A critical ICT third-party provider is an ICT service provider, such as a large cloud company, that the European Supervisory Authorities designate under DORA because of its systemic importance to the financial sector. A lead overseer among the ESAs supervises it directly and can issue recommendations.
DORA (Digital Operational Resilience Act)DORA, Regulation (EU) 2022/2554, sets uniform rules on ICT risk management, ICT incident reporting, digital resilience testing and ICT third-party risk for almost all EU financial entities. It has applied since 17 January 2025 and also creates EU oversight of critical ICT third-party providers.
ICT third-party riskICT third-party risk is the risk to a financial entity from relying on external providers of information and communication technology services, such as cloud, software and data centres. DORA requires a strategy, due diligence, mandatory contract terms, monitoring, concentration analysis and exit plans for these arrangements.
Register of information (DORA)The register of information is the inventory that every financial entity must keep under Article 28 of DORA of all its contractual arrangements for ICT services with third-party providers, flagging those that support critical or important functions. Supervisors collect it in a standard format set by implementing technical standards.
European Supervisory Authorities (ESAs)The European Supervisory Authorities are the EBA (banking), ESMA (securities and markets) and EIOPA (insurance and pensions), created in 2011. They draft technical standards, issue guidelines and Q&As, coordinate national supervisors and, in some areas, supervise firms directly. Their Joint Committee handles cross-sector work.
European Supervisory Authorities (ESAs)The European Supervisory Authorities are the EBA (banking), ESMA (securities and markets) and EIOPA (insurance and pensions), created in 2011. They draft technical standards, issue guidelines and Q&As, coordinate national supervisors and, in some areas, supervise firms directly. Their Joint Committee handles cross-sector work.
DORA (Digital Operational Resilience Act)DORA, Regulation (EU) 2022/2554, sets uniform rules on ICT risk management, ICT incident reporting, digital resilience testing and ICT third-party risk for almost all EU financial entities. It has applied since 17 January 2025 and also creates EU oversight of critical ICT third-party providers.