DORA Article 31: Obligations, Deadlines & Penalties

The ESAs, through the Joint Committee and upon recommendation from the Oversight Forum, shall designate ICT third-party service providers that are critical for financial entities based on specified criteria. Regulation (EU) 2022/2554, Article 31, Article 31

The ESAs shall appoint as Lead Overseer for each critical ICT third-party service provider the ESA responsible for the financial entities having the largest share of total assets using the services of that provider. Regulation (EU) 2022/2554, Article 31, Article 31

Critical ICT third-party service providers which are part of a group shall designate one legal person as a coordination point to ensure adequate representation and communication with the Lead Overseer. Regulation (EU) 2022/2554, Article 31, Article 31

The Lead Overseer shall notify the ICT third-party service provider of the outcome of the assessment leading to the designation. Regulation (EU) 2022/2554, Article 31, Article 31

Within 6 weeks from the date of notification of the assessment outcome, the ICT third-party service provider may submit to the Lead Overseer a reasoned statement with any relevant information for the purposes of the assessment. Regulation (EU) 2022/2554, Article 31, Article 31

The Lead Overseer shall consider the reasoned statement submitted by the ICT third-party service provider and may request additional information to be submitted within 30 calendar days of the receipt of such statement. Regulation (EU) 2022/2554, Article 31, Article 31

After designating an ICT third-party service provider as critical, the ESAs, through the Joint Committee, shall notify the ICT third-party service provider of such designation and the starting date as from which they will effectively be subject to oversight activities. Regulation (EU) 2022/2554, Article 31, Article 31

The ICT third-party service provider shall notify the financial entities to which they provide services of their designation as critical. Regulation (EU) 2022/2554, Article 31, Article 31

The Commission is empowered to adopt a delegated act to supplement this Regulation by specifying further the criteria for designation by 17 July 2024. Regulation (EU) 2022/2554, Article 31, Article 31

The ESAs, through the Joint Committee, shall establish, publish and update yearly the list of critical ICT third-party service providers at Union level. Regulation (EU) 2022/2554, Article 31, Article 31

Competent authorities shall, on a yearly and aggregated basis, transmit the reports referred to in Article 28(3) to the Oversight Forum. Regulation (EU) 2022/2554, Article 31, Article 31

The Oversight Forum shall assess the ICT third-party dependencies of financial entities based on the information received from the competent authorities. Regulation (EU) 2022/2554, Article 31, Article 31

ICT third-party service providers not included in the list of critical providers may request to be designated as critical by submitting a reasoned application to EBA, ESMA or EIOPA. Regulation (EU) 2022/2554, Article 31, Article 31

EBA, ESMA or EIOPA, through the Joint Committee, shall decide whether to designate an ICT third-party service provider as critical and notify the provider of the decision within 6 months of receipt of the application. Regulation (EU) 2022/2554, Article 31, Article 31

Financial entities shall only make use of the services of an ICT third-party service provider established in a third country and designated as critical if the latter has established a subsidiary in the Union within 12 months following the designation. Regulation (EU) 2022/2554, Article 31, Article 31

The critical ICT third-party service provider referred to in paragraph 12 shall notify the Lead Overseer of any changes to the structure of the management of the subsidiary established in the Union. Regulation (EU) 2022/2554, Article 31, Article 31