§ DORA · Article 32

DORA Article 32: Obligations, Deadlines & Penalties

Regulation (EU) 2022/2554, Article 32 · All obligations · DORA
At a glance
Article 32 of the DORA imposes 12 obligations on ESAs, Joint Committee, Member State and 1 other entity type(s). At least one obligation carries an explicit compliance deadline.
§ Obligations

All obligations under Article 32

Obligation 1
The Joint Committee shall establish the Oversight Forum as a sub-committee to support the work of the Joint Committee and the Lead Overseer in the area of ICT third-party risk. Regulation (EU) 2022/2554, Article 32, Article 32
Obligated entity
Joint Committee
Sector scope
financial sectors
Action required
establish
Deadline
—
Penalty
—
Obligation 2
The Oversight Forum shall prepare the draft joint positions and the draft common acts of the Joint Committee in the area of ICT third-party risk. Regulation (EU) 2022/2554, Article 32, Article 32
Obligated entity
Oversight Forum
Sector scope
financial sectors
Action required
prepare
Deadline
—
Penalty
—
Obligation 3
The Oversight Forum shall regularly discuss relevant developments on ICT risk and vulnerabilities and promote a consistent approach in the monitoring of ICT third-party risk at Union level. Regulation (EU) 2022/2554, Article 32, Article 32
Obligated entity
Oversight Forum
Sector scope
financial sectors
Action required
discuss
Deadline
—
Penalty
—
Obligation 4
The Oversight Forum shall, on a yearly basis, undertake a collective assessment of the results and findings of the oversight activities conducted for all critical ICT third-party service providers. Regulation (EU) 2022/2554, Article 32, Article 32
Obligated entity
Oversight Forum
Sector scope
financial sectors
Action required
assess
Deadline
yearly basis
Penalty
—
Obligation 5
The Oversight Forum shall promote coordination measures to increase the digital operational resilience of financial entities, foster best practices on addressing ICT concentration risk and explore mitigants for cross-sector risk transfers. Regulation (EU) 2022/2554, Article 32, Article 32
Obligated entity
Oversight Forum
Sector scope
financial sectors
Action required
promote
Deadline
—
Penalty
—
Obligation 6
The Oversight Forum shall submit comprehensive benchmarks for critical ICT third-party service providers to be adopted by the Joint Committee as joint positions of the ESAs. Regulation (EU) 2022/2554, Article 32, Article 32
Obligated entity
Oversight Forum
Sector scope
financial sectors
Action required
submit
Deadline
—
Penalty
—
Obligation 7
Each Member State shall designate the relevant competent authority whose staff member shall be the high-level representative referred in paragraph 4, point (b). Regulation (EU) 2022/2554, Article 32, Article 32
Obligated entity
Member State
Action required
designate
Deadline
—
Penalty
—
Obligation 8
Each Member State shall inform the Lead Overseer of the designation of the relevant competent authority. Regulation (EU) 2022/2554, Article 32, Article 32
Obligated entity
Member State
Action required
notify
Deadline
—
Penalty
—
Obligation 9
The ESAs shall publish on their website the list of high-level representatives from the current staff of the relevant competent authority designated by Member States. Regulation (EU) 2022/2554, Article 32, Article 32
Obligated entity
ESAs
Action required
publish
Deadline
—
Penalty
—
Obligation 10
The Oversight Forum shall appoint independent experts from a pool of experts selected following a public and transparent application process. Regulation (EU) 2022/2554, Article 32, Article 32
Obligated entity
Oversight Forum
Action required
appoint
Deadline
—
Penalty
—
Obligation 11
The ESAs shall issue guidelines on the cooperation between the ESAs and the competent authorities covering detailed procedures for task allocation and information exchanges. Regulation (EU) 2022/2554, Article 32, Article 32
Obligated entity
ESAs
Action required
issue
Deadline
17 July 2024
Penalty
—
Obligation 12
The ESAs, through the Joint Committee, shall, on a yearly basis, submit a report on the application of this Section to the European Parliament, the Council and the Commission. Regulation (EU) 2022/2554, Article 32, Article 32
Obligated entity
ESAs
Action required
report
Deadline
yearly basis
Penalty
—
§ Deadlines

DORA compliance deadlines

§ Frequently asked

Questions about Article 32

Who must comply with Article 32 of the DORA? +
ESAs, Joint Committee, Member State, Oversight Forum.
What does Article 32 of the DORA require? +
establish prepare discuss
What is the compliance deadline for DORA Article 32? +
17 July 2024; yearly basis
Need a cross-border briefing on DORA Article 32?
Search Fontvera ↵
All EU obligation pages  ·  All DORA articles