§ DORA · Article 32
DORA Article 32: Obligations, Deadlines & Penalties
At a glance
Article 32 of the DORA imposes 12 obligations on ESAs, Joint Committee, Member State and 1 other entity type(s). At least one obligation carries an explicit compliance deadline.
§ Obligations
All obligations under Article 32
Obligation 1
The Joint Committee shall establish the Oversight Forum as a sub-committee to support the work of the Joint Committee and the Lead Overseer in the area of ICT third-party risk.
Regulation (EU) 2022/2554, Article 32, Article 32
- Obligated entity
-
Joint Committee
- Sector scope
- financial sectors
- Action required
-
establish
- Deadline
-
—
- Penalty
-
—
Obligation 2
The Oversight Forum shall prepare the draft joint positions and the draft common acts of the Joint Committee in the area of ICT third-party risk.
Regulation (EU) 2022/2554, Article 32, Article 32
- Obligated entity
-
Oversight Forum
- Sector scope
- financial sectors
- Action required
-
prepare
- Deadline
-
—
- Penalty
-
—
Obligation 3
The Oversight Forum shall regularly discuss relevant developments on ICT risk and vulnerabilities and promote a consistent approach in the monitoring of ICT third-party risk at Union level.
Regulation (EU) 2022/2554, Article 32, Article 32
- Obligated entity
-
Oversight Forum
- Sector scope
- financial sectors
- Action required
-
discuss
- Deadline
-
—
- Penalty
-
—
Obligation 4
The Oversight Forum shall, on a yearly basis, undertake a collective assessment of the results and findings of the oversight activities conducted for all critical ICT third-party service providers.
Regulation (EU) 2022/2554, Article 32, Article 32
- Obligated entity
-
Oversight Forum
- Sector scope
- financial sectors
- Action required
-
assess
- Deadline
-
yearly basis
- Penalty
-
—
Obligation 5
The Oversight Forum shall promote coordination measures to increase the digital operational resilience of financial entities, foster best practices on addressing ICT concentration risk and explore mitigants for cross-sector risk transfers.
Regulation (EU) 2022/2554, Article 32, Article 32
- Obligated entity
-
Oversight Forum
- Sector scope
- financial sectors
- Action required
-
promote
- Deadline
-
—
- Penalty
-
—
Obligation 6
The Oversight Forum shall submit comprehensive benchmarks for critical ICT third-party service providers to be adopted by the Joint Committee as joint positions of the ESAs.
Regulation (EU) 2022/2554, Article 32, Article 32
- Obligated entity
-
Oversight Forum
- Sector scope
- financial sectors
- Action required
-
submit
- Deadline
-
—
- Penalty
-
—
Obligation 7
Each Member State shall designate the relevant competent authority whose staff member shall be the high-level representative referred in paragraph 4, point (b).
Regulation (EU) 2022/2554, Article 32, Article 32
- Obligated entity
-
Member State
- Action required
-
designate
- Deadline
-
—
- Penalty
-
—
Obligation 8
Each Member State shall inform the Lead Overseer of the designation of the relevant competent authority.
Regulation (EU) 2022/2554, Article 32, Article 32
- Obligated entity
-
Member State
- Action required
-
notify
- Deadline
-
—
- Penalty
-
—
Obligation 9
The ESAs shall publish on their website the list of high-level representatives from the current staff of the relevant competent authority designated by Member States.
Regulation (EU) 2022/2554, Article 32, Article 32
- Obligated entity
-
ESAs
- Action required
-
publish
- Deadline
-
—
- Penalty
-
—
Obligation 10
The Oversight Forum shall appoint independent experts from a pool of experts selected following a public and transparent application process.
Regulation (EU) 2022/2554, Article 32, Article 32
- Obligated entity
-
Oversight Forum
- Action required
-
appoint
- Deadline
-
—
- Penalty
-
—
Obligation 11
The ESAs shall issue guidelines on the cooperation between the ESAs and the competent authorities covering detailed procedures for task allocation and information exchanges.
Regulation (EU) 2022/2554, Article 32, Article 32
- Obligated entity
-
ESAs
- Action required
-
issue
- Deadline
-
17 July 2024
- Penalty
-
—
Obligation 12
The ESAs, through the Joint Committee, shall, on a yearly basis, submit a report on the application of this Section to the European Parliament, the Council and the Commission.
Regulation (EU) 2022/2554, Article 32, Article 32
- Obligated entity
-
ESAs
- Action required
-
report
- Deadline
-
yearly basis
- Penalty
-
—
§ Frequently asked
Questions about Article 32
Who must comply with Article 32 of the DORA?
+
ESAs, Joint Committee, Member State, Oversight Forum.
What does Article 32 of the DORA require?
+
establish prepare discuss
What is the compliance deadline for DORA Article 32?
+
17 July 2024; yearly basis