Critical Information and Communications Technology Service Providers Under DORA

The ESAs announced on November 15, 2024, that the registers of information must be submitted by competent authorities (i.e., national EU financial services regulators) to the ESAs by April 30, 2025, to assist the ESAs with identifying and designating critical ICT Providers (CTPPs). Our overview of the registers of information and compliance obligations to be undertaken by financial entities can be found here.

CTPPs are ICT Providers whose services support “critical or important functions,” the disruption of which would materially impair the financial performance of a financial entity or its compliance with the conditions and obligations of its authorization or obligations under financial services law, or the soundness or continuity of its services and activities. The oversight framework introduced by DORA for CTPPs aims to address concentration risks posed by the financial sector’s reliance on a small number of ICT Providers by imposing direct regulatory obligations on CTPPs.

Critical ICT Providers: Criteria and Designations
The ESAs will designate CTPPs based on financial entities’ registers of information, which must be completed and submitted by financial entities to competent authorities by January 17, 2025. The designations are expected to take place in the second half of 2025 following the competent authorities’ April 30, 2025, deadline to submit the registers of information to the ESAs.  

The designations will be based on the following criteria:

• The systemic impact on the financial entity’s stability, continuity or quality of its provision of financial services should the ICT Provider face a large-scale operational failure;
• The systemic character or importance of the financial entities that rely on the ICT Provider, assessed based on the number of and interdependence between global systemically important institutions or other systemically important institutions that rely on the ICT Provider;
• Financial entities’ reliance on ICT services for critical or important functions provided by the same ICT Provider (regardless of whether financial entities rely on those services directly or indirectly through subcontracting arrangements);
• The degree of substitutability of the ICT Provider, taking into account the lack of alternatives (due to limited numbers of ICT Providers in a specific market, the market share of the ICT Provider, the technical complexity involved or the specific features of the ICT Provider) and the difficulties in partially or fully migrating relevant information from the ICT Provider to another ICT Provider (due to costs, time or other resources drain, or increase of ICT risks or other operational risks arising during the migration).

The criticality assessment follows a two-step approach detailed in a delegated regulation adopted by the European Commission in February 2024. In the first step, ICT Providers will be assessed against quantitative indicators and minimum relevance thresholds. In the second step, the qualitative assessment of ICT Providers is more detailed and uses additional criticality metrics. The delegated regulation includes certain parameters, including, for example, how the degree of substitutability of the ICT Provider will be defined and calculated.

As part of the ESAs’ voluntary dry-run exercise for financial entities to complete the registers of information, the ESAs will organize a workshop to share their general findings, observations and outcomes of the dry-run exercise with the industry on December 18, 2024. The ESAs are expected to publish a report with high-level observations on data quality following the workshop. It is expected that the workshop and report will provide further clarity on which ICT Providers are likely to be designated as CTPPs.

Oversight Framework for CTPPs
Following completion of the first designations in 2025, the ESAs will publish an updated list of CTPPs on an annual basis. Although DORA does not explicitly specify a designation challenge mechanism or process, within six weeks of the ESAs’ CTPP assessment, the ICT Provider can submit a “reasoned statement” setting out any relevant information for the purpose of the assessment, the implication of which is that such response would be the ICT Provider’s opportunity to raise any concerns or dispute the designation. The ESAs will review the statement prior to making a final decision on designation.

The ESAs, as part of their oversight activities and in conjunction with competent authorities (such as local regulators), may request information from CTPPs, conduct off-site investigations and onsite inspections, impose penalties and issue recommendations to CTPPs. Further powers assigned to the ESAs include establishing rules relating to ICT-related incidents, such as deadlines for timely reporting.

ICT Providers can also apply to be designated as CTPPs on a voluntary basis. However, the process to do so is cumbersome and requires that ICT Providers submit substantial amounts of information (mirroring the information requirements for financial entities’ registers of information) to the ESA. Given the onerous application requirements and oversight fees (discussed below), any benefit gained by an ICT Provider, such as enhancing customer trust in a vendor that is subject to direct regulatory oversight, is unlikely to be a significant motivator for voluntary CTPP applications.

Oversight Fees Payable by CTPPs
CTPPs are required to pay an annual oversight fee to the ESA appointed as their “Lead Overseer” on a single installment basis to account for the direct and indirect costs of the Lead Overseer and the ESA’s oversight duties, with the oversight fee expected to fluctuate year-on-year.

For the first published list of designated CTPPs, the oversight fees will be equally split between the CTPPs based on the overall estimated expenditure of the Lead Overseers and the number of designated CTPPs. Where an ICT Provider is designated as critical after the first list is published, that ICT Provider will pay a fixed fee for its first year of designation at the same level as the CTPP on the first published list. This fee will be calculated on a pro rata basis where the first year of designation is not a complete calendar year.

For subsequent years, a minimum fee of EUR 50,000 will be payable by the CTPP to the Lead Overseer. Any amount payable above this figure will be proportionate to the CTPP’s turnover generated from the ICT services it provides to financial entities within the scope of DORA. The CTPP’s turnover will be calculated based on financial information, including audited figures of turnover generated from ICT services provided to financial entities within the EU, with such figures to be provided to the Lead Overseer by December 31 each year. If the deadline is not respected, the Lead Overseer will calculate the oversight fee based on worldwide, rather than EU, turnover.

Preparations for DORA
ICT Providers should assess their financial entity clients and those clients’ functions supported by the ICT Provider, particularly in light of a potential CTPP designation, to be able to support its clients with the completion of the registers of information. It will be important for ICT Providers to ensure that their internal teams and functions handling DORA compliance are appropriately trained and aligned on the ICT Provider’s approach to client enquiries and requests.

ICT Providers will also need to review and analyze their contractual arrangements with subcontractors engaged to the provision of ICT services to financial entities. The current draft delegated legislation under DORA grants financial entities broad monitoring and information rights over the entire chain of ICT Providers’ subcontractors, and so ICT Providers will need to ensure that appropriate terms are flowed down in their subcontracts.

ICT Providers should also consider whether to prepare any external DORA materials that can be provided to clients to provide information on the ICT Provider’s DORA compliance and approach.

The ESAs also published, on November 15, 2024, a list of validation rules, which can be accessed here, that will be used by the ESAs to analyze the registers of information. These rules, in addition to an updated data point model and taxonomy, will be republished as part of an updated technical reporting package in December 2024. ICT Providers may benefit from using the validation rules and wider technical reporting package to facilitate their analysis of subcontractors and their position vis-à-vis financial entities.

Conclusion
With only a few weeks until DORA’s compliance deadline, ICT Providers should now be engaging in preparations to ensure compliance. While the initial CTPP designations are not expected until the second half of 2025, ICT Providers that are concerned about fulfilling the designation criteria should conduct internal analysis on the services they provide to financial entities (and which functions they support). We will be closely following any further developments.

The authors would like to thank trainee solicitor Anahita Shahrokh for her contributions to this Client Alert.