ICT third-party service providers have strategies in place to manage the potential ICT risk to financial entities. The ESA appointed will be the one with the largest share of users for the services, (eg, if banks are the main service users then the EBA will be appointed).

The Lead Overseer will have an oversight role and has extensive powers, including the ability to request information such as governance arrangements or ICT audits to assess compliance, conduct on-site and offsite investigations and inspections into operations and practices, issue recommendations and request reports that the actions or remedies have been undertaken by the critical ICT third-party providers in relation to the recommendations.

The Lead Overseer can impose penalty payments to require compliance (up to 1% of the average daily global turnover of the ICT service provider in the preceding business year) in the event of non-compliance. In extreme cases, where necessary, contracts may be terminated or services suspended.

Certain ICT third-party service providers are exempt from being designated as critical including:

• intra-group ICT service providers (ie, they offer services within their own business group); and
• service providers operating in one single EU member state to financial entities that are only active in that member state.